At first glance, it’s a seemingly ordinary email address: s*******@gmail.com. Yet it enabled the consortium to identify DGST agent Farid S: “an IT specialist in the systems department,” Safir confirmed. The address was used to register the TLS certificate for an internal DGST domain name, tersim.ma, according to analyses by Amnesty’s Security Lab. But Farid is also obsessed with Google Maps reviews and ratings, revealing clues about his personal and professional life. For example, he has spent a lot of time in the Harhoura Forest, “an ideal place for sports, especially walking and running,” not too far from the DGST offices. Posts include photos of the Dan Accadia Resort and reviews of the MeatBar restaurant and Azrieli shopping center. Better yet, he has been within spitting distance of NSO’s headquarters in Herzliya, Israel. “Internally, when agents went to Herzliya for training, we’d say they were in Cape Verde, not Israel,” Safir said with a smile.
