The Phone Becomes an Intelligence Office

The mechanism is simple. Intrusion stays centralized. Suspicion spreads everywhere. A security service needs the software, operators, target lists, and permission chain. Everyone else needs only a phone and the knowledge that it might no longer belong entirely to them.

A former member of Morocco’s domestic intelligence service says internal security began using Pegasus in 2017 and deployed it over four years against domestic and foreign targets. Reporting coordinated by Forbidden Stories draws on that testimony, leaked material, targeting records, internal training documents, victim accounts, and forensic work by Amnesty International’s Security Lab. Two other former agents corroborated parts of the account. Morocco has long denied using Pegasus against critics or having a proven relationship with its maker. The allegation is substantial. The denial remains part of the record.

Pegasus collapses several surveillance departments into the object already sitting on the table. Messages, photographs, email, location, microphone, camera. The target buys the battery, maintains the connection, updates the operating system, and carries the sensor into meetings. Procurement has rarely been so considerate.

This is what makes spyware politically durable. Its direct use can be selective while its behavioral reach is broad. A journalist does not need proof that every conversation is monitored to shorten a question. A source does not need a forensic report to stop calling. A foreign official does not need to find an infection before wondering which private exchange has entered somebody else’s archive. Possible access becomes ambient management.

The vendor’s stated boundary is criminals and terrorists. The reported target categories include journalists, rights defenders, politicians, ministers, diplomats, and police officers. That gap is not merely a problem of improper users. It is an incentive built into a tool whose value rises with secrecy and whose abuse is difficult for targets to detect. The customer operates behind classification. The vendor invokes contractual limits. The phone produces no warrant receipt.

Technical defenses matter, as do forensic investigations, export controls, litigation, and vendor accountability. None removes the asymmetry. Infection can occur silently. Verification requires expertise. Public proof arrives slowly, often through international collaborations assembled after the relevant conversations have already happened. The institution acts in real time. Accountability reconstructs the scene later.

The deepest product is therefore not the extracted message. It is compliance before extraction. The possibility of intrusion enters every contact list and closed door, encouraging each person to become a junior security officer inside their own life. One operations room can then occupy thousands of rooms without being seen in any of them.