Despite the apparent complicity between the Guardia Civil and the Moroccan internal intelligence service, the latter spied on Spanish agents during their training visits to Morocco.

After the end of ETA in 2011, jihadism became the main obsession of Spain’s security and intelligence agencies. The new threat forced major changes in the way the National Intelligence Center (CNI), the National Police, and the Guardia Civil worked. Islamist terrorism had structures very different from those of the Basque terrorist group and knew no borders, which required building relationships with institutions from other countries. This is how, in 2014, the Guardia Civil began to forge its own path of cooperation with the DGST, the powerful internal intelligence service of Morocco—a collaboration that until then had been dominated by the CNI and, above all, by the National Police.

Little by little, the benemérita (Guardia Civil) won the sympathy of the Moroccan spies led by Abdellatif Hammouchi. An alliance of this kind takes time and, above all, trust. Directors and other senior Guardia Civil officials began traveling to Rabat. Then, technicians from the Operational Support Group (GAO), all fluent in French, set up on-site training to teach their Moroccan counterparts the espionage and surveillance techniques used in Spain. Joint counterterrorism and irregular immigration operations soon followed. They even created a joint WhatsApp group, as corroborated by two Guardia Civil sources who participated in this collaboration, as well as a former Moroccan intelligence agent.

For their part, DGST (General Directorate of Territorial Surveillance) agents were also invited to Ceuta, Málaga, Marbella, and Madrid. Photographs taken in 2017 and 2018, to which this investigation had access, show visits by Moroccan agents to the Santiago Bernabéu, the GAO headquarters in the Spanish capital, and Puerto Banús in Marbella.

Trust was not built overnight, but by 2017 the DGST and the Guardia Civil already had a solid and friendly relationship. A dozen photos from that period show the rapport between Spanish and Moroccan agents. They pose smiling, joking, sharing moments of relaxation and dinners.

That rapport remains in place. On July 2 last year, Hammouchi, director of the DGST, received a high-level Spanish delegation led by General Luis Peláez, the highest-ranking officer of the Guardia Civil Intelligence Service. A few months earlier, in November 2025, Interior Minister Fernando Grande-Marlaska received him at the ministry to award him the Grand Cross of Merit of the Guardia Civil, a distinction approved by the Council of Ministers in 2019.

This investigation reveals the other side of that relationship.

Despite the apparent complicity between the two institutions, this is the story of a « betrayal, » in the words of a senior Guardia Civil official who knows the details of this Spanish-Moroccan cooperation well, upon first learning of the findings of the media consortium led by Forbidden Stories, in which El Confidencial participates.

The information contained in this report is based on leaked documents and photographs, and has been corroborated and supplemented by intelligence sources: a former Moroccan DGST agent, two from the Guardia Civil, one from the National Police, and one from the CNI. The evidence was independently analyzed by Amnesty International’s Security Lab, which confirmed its authenticity.

« We spy on all of them, » says the former DGST agent. This source details how Moroccan intelligence gained access, without leaving a trace, to the communications of Guardia Civil agents traveling to Morocco to train Mohammed VI’s spies. Something they do systematically « just in case, » he explains.

« The Moroccan agents coordinated the espionage of Guardia Civil agents through a WhatsApp group of which the benemérita knew nothing »

The modus operandi by which they allegedly gained access to the communications and files of their benemérita colleagues’ mobile devices is based on Rabat’s mass surveillance machinery. A fundamental advantage would be direct access to the infrastructure and capabilities of Maroc Telecom, the main operator, the former Moroccan agent asserts. According to his testimony, from a phone number connected to the Moroccan network, these spies would obtain the IMSI number (SIM card identifier) and, with it, the IMEI number (device identifier). Telecommunications experts at Amnesty International’s Security Lab note that these technologies are routinely used for operational surveillance tasks in Morocco.

For its part, the National Police reports that it takes certain precautions when traveling to the North African country: its intelligence agents carry two mobile phones, one with no sensitive content, which they use to connect to the Moroccan telephone network; and another configured to avoid being spied on.

However, GAO personnel do not apply this type of digital security measures when traveling to Morocco. « We didn’t do it because we didn’t suspect we would be spied on, » acknowledges a prominent member of the Guardia Civil Intelligence Service. Another source from the same institution, who participates in these exchanges, states that « our ignorance about Morocco is a problem. » The GAO’s motto is Videre sine visum; « To see without being seen. »

Within the framework of this cooperation, Guardia Civil technicians teach Moroccan spies—particularly those in the Operations Directorate, according to internal sources—their surveillance and tracking techniques, their protocols for accessing hotels and inspecting luggage without leaving traces, their techniques for installing technical means of information gathering, and how to infect cybercafé computers without leaving any trace, among others.

These trainings are part of actions against jihadism, human trafficking, and, in recent years, drug trafficking. However, Rabat would have used that knowledge to repress journalists, human rights defenders, activists, and others uncomfortable for the regime, according to the former Moroccan agent. This source does not provide documentary evidence of this negligent use of the techniques that the Guardia Civil passed on to the Moroccan spies.

The motivation of the armed institute is the « strategic need to get along well with the DGST, » explains a Guardia Civil source who participated in the design and implementation of this roadmap. The Spanish agents had to offer something to their Moroccan counterparts to create reciprocity with them and obtain information in return.

The Guardia Civil exercises are carried out in real life, on the ground, in cities such as Castillejos (Fnideq), on the border with Ceuta, or Tangier, Rabat, Tetouan, Nador, and Marrakech. Although the transfer of tactics is one-way: Moroccan agents do not share their techniques with their Spanish colleagues, according to Guardia Civil sources.

