On 1 October 2026 Amnesty International published "We start with the verdict": Inside Morocco's surveillance machine, a Forbidden Stories-coordinated investigation with media partners. Using testimony from a former employee of Morocco's domestic intelligence service (DGST), leaked documents and forensic work, it says the DGST used Pegasus spyware against activists and journalists between 2017 and 2021. Morocco has repeatedly denied using spyware against its citizens. Amnesty says it wrote to the authorities four weeks before publication and got no reply.
This is not a Zimbabwe story, and we found no verified, recent Zimbabwean spyware incident to report. The Morocco case matters to Zimbabwe because it shows what happens when the legal gate in front of surveillance is a political one rather than a judicial one.
What Amnesty reports
According to Al Jazeera's account of the report, Amnesty matched 103 Moroccan phone numbers entered into Pegasus in late 2017 to specific people. Of these, 65 were members of civil society, including 34 human rights defenders and 22 journalists and media workers. Another 25 were political figures or officials. Amnesty also found evidence of spyware delivered over the state-owned Maroc Telecom network, and says Morocco bought tools from companies in Israel, the EU and the US. It calls on other states to halt spyware exports to Morocco until human rights safeguards exist.
The technical story is older than this report. OCCRP's summary notes that the DGST was already a Hacking Team customer in the 2015 leak, licensed to infect up to 2,000 devices. The Committee to Protect Journalists says the Interior Ministry did not respond to its request for comment.
Two caveats apply. The core evidence includes a single insider's testimony, and the allegations are Amnesty's, not a court finding. Morocco disputes them.
The case for strong surveillance powers
The strongest argument for broad interception authority is real. States face terrorism, organised crime and fraud that move across encrypted channels, and an intelligence service that cannot lawfully read a suspect's messages may turn to informal methods. Interception that is fast and secret can prevent serious harm. Most governments, including democratic ones, hold such powers.
But the argument works only when the power is bounded by someone who does not report to the agency asking for it.
Zimbabwe's structural gap
Zimbabwe's Interception of Communications Act [Chapter 11:20] shows the design problem. Under section 5, an authorised person applies to a minister, who issues the warrant. The authorised applicants are the Chief of Defence Intelligence, the Director-General of the President's department responsible for national security, the Commissioner of the Zimbabwe Republic Police and the Commissioner-General of the Zimbabwe Revenue Authority, or their nominees. The application must state the period the warrant is required for, and it must name the service provider where relevant. The Act also routes interceptions through a central monitoring centre. We have not independently verified later amendments to the Act, and readers should check the current consolidated text.
The structural point stands regardless. A member of the executive approves requests that come from the executive's own security services. When the Act was signed on 3 August 2007, Reporters Without Borders criticised it because interception could proceed without a judge's permission. The Morocco report is not evidence that Zimbabwe has done what Morocco is accused of. It shows why the absence of independent review matters when capable tools are bought on the commercial market.
Why this is a speech problem, not only a privacy problem
Surveillance targets journalists and activists first because their work depends on confidential sources and open communication. Amnesty says information likely gathered through Morocco's surveillance was leaked to pro-government media to smear its targets. A reporter who suspects their phone is compromised self-censors well before any article is blocked. That chilling effect is invisible in takedown statistics, which is why surveillance deserves as much attention as content rules in any assessment of an open internet.
It is also a market problem. A country that is known for unaccountable surveillance deters the founders, remittance firms and cloud providers that need trustworthy communications infrastructure. Proportionate rules are good for innovation, not opposed to it.
What proportionate reform looks like
None of this requires disarming security services. Four measures would fit the evidence:
- Prior judicial authorisation. Warrants issued by a judge, not a minister, on stated grounds of serious crime or a concrete national security threat.
- Time limits and renewal review. Short warrant periods, with a fresh judicial look at each renewal.
- Post-hoc notification and independent audit. Targets told once an investigation is no longer prejudiced, plus annual aggregate reporting to parliament.
- Procurement transparency for spyware. Public rules on who may buy intrusion tools, and export-control scrutiny by supplier states. Amnesty's call for an export halt to Morocco applies the same logic from the supply side.
Supplier countries carry responsibility too. The vendors named in the Moroccan case come from Israel, the EU and the US. Export licensing that checks the buyer's domestic oversight is a more proportionate lever than bans on whole categories of security software.
Bottom line
The Morocco allegations are serious but still contested. What they illustrate is general: when the approving authority sits inside the executive, safeguards depend on restraint rather than law. Zimbabwe's statute places the warrant decision with a minister. Moving that decision to a judge would cost the state little in legitimate investigative capacity and would remove a legal gap that spyware vendors, and a government's critics, can both see.