- Temps de lecture: 15 min.
Moroccan intelligence is believed to have spied on Spanish agents who were training them
Leaked documents and insider testimonies reveal that Morocco used Pegasus to spy on a senior Guardia Civil intelligence officer while secretly monitoring Spanish officers training its intelligence service.
Crédit: Mélody da Fonseca
By José Bautista et Hicham Mansouri
July 17th 2026
In 2021, Spain and Morocco experienced the worst diplomatic crisis in their recent history. In a context marked by the Abraham Accords promoted by the White House, Morocco recognized Israel and, in exchange, Donald Trump recognized Moroccan sovereignty over Western Sahara, a former Spanish province considered by the UN to be a non-self-governing territory pending decolonization and currently under Rabat’s de facto control.
That diplomatic crisis between the two countries materialized in a migration crisis orchestrated by Moroccan intelligence services in the Spanish enclave of Ceuta, on the border with Morocco, and ended with a massacre, this time at the border separating Melilla (Spain) and Nador (Morocco) in june 2022. Spanish Prime Minister Pedro Sánchez’s government avoids confrontation with its Moroccan counterparts and describes the country as a “friend,” “ally” and “strategic partner.” This investigation sheds light on the relationship between the two countries beyond political discourse, focusing in particular on security cooperation between Spain’s Guardia Civil and Morocco’s domestic intelligence service, the DGST.
The origins of this story date back to 2011. That year, the Basque separatist group ETA announced the definitive end of its armed activity, and jihadism became the main obsession of Spain’s security and intelligence agencies. The shift forced major changes across Spain’s security apparatus. Islamist terrorism differed from ETA in that it operated across borders, requiring greater international cooperation. In 2014 Spain’s gendarmerie force Guardia Civil began cooperation with Morocco’s powerful domestic intelligence service, the DGST, a relationship that, until then, had been primarily led by Spain’s National Police and secret service, the Centro Nacional de Inteligencia (CNI).
According to multiple sources, collaboration expanded gradually through official visits, joint counterterrorism work and training sessions in Morocco and Spain.
Over time, the Guardia Civil built working relations and sympathy with senior DGST officials led by Abdellatif Hammouchi. Cooperation between both services expanded to include operational exchanges and institutional meetings. Directors and other senior Guardia Civil officials began traveling to Rabat.
November 11, 2025. Spain’s Interior Minister, Fernando Grande-Marlaska, awards Abdellatif Hammouchi, director of Morocco’s DGST intelligence agency, the Grand Cross of the Order of Merit of the Guardia Civil. Photo: Spanish Ministry of the Interior.
Later, technical staff from the Operational Support Group (GAO), a specialized Guardia Civil unit, all of them fluent in French, launched on-site training sessions to teach their Moroccan counterparts the intelligence and surveillance methods used in Spain. This was followed by joint counterterrorism and irregular migration operations. Informal communication channels were also used, including a joint WhatsApp group, according to well-placed sources familiar with the matter.
DGST officers were hosted in Ceuta, an autonomous Spanish city on the North African coast, as well as in the Spanish cities of Málaga, Marbella and Madrid, among other locations. Photos taken in 2017 and 2018, not published here for security reasons, show several visits to Real Madrid’s stadium; the GAO headquarters in the Spanish capital; and Puerto Banús, Marbella’s luxury marina.
Photo 1: DGST and Guardia Civil officers during a training exercise in Fnideq, near the Ceuta border.
Photo 2: A Guardia Civil officer and a DGST officer during a training exercise conducted in the outskirts of Tangier.
Photo 3: DGST officers Mourad and Amine in front of the Royal Palace in Madrid.
DGST’s note on a joint exercise with Guardia Civil in Spain and Morocco in May 2017.
To build this kind of alliance requires time. Trust did not develop overnight, but by 2017 the DGST and the Guardia Civil already had a solid and friendly relationship. A dozen photos from that period show the closeness between Spanish and Moroccan officers. They pose smiling, joking, sharing informal moments and dinners.
That rapport remains intact to this day. For example, on July 2, 2026, Hammouchi, head of the DGST, received a high-level Spanish delegation led by General Luis Peláez Piñeiro, the top official of the Guardia Civil Intelligence Service. In November of the year prior, Interior Minister Fernando Grande-Marlaska had awarded him the Grand Cross of the Guardia Civil Merit.
This investigation explores the other side of that relationship.
