For many months, France considered acquiring the world’s most famous spyware. New elements consulted by Forbidden Stories detail this project, which was being outlined at the very time when government members were allegedly being secretly targeted by Morocco using Pegasus. The Élysée ultimately vetoed it. The story of a U-turn.
Our revelations
- NSO’s official reseller in France reveals, in a testimony consulted by Forbidden Stories, the behind-the-scenes of his meetings with intelligence services and mentions a sum of « 60/80 million » euros for the purchase of the software.
- The Élysée eventually gave up at the end of 2020, faced with reputational risk, and cited a risk of loss of sovereignty.
- The request for authorization to sell Pegasus in France was submitted once again to the ANSSI commission after the presidency’s veto on acquiring Pegasus.
- Seven phones of ministers from that period show « traces of compromise » by Pegasus. All are similar to other markers found on targets associated with Morocco.
By Eloïse Layan, Hicham Mansouri and Guillaume Vénétitay
Even monk-soldiers have secrets. Sébastien Lecornu himself had chosen this qualifier of « liege man » to swear loyalty to Emmanuel Macron when he was appointed Prime Minister. Behind this expression emerges the image of an ascetic, almost colorless figure.
Yet there is one country that found Sébastien Lecornu’s life and activities interesting: Morocco. In July 2019, while the Norman was still Minister of Territorial Communities, the Cherifian Kingdom allegedly targeted his phone with the Pegasus spyware, marketed by the Israeli company NSO.
The former mayor of Vernon and France are clearly not ones to hold grudges. Sébastien Lecornu is traveling to Rabat on July 15 and 16, accompanied by twelve ministers, for a « high-level meeting » meant to seal the rapprochement between France and Morocco. This comes at the very moment when Forbidden Stories and its partners are publishing new revelations about Morocco’s mass surveillance operations, including the infection of seven French ministers’ phones in 2019 and 2020 by the Pegasus software.
New documents, which the consortium was able to consult, tell an even more dizzying story: that of a spyware that France considered acquiring for many months, while the country’s highest state officials were already victims of it, without even knowing.
« 60/80 million euros » for Pegasus
There is no need to go all the way to NSO’s headquarters in Herzliya, 10 kilometers north of Tel Aviv, to understand how France’s state services were tempted to equip themselves with Pegasus. One only needs to go to Angoulême (Charente). This is where Jérôme S., 52, lives, in a house tucked away on a quiet street. He heads the company Syans, which had five employees in 2022, and has been supplying French intelligence services, including the Directorate-General for Internal Security (DGSI), « for years. » Syans is also NSO’s exclusive reseller in France.
As part of the investigation opened in France following complaints from Pegasus victims, Jérôme S. was heard by investigators. During his testimony, which the consortium was able to consult, the man reveals a number of specific features tailored for the potential French client. It was reportedly planned that the malware would have a limited lifespan and self-destruct to avoid being discovered in the event of a phone analysis. Another indication that discussions were advanced: the Syans CEO mentions his commission in the event of a Pegasus sale – 50,000 to 65,000 euros – and even a transaction amount: « I think that for France, the price proposed by NSO Group is around 60/80 million euros. » Contacted, Jérôme S. declined to comment in order to protect his business.
« Several state services were pushing in favor of Pegasus »
Around the turn of 2020, the DGSI as well as the Directorate of Military Intelligence (DRM) are cited as potential clients, according to the documents consulted by Forbidden Stories. The tool also caught the eye of the Ministry of Justice. The Place Vendôme was eyeing this spyware with interest for use in investigations related to drug trafficking or terrorism, and nothing indicates that the envisaged uses of the software in France were illicit. « Several state services were pushing in favor of Pegasus, including the Ministry of Justice, » confirms a French intelligence member.
Others put precise words to their enthusiasm for such software. Like Jean-Dominique Nollet, a former Saint-Cyr graduate with a career in the Army and then the Gendarmerie. This man with thin glasses met NSO in Prague « around 2016/2017 » and then at the firm’s headquarters, while he was seconded to Europol, the European Union’s criminal police agency.
At Europol, « we were all extremely impressed by the tool’s performance, both in terms of deployment and data capture. […] By providing the phone number, NSO was able to infect the phone in about 20 seconds, » he describes in his testimony to investigators. Now employed by TotalEnergies, he struggles to hide his fascination in Herzliya for « a room of about 15 square meters filled with every type of iOS and Android phone on the planet, which were continuously subjected to infection and deployment tests of their malware. »
For the spied French ministers, traces linked to Morocco
The ministries are busy, unaware that they have been beaten to the punch. On the other side of the Mediterranean, Morocco has been a Pegasus user since the end of 2017. In a response from the Directorate-General for External Security (DGSE) to a judicial requisition dated November 8, 2022, the service « establishes that the United Arab Emirates and Morocco have used NSO products, at least since 2017. » This is despite the kingdom’s repeated denials. The revelations of the Pegasus Project in the summer of 2021 acted as a bombshell: the phone numbers of Emmanuel Macron and fifteen government members were found in the list of potential targets of Morocco. « I was never informed of the results of the analysis of Macron’s phone; that was handled directly by the Élysée, with a very high degree of confidentiality, » indicates a French intelligence bigwig.
