Pegasus by Proxy: How the UAE Helped Expand Israel’s Regional Surveillance Network

A major investigation into Morocco’s use of Israeli Pegasus spyware has raised serious questions about the United Arab Emirates’ role in spreading sophisticated surveillance technology across the Arab world.

The investigation, coordinated by Forbidden Stories and involving The Guardian and other international media organizations, examined leaked records, internal training materials, victims’ testimony and information supplied by former Moroccan intelligence officers. Its findings suggest that Morocco’s domestic intelligence service began operating Pegasus in 2017 to monitor journalists, human rights defenders, political activists and foreign officials.

At the center of the UAE connection is testimony from a former member of Morocco’s Direction Générale de la Surveillance du Territoire, or DGST, identified under the pseudonym Safir.

According to the whistleblower, the expensive surveillance system may have been purchased by the UAE and provided to Morocco’s intelligence services. Safir described the arrangement as a shared subscription in which Abu Dhabi acquired access to Pegasus and redistributed that access to friendly security agencies.

The claim has not been independently confirmed by documentary evidence establishing a formal transfer agreement. Nevertheless, it presents a disturbing picture of the UAE not merely as a customer of Israeli surveillance technology, but as a possible regional intermediary capable of extending that technology to allied governments.

Pegasus is produced by the Israel-based NSO Group. Once deployed successfully, it can reportedly access messages, emails, photographs and other data stored on a mobile phone. It can also activate a device’s microphone and camera, effectively converting the phone into a remote surveillance instrument.

NSO has maintained that its technology is intended for governments investigating terrorism and serious crime. Yet Pegasus has repeatedly been associated with the targeting of journalists, dissidents, lawyers, diplomats, activists and political officials.

The Morocco investigation provides new detail about how such technology may have entered the country’s security infrastructure.

According to information gathered by the investigative consortium, NSO representatives conducted a detailed demonstration for senior Moroccan intelligence officials and technical specialists at a villa in Rabat in 2017. The property was reportedly associated with FSSYS Maroc, then the Moroccan branch of al-Fahad, a UAE-based surveillance intermediary.

During the demonstration, representatives infected test phones remotely, activated cameras and microphones and accessed private communications. Those present reportedly recognized immediately that Pegasus would allow intelligence officers to penetrate devices without physically obtaining them.

This was a decisive transformation.

Before acquiring access to advanced spyware, Moroccan intelligence relied on human informants, compromised internet cafés and mobile devices preloaded with less sophisticated surveillance programs. Pegasus offered a more powerful and less visible method of reaching high-value targets.

The investigation indicates that Moroccan numbers connected to journalists and human rights defenders began entering the Pegasus targeting system in September 2017. The surveillance activity later expanded beyond Morocco, reportedly reaching activists, journalists and officials connected to Spain and France.

Records examined during the wider Pegasus Project identified more than 200 Spanish telephone numbers selected for potential targeting by an operator believed to be linked to Morocco. Spanish officials later confirmed that the phones of Prime Minister Pedro Sánchez and Defense Minister Margarita Robles had been infected with Pegasus in 2021, although repeated judicial investigations struggled to establish responsibility conclusively.

The UAE-related reports therefore carry implications extending far beyond a single commercial transaction.

They suggest a model of regional surveillance cooperation in which a wealthy Gulf state could purchase advanced Israeli technology and facilitate its use by allied security services. Such an arrangement would allow spyware to circulate through political and intelligence relationships that are often hidden from public scrutiny.

It also raises deeper questions about the security dimension of Emirati-Israeli relations.

Although open diplomatic normalization between the UAE and Israel was formalized in 2020, security and technology contacts between the two countries developed earlier. The Pegasus reports suggest that cooperation in surveillance may have preceded formal normalization and helped establish a regional market for Israeli cyber capabilities.

In that context, normalization cannot be understood solely through embassies, tourism, trade and investment agreements. It has also created or legitimized security partnerships involving intelligence, cybersecurity and surveillance technologies with profound consequences for privacy and civil liberties.

For critics of Abu Dhabi, the findings reinforce concerns that the UAE has positioned itself as a regional hub connecting authoritarian security systems with advanced foreign technology.

The danger is not simply that governments acquire powerful tools. It is that those tools may be transferred, shared or informally distributed among allied intelligence services with limited judicial oversight and almost no public accountability.

The investigation did not establish that UAE authorities personally selected Moroccan surveillance targets. It also reported that the UAE, Morocco, NSO Group and the companies mentioned were approached for comment. Morocco has long denied using Pegasus against critics, while NSO says its products are intended for legitimate law-enforcement purposes.

Those denials must be noted. But they do not remove the need for investigation.

If the whistleblower’s account is accurate, the UAE played a significant role in transforming Pegasus from an Israeli commercial product into an instrument available to a broader network of regional security agencies.

That would make Abu Dhabi more than a passive buyer. It would make it a distributor of digital surveillance power—helping allied governments gain access to technology capable of penetrating the private lives of journalists, activists and officials.

The broader lesson is clear: digital repression does not spread only through software companies. It also spreads through alliances, intermediaries, intelligence partnerships and governments willing to finance systems whose operations remain hidden from the citizens they monitor.

The Pegasus revelations therefore expose the darker side of regional security cooperation: a system in which technology sold in the name of combating terrorism can become a weapon against political dissent, independent journalism and basic personal freedom.