The apparent closeness between both institutions conceals a story of “betrayal,” as a senior Guardia Civil official put it upon learning of the findings of the consortium led by Forbidden Stories. This source played a key role in establishing the cooperation between Guardia Civil and the DGST.
This article is based on leaked documents and photographs, as well as information provided and corroborated by several intelligence sources: a former DGST agent, two Guardia Civil agents, one Spanish National Police officer, and one CNI agent. Each of these sources participated directly in the events described, and provided details that corroborate the facts described here. The evidence was subjected to forensic analysis by Amnesty International’s Security Lab, which confirmed its authenticity.
“We spy on everyone,” Safir* claimed. This source alleged that, without leaving any trace, Moroccan intelligence accessed the communications of Guardia Civil officers while they were in Morocco to train the spies of King Mohamed VI. The agent added that this is also done “just in case.”
[Highlight: Moroccan agents coordinated surveillance of Guardia Civil officers via a WhatsApp group unknown to the Guardia Civil.]
The source described several modus operandi for accessing the communications and files on his counterparts’ mobile devices, which relies on Morocco’s mass surveillance machinery. These processes can also be initiated locally, such as through devices known as IMSI catchers, which imitate mobile phone towers to intercept data, including encrypted messages, in real time from nearby devices. (This description could not be independently verified, but telecommunications experts from Amnesty Lab note that IMSI identifiers are commonly used for operational surveillance in Morocco.)
With this data, Moroccan intelligence can deploy its arsenal of cyber-espionage tools and access communications, including encrypted messages in apps like WhatsApp and Signal, from any phone in its territory with ease and speed. The Spanish National Police reportedly apply stricter precautions when traveling to Morocco, including the use of separate mobile devices for sensitive and non-sensitive communications. But the Guardia Civil’s GAO officers did not take similar precautions.
“We didn’t do it because we did not suspect we would be spied on,” a senior Guardia Civil intelligence officer said. Another source from the same institution and involved in these exchanges said that “our lack of knowledge about Morocco is a problem.” The GAO’s motto is “Videre sine visum,” Latin for “to see without being seen.”
One of the most prominent Guardia Civil officers targeted in this spying campaign was Alberto Aguilera, who served as Interior Attaché at the Spanish Embassy in Rabat between 2012 and 2017. Aguilera was responsible for establishing the Spanish-Moroccan Police Cooperation Center, based in Tangier. After returning to Spain from Morocco, Aguilera was appointed head of the Guardia Civil’s Intelligence Service in Catalonia, yet Morocco continued to monitor him. Aguilera’s personal phone number appears five times on the list of targets selected by Morocco for Pegasus surveillance. Rabat initiated the targeting of his phone on March 8, 2019.
A DGST officer takes pictures from a vehicle during a training session with the Guardia Civil in Morocco.
A former DGST agent corroborates these facts and describes it as “highly unusual” that someone with Aguilera’s profile was later appointed to intelligence-related command positions after serving in Morocco, arguing that “it contradicts basic security protocols.”
Aguilera was promoted to colonel and transferred to Madrid in 2024. He currently heads the Guardia Civil’s Digital Transformation and Technological Innovation Unit.
Within this cooperation framework, Guardia Civil technical units provide training in surveillance and operational techniques to Moroccan intelligence officers, mainly from the Operations Directorate, the most powerful arm of the DGST. According to sources involved, these sessions include methods related to tracking, infiltration, technical intelligence collection and spyware infections on mobile devices and cybercafés.
These trainings serve the “strategic need to maintain a good relationship with the DGST,” explained a Guardia Civil source involved in designing and implementing this roadmap. Spanish officers had to offer something to their Moroccan counterparts to build reciprocity and obtain information in return.
Guardia Civil delivers a seminar to DGST agents in Morocco.
According to Safir, the DGST official who directs the surveillance of Guardia Civil officers in Morocco is named Jaouad (also spelled Jawad), and holds a senior position in the research cell. Jaouad is not a desk officer. His specialty is field operations. This officer acts as right-hand man to the head of the research cell, a senior official who coordinates arrests, including those of journalists and human rights defenders.
Jaouad, a veteran officer of the DGST Investigation Unit, during an operation with Guardia Civil at the Fnideq-Ceuta border.
According to Safir, Jaouad is part of one of the most valuable departments of Morocco’s domestic intelligence service, responsible for surveilling and aggressively targeting independent journalists, human rights activists and critics of the regime. For example, this department played a key role in the surveillance, reputational destruction and imprisonment of journalist Omar Radi, one of Morocco’s first victims of Pegasus, the powerful spyware developed by Israeli firm NSO Group. After serving prison time in a politically motivated case based on fake allegations, Radi went into exile.