Much like the medical confidentiality surrounding the head of state, nothing leaks out about the possible infection of his smartphone. However, the new elements consulted by the consortium make it possible to establish « traces of compromise » by Pegasus on the phones of seven members of the government at the time: Jean-Michel Blanquer, Jacqueline Gourault, Julien Denormandie, Emmanuelle Wargon, François de Rugy, Florence Parly, and Sébastien Lecornu.
These traces are all linked to Morocco. On Sébastien Lecornu’s iPhone XS, two markers found by ANSSI indicate the presence of the addresses « bergers.o79@gmail.com » and « bogaardlisa803@gmail.com, » detected in cache files used by Apple. Florence Parly’s iPhone 12 also contains traces of « bergers.o79, » as well as a second email address, « naomiwerff772@gmail.com. » These addresses are known to have been used against targets of interest to the Cherifian Kingdom – « bergers.o79 » notably compromised Omar Radi’s phone, according to elements from Amnesty Security Lab. The infection markers for Lecornu and Blanquer extended until March 2020, i.e., after the last targeting dates revealed by the Pegasus Project.
For its part, in a letter dated April 20, 2022, the DGSE writes that following its analyses, it is « able to link certain intrusions to the activity of intelligence services of Pegasus client countries and considers that they are part of espionage operations that undermine the fundamental interests of the Nation. »
The DGSE is « able to link certain intrusions to the activity of intelligence services of Pegasus client countries and considers that they are part of espionage operations that undermine the fundamental interests of the Nation. »
Opacity and embarrassment at the Élysée
The judicial proceedings that followed our revelations also show a certain casualness among personalities concerned by a possible hack. Florence Parly’s testimony, the former Minister of the Armed Forces, is a succession of « I don’t remember. » She assures that she had « no suspicion as to which service or state could have been behind [the] targeting. » The minister also does not recall the details of her meeting with Benny Gantz, the Israeli Defense Minister, who, according to Shalev Hulio, one of NSO’s co-founders, allegedly gave her a report certifying that no French political figure had been targeted by Pegasus.
These memory lapses and forgetfulness illustrate the embarrassment at the highest levels. France, moreover, is quite happy not to be mixed up with the Israeli software. Proof of this is that the Élysée communicated more quickly on its refusal to buy Pegasus than on the results of the analysis of Emmanuel Macron’s phone. The decision was made at the end of 2020, as revealed by Le Monde. « Emmanuel Macron announced it during a defense council and invoked reasons of sovereignty as well as reputational risk, as the spyware was already being used by authoritarian regimes, » a source close to the matter confirmed to Forbidden Stories.
One French enigma remains. Six months after the Élysée’s veto, in June 2021, Jérôme S., the spyware’s reseller in France, filed an R226 – the procedure for marketing surveillance or interception technologies – in the name of Syans because « the DGSI wished to acquire the software. » According to the man from Charente, the budget had been « validated at the ministerial level » and the project was even « green-lit » on the government side at the end of 2020. Why was the request for authorization to sell Pegasus in France submitted at that date? A power play by intelligence? The director of the National Technical Service for Judicial Interception (STNCJ), attached to the DGSI, believes that NSO’s representative in Europe – Rogier R., a Dutchman – may have gone it alone, taking note of France’s refusal while simultaneously « making arrangements to present a new file before the R226 commission. » Why insist so much when the game seemed already over? Was NSO hoping for a political reversal, or does this reflect a double discourse at the highest level of the state?
One more mystery for investigators, who could not count on Morocco’s cooperation, as the kingdom refused a rogatory commission, according to the magistrates. Before this week’s ministerial visit, King Mohammed VI sent, according to the press aligned with the kingdom, his warmest wishes to Emmanuel Macron in a spirit of « friendship, trust, and demandingness. » Sébastien Lecornu, meanwhile, will participate in a lunch « hosted » by the sovereign this Thursday.
Gérard Araud’s trip, former ambassador turned NSO « ethics » advisor
In May 2019, Gérard Araud visited NSO’s premises for 48 hours, at the invitation of the American investment fund Novalpina, which had bought the Israeli company. The freshly retired civil servant, after a final post as French ambassador to the United States, observes that « the employees of this company are all very young, dressed casually in shorts and T-shirts. » In his testimony, he also states that he quickly had « doubts » about the « curious » advisory mission proposed to him. « Indeed, I had the intuition that the NSO tool could have what I will call a ‘backdoor’ with Mossad, » he indicates. This does not prevent him from eventually accepting a mission as ethics advisor from September 2019 to September 2020, against the advice of « his friend » Bernard Emié, then director of the DGSE. It must be said that in Gérard Araud’s hierarchy of acquaintances, « his best friend, » Zamir Dabbash, is the head of Novalpina. « NSO needed to acquire a more respectable image following a scandal over the use of its tool in Mexico against journalists, » Araud awkwardly explains, not fooled by the whitewashing operation he is participating in. He finally tells investigators that he is « not unhappy to be out of it » and that he « found [he] was paid for not much. » A bit of lucidity, in the end.
Source: Forbidden Stories, July 16, 2026
#Pegasus #Morocco #France #Emmanuel_Macron #Espionage #Pegasus_software #Forbidden_Stories
Soyez le premier à commenter