Sometimes, these trainings turn into « real tests. » The difference between exercises and real operations was « the long waits, » recalls the former DGST spy. The same source recalls that the first time Moroccan intelligence used drones was thanks to the Guardia Civil’s teachings in Málaga. Currently, Morocco produces this type of autonomous device with support from Israel.

The ex-spy points to J., a senior official in the DGST’s Research Unit (‘Cellule Recherche’), as the person responsible for the wiretapping and monitoring of the Civil Guards. The source relates that J. is not a desk man; his specialty is field operations. This officer would act as acting head of the Research Unit when its top official, M.J., is absent. The latter would be, the former agent explains, the senior official who coordinates arrests, including those of journalists and human rights defenders.

The Research Unit is one of the DGST’s most valuable departments, according to internal sources. It would be responsible for aggressive tracking and surveillance of inconvenient journalists, human rights activists, and regime critics. Its director, M.J., would have played a key role in the espionage, reputational destruction, and imprisonment of journalist Omar Radi, one of Pegasus’s first victims in Morocco. After going through prison, following a conviction with strong political motivations and based on fabricated accusations—as denounced by organizations such as Amnesty International and Human Rights Watch—Radi went into exile and currently lives in Germany.

Targeting Civil Guards is not limited to these trainings in Morocco. Among the Spanish phone numbers spied on by Morocco with Pegasus, obtained by the consortium of 14 media outlets driving this investigation, is that of Guardia Civil Colonel Alberto Aguilera. His mobile appears five times on the target list, in infection attempts that took place from March 8, 2019. Aguilera served as Interior Attaché at the Spanish Embassy in Rabat between 2012 and 2017, during which time he promoted the Spanish-Moroccan Police Cooperation Center, based in Tangier. After his time in Morocco, Aguilera was appointed head of Intelligence for the armed institute in Catalonia. It was during this period that he suffered the Pegasus attacks.

The former DGST agent, who corroborates these facts, considers it « abnormal » for someone with his profile to have obtained intelligence-related command posts after having been in Morocco. In his opinion, « that contradicts basic security protocols. » From Catalonia to Gijón, and from there, Aguilera was promoted to colonel and assigned to Madrid in 2024. He is currently head of the Digital Transformation and Technological Innovation Unit of the Guardia Civil.

Unlike other intelligence agencies such as the CNI, the DGST would not seek judicial authorization to spy indiscriminately.

Collaboration, yes; but with guard up

In October 2020, President Pedro Sánchez’s phone suffered the first infection attempt with the Israeli software Pegasus, according to an order from Judge José Luis Calama. His investigation details that on May 19, 2021, in a subsequent attack, 2.57 gigabytes of information were extracted from his mobile. This date coincides with the major diplomatic crisis between Spain and its southern neighbor, when Morocco opened the border with Ceuta 48 hours earlier, encouraging the irregular passage of more than 10,000 people into the autonomous city.

A CNI report points to Fouad El Himma, royal adviser to Mohammed VI, as the architect of a strategy of pressure against Madrid, using migratory flows, in retaliation for having allowed the hospitalization in Logroño of the leader of the Polisario Front, Brahim Ghali. Sources for this investigation place El Himma, known as Morocco’s ‘viceroy,’ at the head of Bureau 21, a department that from the Royal Palace in Rabat drives the espionage of senior foreign officials with tools such as Pegasus. According to Judge Calama’s proceedings, in addition to Sánchez, the phones of ministers Grande-Marlaska (Interior) and Robles (Defense) were also compromised during this period.

The crisis began to reverse in 2022 when the Spanish government dismissed its Foreign Minister, Arancha González Laya, at Morocco’s request. Both countries restored their relations after, in March of that year, Pedro Sánchez adopted the Moroccan position on Western Sahara, which until 1976 had been a Spanish province. The Moroccan Royal Palace made public the letter with which Sánchez sealed his surrender to Mohammed VI. Three months later, in June 2022, a « miscalculation » by Morocco gave rise to the so-called ‘Melilla massacre,’ the deadliest episode at a European land border to date. At that time, Madrid hosted the NATO summit and successfully pressured the Alliance to include in its strategic framework the instrumentalization of migratory flows as a hybrid threat.

The Guardia Civil is not the only state body affected by the volatile loyalty of its Moroccan counterparts. In September 2022, when Spain and Morocco were resuming their relationship after the diplomatic crisis, the CNI director secretly traveled to Rabat to meet with the head of the Moroccan spies, Hammouchi. Moroccan intelligence released several photographs of Esperanza Casteleiro with Hammouchi without her consent and without prior notice. Another illustrative case of this relationship marked by betrayals came to light in 2023, when an investigation by El Confidencial revealed that Moroccan spies had recruited the daughter of the General Commissioner of Intelligence of the National Police.

Moncloa and Rabat publicly display good relations, although the situation reflects moments of high tension in recent years, more or less veiled and at different levels. Among the unresolved questions for the government is the content downloaded from Sánchez’s mobile phone, the theft of which, according to the various sources consulted, points to the highest officials of the Kingdom of Morocco. What information did they extract from the Spanish president? The question remains unanswered.

At the time of this edition’s closing, the following had not responded to the questions sent by the media consortium that produced this investigation: Moncloa, Ministry of Interior, Ministry of Defense, Ministry of Foreign Affairs (Spain); DGST, DGED, Moroccan Royal Palace (Morocco); and NSO Group (Israel).

About the Pegasus Project
El Confidencial is part of a consortium of 39 journalists coordinated by Forbidden Stories, which also includes Amnesty International’s Security Lab, Le Monde, Radio France, The Guardian, Haaretz, Die Zeit, Der Spiegel, Der Standard, OCCRP, Código Morse, Paper Trail Media, Hawamich, and Tamedia.

#Morocco #Spanish_civil_guards #espionage #Pegasus #DGST #Forbidden_Stories_consortium