[Highlight: Unlike agencies such as Spain’s CNI, UK’s MI5 or France’s DGSI, the DGST does not require judicial authorization to carry out indiscriminate surveillance in Morocco. A former DGST source said that “Guardia Civil agents were surprised by our methods of operation. They were shocked to see that we didn’t have to obtain authorization to spy on someone.”]
Guardia Civil training takes place in real-life operational environments in cities such as Fnideq, near the Ceuta border, as well as Tangier, Rabat, Tetouan, Nador, and Marrakech. The transfer of tactics is unidirectional: Moroccan officers do not share their techniques with the Guardia Civil agents they work with.
Sometimes, these training sessions turn into “real tests.” The difference between drills and real operations was “the long waiting times,” the former DGST agent recalled. The same source says that the Moroccan intelligence service’s first use of drones came thanks to instruction from the Spanish agents in Málaga. Morocco now produces such autonomous devices with Israeli support.
In these internal photographs obtained by the consortium, Guardia Civil officers teach techniques to the DGST during a real operation and inspect the luggage of a suspected human trafficker.
The Guardia Civil taught its secret techniques to the DGST in order to fight jihadism and human trafficking. In recent years, cooperation against drug trafficking has also become more prominent. However, Moroccan intelligence officers also allegedly use this knowledge to repress journalists, human rights defenders, activists and other individuals considered troublesome by the Alaouite regime, according to a former DGST agent consulted for this investigation. No documentary evidence was provided to support this claim.
However, among the Moroccan officers working with the Guardia Civil are some prominent senior figures of the regime’s repressive intelligence apparatus. Moroccan authorities have consistently rejected accusations of unlawful surveillance.
From Guardia Civil’s classroom to the persecution of dissent
1
According to Safir, Fahad works closely with officers of the Spanish Civil Guard.This Moroccan officer played a key role in surveillance operations against journalist Omar Radi and his immediate circle, according to the DGST source who also participated in the Radi case. “The objective was clear: neutralize his investigations,” the former DGST source says.
[Fahad (left, in the blue T-shirt), during a training exercise with the Spanish Guardia Civil in Morocco. This officer coordinates operations to install hidden cameras in the homes of journalists, human rights defenders, and Sahrawi activists, among others. Fahad also compromises Wi-Fi networks using man-in-the-middle (MitM) attacks and plays a key role in the deployment of other spyware tools, including NightHawk’s Interionet.]
[Fahad (left, in the blue T-shirt), during a training exercise with the Spanish Guardia Civil in Morocco. This officer coordinates operations to install hidden cameras in the homes of journalists, human rights defenders, and Sahrawi activists, among others. Fahad also compromises Wi-Fi networks using man-in-the-middle (MitM) attacks and plays a key role in the deployment of other spyware tools, including NightHawk’s Interionet.]2
Khalid receives reports prepared by the Operations Department based on communications intercepted through clandestine means. His unit controls a wide network of fake media outlets in Morocco and other countries (Mauritania, Nigeria, and Ivory Coast, for example) to spread disinformation and defame regime critics. Moroccan intelligence floods the internet with fake news in multiple languages. The Systems Department led by El Hani played a key role in the deployment and operation of Pegasus within Moroccan intelligence.
[Khalid, a senior official at the DGST, during a visit to Real Madrid’s stadium at the invitation of the Spanish Guardia Civil.]
3
According to Safir, Mourad belongs to a unit attached to the Operations Directorate. Mourad carried out spoofing attacks against journalist Omar Radi and took part in the analysis of one of his phones. This official also took part in the arrest of journalist and human rights defender Souleiman Raissouni. “He said nothing, he did nothing, and look what they did to him,” the source said. Raissouni and his family were kept under constant surveillance by the DGST. Several DGST-linked smear outlets, including Chouf TV, Barlamane and Le360, accused him of sexually assaulting a man. Two days after Raissouni published an article denying the allegations and holding the Moroccan authorities responsible, he was arrested and placed in solitary confinement. Raissouni went on a hunger strike and lost 31 kilograms but received little medical care. During his imprisonment, Moroccan authorities fabricated evidence against him and told him that his wife had been unfaithful in an effort to break him psychologically, according to the former DGST officer. Raissouni now lives in exile. 
