US computer science researcher Jonathan Scott just released a technical report clearing and exonerating Morocco, scientifically, from all accusations of using the notorious Pegasus spyware.
The report, which examines the scientific methodologies and data used to make the digital espionage allegations and pin them on the Moroccan government, raises concerns about the forensic investigations conducted by Amnesty International and The Citizen Lab, given that their conclusions were not independently verified or reproduced by anyone outside their trusted network.
Despite these shortcomings, the two parties formed partnerships with several global media outlets, including the coalition of journalists from Forbidden Stories, he noted.
On the cases of Omar Radi, Claude Mangin and others, the researcher pointed out that mobile forensics results used to support Pegasus allegations include false positive results that were not disclosed by the researchers.
He added that false positives in forensic analysis lead to erroneous conclusions which can have significant weight on international relations, especially if used to make surveillance accusations against governments.
“This calls into question the intentionality of the investigation and the credibility of the conclusions drawn by AI and The Citizen Lab,” he said.
On using an IP address as an evidence of crime, Scott explained that tracing an Internet Protocol (IP) geolocation to identify technical information is not a dependable method as it has limitations and inaccuracies.
Furthermore, he stressed that AI and The Citizen Lab do not possess the physical devices to perform the forensics and use only iCloud backups of an iPhone to conduct their analysis.
On another matter, he pointed to the conflict of interest which calls into question the impartiality of investigation as both AI and The Citizen Lab receive funding from the same institutions.
On the Mamfakinch allegations, the researcher said the software concerned was configured during a demo and a trial period in a way that would prevent it from being used in the field, limiting it solely to internal use. “It would not be possible for anyone from the Moroccan government to have even attempted to attack Mamfakinch,” he explained.
The Citizen Lab citing Morocco’s alleged hacking of Mamfakinch to support its new allegations is merely a circular self-citation that is not supported by any factual evidence, he underlined.
Scott recalled that Morocco repeatedly demanded that AI provides substantiated evidence of its Pegasus allegations, pursuant to the Budapest Convention which lays down globally accepted procedures that are designed to facilitate the collection of digital evidence in the course of criminal investigations. “These demands have gone unmet,” he said.