Paris Weighed Buying the Spyware Morocco Was Already Using on Its Ministers

Key Takeaways

• France's government explored acquiring Pegasus spyware from mid-2019, with NSO's French reseller pitching French intelligence agencies a price of 60 to 80 million euros.
• At the same time, Morocco had been deploying Pegasus against French officials since at least 2017, including current Prime Minister Sébastien Lecornu.
• A former Moroccan intelligence officer has now detailed how the country's domestic intelligence agency used a private intermediary company to hide its ties to NSO Group.
• The revelations landed the same week Lecornu traveled to Rabat for a high-level reconciliation visit with Morocco.

France Shopped for the Very Spyware Turned on Its Own Government

France briefly explored acquiring Pegasus starting in mid-2019, and it wasn't a passing glance. NSO's official reseller in France met with French intelligence agencies and pitched them a price of 60 to 80 million euros, according to documents reviewed by investigators. French officials spent months weighing whether to bring the world's most notorious spyware in-house.

And, well, at that exact moment, Morocco was already using the same software on French soil. France's own foreign intelligence agency later told investigators that Morocco had been running NSO's tools since at least 2017, targeting French officials with a program the Moroccan government would go on to publicly and repeatedly deny.

Naturally, the same intelligence apparatus doing the vetting was already living the consequences of Pegasus in the wild. President Emmanuel Macron ultimately rejected the purchase, but not before Sébastien Lecornu, then a junior minister for local authorities and now France's prime minister, had already been targeted from July 2019 onward.

So France's government spent part of 2019 pricing out a tool that was, at that very moment, being pointed at one of its own future prime ministers, which turns the whole episode into a procurement meeting happening in the same building as the crime scene.

How Morocco Hid Its Fingerprints on Every Hack

A former Moroccan intelligence officer using the pseudonym Safir has now laid out exactly how his old employer, the domestic intelligence agency DGST, ran its Pegasus program. Officers would obtain a target's IMEI number, get it approved by intelligence chiefs, and send it up the chain "for the infection," as Safir put it.

To keep the DGST's name off any contract, Morocco routed the entire arrangement through a private intermediary, later identified as FSSYS Maroc, a company with ties to a UAE-based defense and intelligence group. "The Israelis don't sign a contract for their system directly with the DGST," Safir said. "That's not how it's done."

The human cost of that setup has names attached. Journalist Omar Radi and human rights activist Maati Monjib were both targeted, both later convicted in proceedings the EU Parliament called flawed, and both eventually pardoned. Amnesty International and Forbidden Stories had already documented the technical evidence years ago. Morocco's government has consistently maintained it "never acquired computer software to infiltrate communication devices," which is a strange claim to keep making once a former employee of your own intelligence service is describing the invoicing process. Morocco is far from the only government running state-sponsored spyware programs that never face real consequences, and it is simply following the well-worn script.

Reconciliation Trip, Same Week as the Receipts

Lecornu is in Rabat this week, leading a delegation of twelve ministers for what his office is calling a "high-level meeting" built around rebuilding trust with Morocco. The timing is almost comedic. The same consortium publishing these new revelations broke the original Pegasus story back in 2021, and five years later, the prime minister who was personally targeted is the one shaking hands and talking partnership.

A government that once priced out this exact spyware doesn't get to play the wounded party now, and reconciling with the state that used it against you without ever forcing a real reckoning is its own kind of confession. France was a prospective customer of the same surveillance industry it now claims victimized it. Journalists in Italy have lived this same cycle, hacked with Paragon spyware while their own governments shrugged, and nothing about the pattern changes country to country.

The procurement meetings don't stop happening just because the last vendor got caught. They just move to the next country willing to sell, and the next government willing to buy, no matter how many ministers, journalists, or activists get hacked along the way.