[DGST agent Mourad taking undercover photos during a training exercise with Spain’s Guardia Civil in Fnideq, near the border with the Spanish enclave of Ceuta in northern Morocco.] A story of betrayals
In 2021 and 2022, Moroccan intelligence spied on Sánchez and several ministers using the Pegasus spyware. These infections started in May 2021 and were reportedly ordered from the Royal Palace in Rabat by Bureau 21, the department of Royal Adviser Fouad El Himma, popularly known as “the king in the shadows.”
The story does not end there. A Spanish secret intelligence report dated May 19, 2021, states that, “The measures to be taken at any given time are planned and managed by Royal Adviser Fouad Ali El Himma,” in relation to the sudden opening of the Ceuta border on May 17, 2021, weaponizing the flow of migration in order to pressure Spain into recognizing Moroccan sovereignty over the disputed territory of Western Sahara. El Himma directly coordinated the strategy with Moroccan Foreign Minister Nasser Bourita and the heads of Morocco’s external (DGED) and domestic (DGST) intelligence services, Yassine Mansouri and Abdellatif Hammouchi, respectively, according to the same secret report. The phones of Sánchez and ministers Fernando Grande-Marlaska (Interior), Margarita Robles (Defense), Arancha González Laya (Foreign Affairs) and Luis Planas (Agriculture) were infected with Pegasus in May and June 2021, according to a judicial investigation conducted in Spain and reviewed as part of this investigation.
The crisis began to ease in 2022 when the Spanish government, at Morocco’s request, fired its foreign minister, Arancha González Laya, for reasons related to the Western Sahara dispute. The two countries restored relations when, in March of that year, Sánchez adopted the Moroccan position on Western Sahara, which was a Spanish province until 1976. Moroccan intelligence made public the letter through which Sánchez formalised his alignment with King Mohamed VI. Three months later, in June 2022, a “miscalculation” by Morocco led to the so-called ‘Melilla massacre,’ when Moroccan security forces, in order to demonstrate their indispensability as guardians of Spain’s border, provoked a mass attempt by migrants to cross the city’s border fence. The incident was the deadliest ever recorded at a European land border—37 people were killed and at least 70 remain missing, according to Amnesty International. Five days later, on June 29, 2022, Madrid hosted the NATO Summit and successfully pushed for the alliance, in its strategic framework, to recognize for the first time the instrumentalisation of migration flows as a hybrid threat.
The Guardia Civil is not the only Spanish state body affected by the volatile loyalty of its Moroccan counterparts. In September 2022, as Spain and Morocco resumed relations after the diplomatic crisis, the head of Spain’s intelligence service traveled secretly to Rabat to meet the Moroccan intelligence chief, Hammouchi. Moroccan intelligence released several photographs of Esperanza Casteleiro with Hammouchi without her consent or prior notice. Another illustrative case of this relationship marked by betrayal emerged in 2023, when an investigation by El Confidencial revealed that Moroccan intelligence had recruited the daughter of the Commissioner General of Information of the National Police.
Following the latest diplomatic crisis, on April 7, 2022, King Mohammed VI invited Spanish PM Sánchez to an iftar – the evening meal that breaks the Ramadan fast – to herald what official statements described as a “new chapter” in relations between the two countries. Among the nine guests was Fouad Ali El Himma, the royal adviser that ordered the espionage against Sánchez and several members of his cabinet with Pegasus. In the official photograph of the meeting, the Spanish flag was displayed upside down, a detail that sparked debate in Spain over Madrid’s handling of its relationship with Rabat. Since then, the Sánchez government’s approach to Morocco has become one of the most controversial aspects of his premiership, yet the Spanish government has never publicly explained what prompted such a dramatic shift in policy. The evidence and testimonies underpinning this investigation make it possible to reconstruct Morocco’s mass surveillance apparatus with far greater precision and invite a re-examination of the evolution of relations between Spain and Morocco in light of these revelations.
The Spanish Ministry of Foreign Affairs did not respond to the questions submitted by Forbidden Stories, but stated that Spanish embassies and consulates have “security measures in place in all countries around the world.”
By the time of publication, the following institutions had not responded to questions submitted by Forbidden Stories:
Spain: Spain’s Ministries of Interior and Defence, and the office of President Pedro Sánchez.
Morocco: DGST, DGED, the Moroccan ministry of foreign affairs, M. Fouad Ali El Himma.
Read also
