Who hacked the Spanish PM's phone?: Intelligence services probe Rabat's possible use of Pegasus

Morocco is reportedly being investigated by Spanish intelligence agencies as the source behind the malware targeting several Spanish officials' phones after news broke of the hacking on Monday.

The Spanish government announced Monday that the mobile phones of Pedro Sánchez, the prime minister, and Margarita Robles, the defence minister, were both infected last year with the Pegasus spyware.

Officially, the Spanish National Intelligence Centre (CNI) often avoids pointing fingers at a specific party. Yet, it insists that only states can have the infamous Israeli malware, confirming that the targeting of the Spanish officials was conducted by an unknown "external" party since any such monitoring in Spain requires judicial authorisation.

On Tuesday, the leading Spanish newspaper El Correo reported that the "CNI is investigating the role of the secret services of Rabat in the targeting. " A narrative that several Spanish media have also supported.

Furthermore, the British newspaper the Guardian also reported Tuesday that more than 200 Spanish mobile numbers were highlighted as possible targets for surveillance by an NSO Group client believed to be Morocco, according to the data leak investigated by the Pegasus project.

The Guardian's report reinforces the ongoing theory that Rabat might be behind hijacking the Spanish officials' phones.

On its part, the Spanish government said the targeting of the prime minister have taken place in May and June last year - a particularly turbulent time in Spanish politics. 

In April 2021, Moroccan-Spanish ties hit a low following Madrid's allowance to Brahim Ghali, the Polisario leader and Morocco's main enemy, to be treated for Covid-19 in Spain.

Over the following days, more than 8,000 people crossed from Morocco to the Spanish-controlled enclave of Ceuta. Morocco has denied Spain's accusations of using immigrants to blackmail the European country.

The Moroccan-Spanish year-long diplomatic dispute ended in March when the Spanish PM reversed decades of Spain's neutrality on the Western Sahara conflict, announcing that Madrid supported Morocco's autonomy plan for the disputed territory. 

The socialist leader's decision to walk away from his predecessors' neutral policy has put him under backlash from various quarters, including the opposition and members of his party. 

The Spanish government's spokesperson has refused to directly comment on whether Morocco may have been behind the Pegasus attack, and if confirmed, how this could impact diplomatic ties between the two countries.

"It's a bit hypothetical to talk about what the consequences could be – if we're able to find out where the attack came from," said Isabel Rodríguez, the Spanish government’s spokesperson on Tuesday, sidestepping a question on the probability of Rabat's responsibility. 

"But what we're clear about is that this attack was external and illicit. Those are the certainties we can use to make decisions at the moment," added Rodríguez.

Pegasus is produced and sold by Israeli surveillance company NSO Group. NSO Group claims that it only sells its products to governments and does so solely to assist them in their fight against terrorism and organised crime.

Since last year, Morocco has been at the centre of the Pegasus scandal, when Paris-based media non-profit Forbidden Stories, listed Rabat among the countries that actively use the Israeli malware to spy on journalists, activists and officials.

The investigation project has also accused Rabat's secret services of spying on France's President Emmanuel Macron and the Moroccan King Mohammed VI.

The Moroccan government has denied the accusations and sued the organisations behind the investigation for defamation.

Sánchez's Spanish Socialist Workers' party (PSOE) has vetoed a parliamentary inquiry into the Pegasus scandal, saying that no congressional committee is needed since an internal investigation by Spain's national intelligence agencies was already underway.