Cyber Morocco: a quick and dirty experiment about artificial intelligence for cyber intelligence

This is an experiment about artificial intelligence for intelligence. Sorry for the length, but I wanted to detail all the steps and results. You will find here not only this description, but also the real results (mainly, skills and final intelligence product). If you are interested only in the product, you can go to the end of the post. If not, you can continue reading.

But first, some disclaimers:

• This is a laboratory experiment. Just an experiment. Please, don’t blame me with “This is not token optimized”, “This skill is not well defined”, “This should have been an agent”, “This prompt is not accurate enough” or “You should have used Opus 5 instead of Sonnet 5 for this task”. I am not looking for a scientific precision: I just wanted to know, in a quick & dirty way, how AI can analyse information and generate intelligence.
• All the gathered information for this experiment is open source. OSINT is the only gathering discipline used here.
• I am not a Morocco expert, so when delving into details, I can not assess the trustworthiness of data.
• I have included minor modification (format) changes in the final report, and I have changed the TLP:AMBER from the skeleton to TLP:CLEAR.
• If you identify any improvement (in skills, in the final product, in the methodology, in…) please let me know.

I wanted to write about Morocco and its intelligence ecosystem, particularly in cyberspace. For Spain, Morocco is a key actor, and the recent invasion of Ceuta has generated a crisis that is still being managed (more or less).

However, I don’t have many free time to devote to actors that don’t drink vodka and I am not an expert in Moroccan politics, military or intelligence. So, I decided that Claude (Sonnet 5) would be my private intelligence partner. Some sort of “vibe writing”. I thought, and I told Claude Code:

“I am an analyst who wants to generate, as an intelligence product, a report about Morocco and their cyberspace activities and operations. As a Spanish, I am particularly interested in the Moroccan Spanish relationships (Gibraltar strait, migration matters, etc.).”

My experiment started by defining the skills I thought would be useful for my purpose. Following the intelligence cycle, I asked Claude to generate separate skills to perform the following activities:

• Acquisition. Skill to gather relevant data from online open sources. Data must be stored locally, registering Sources must be prioritized following this hierarchy:
  • Primary legal and official documents
    • Constitution.
    • Dahirs and decrees.
    • Bulletin Officiel.
    • Parliamentary documentation.
    • DGSSI, ANRT, CNDP and Bank Al-Maghrib publications.
    • UN records.
    • EU and CJEU judgments.
    • Spanish judicial documents.
    • Official procurement notifications.
    • Company filings and regulated ownership disclosures.
  • Original technical evidence
    • Forensic reports.
    • Malware analyses.
    • Incident artefacts.
    • Court exhibits.
    • Leaked procurement contracts whose authenticity has been technically established.
  • High-quality independent research
    • Peer-reviewed articles.
    • Academic monographs.
    • Established think tanks with transparent methodologies.
    • Specialist defence and intelligence publications.
  • Original investigative journalism
    • Only where methodology, witnesses and corroboration are explained.
  • Mainstream reporting
    • Moroccan, Spanish and Algerian newspapers.
  • Partisan media, aggregators and tertiary sources.

• Processing. Skill to translate information from Spanish, French and Arab into English (yes, I really didn’t invest many time specifying the prompt).

• Analysis. Different skills to analyse the data once it has been acquired and processed. All these skills must have strong critical and analytical thinking capabilities, differentiating facts from hypotheses, identifying bias, estimating source and information quality. Particularly, they must avoid mirror imaging, confirmation bias and wishful thinkings. In addition, they must be technologically strong, understanding cybersecurity, artificial intelligence, semiconductors, space, quantum computing and critical infrastructures, among others. These skills must be, at least, the following ones:
  • Geopolitical analyst. Expert in global geopolitics with a specialization in the Moroccan ones. This skill must be able to:
    • Understand geopolitics and strategy: international relationships, national interests, doctrines, partnerships, rivalries, risk factors (demography, energy, ideology, economy, etc.).
    • Characterize actors: states, intelligence services, military forces, proxies, think tanks, NGO, etc.
    • Predictive intelligence: identify weaknesses and trends, generate scenarios, estimate probabilities, etc.
  • Military analyst. Expert in global military matters with a specialization in the Moroccan military. This skill must combine strategy, operational art, intelligence, technology and force structure analysis, and it must be able to:
    • Understand military doctrine and strategic culture of countries, historical and political influences and decision-making processes.
    • Analyse ORBAT (Order of Battle), mapping units, commands, force structure, readiness, etc.
    • Assess capabilities, evaluating land, air, naval, strategic and information domains.
    • Perform operational analysis, understanding operational design, campaign planning, sequencing, etc.
    • Understand modern military technology: missiles, UAVs, electronic warfare, combat cloud, AI-enabled warfare, etc.
    • Understand logistics and industrial capacity, particularly defence industrial base, supply chains, strategic reserves, etc.
  • Intelligence analyst. Expert in global intelligence services and capabilities with a specialization in the Moroccan intelligence ecosystem. This skill must have an in-depth knowledge about the organizations that generate intelligence, how they work, how they evolve, and how they influence international events, and it must be able to:
    • Analyse intelligence services architecture: organizational, mandates and jurisdictions, legal authorities, oversight mechanisms, relationships with other intelligence services, law enforcement agencies and military, etc.
    • Understand historical intelligence and its impact in today’s services: origins, successes and failures, reforms, leaderships, etc.
    • Understand acquisition disciplines, source’s reliability, information quality, etc.
    • Provide counterintelligence expertise, understanding insider threats, penetration operations, double agents, influence networks, technology transfer mechanisms, etc.
    • Analyse intelligence tradecraft: risk appetite, attribution, proxies, cover entities, front organizations, etc.
    • Integrate cyber intelligence: APT, contractors, offensive cyber units, influence in cyberspace, cyberspace operations, etc.
  • Diplomatic analyst. Expert in global diplomacy with a specialization in Moroccan diplomatic relationships. This skill must be expert in foreign policy, bilateral relationships, multilateral organizations, international negotiations, alliance dynamics, diplomatic signalling, crisis management and international influence. It must be able to:
    • Analyse foreign policies, understanding national interests, strategic objectives, political constraints, alliances and domestic political pressures.
    • Understand diplomatic ecosystems, including ministries of foreign affairs, embassies, international organizations, permanent representations, back-channel diplomacy, etc.
    • Analyse negotiations, identifying interests, position, red lines, trade-offs and leverages.
    • Diplomatic signalling, interpreting official statements, ministerial visits, voting behaviour, joint communiqués, etc.
    • Regional expertise, particularly in Europe, Middle East, North Africa and sub-Saharan.
    • Provide an in-depth knowledge about international organizations, particularly NATO, African Union, Arab League and European Union.
    • Interpret diplomat crisis: escalation ladders, ceasefire processes, mediation mechanisms, etc.
    • Provide a strong political and cultural intelligence, understanding political systems, elite networks, historical memories, national narratives, strategic culture, etc.
    • Diplomatic forecasting.
  • Social analyst. Expert in the internals of the Moroccan society, from religion to culture, tribes and trends. This skill must understand collective behaviour, including social cohesion, identity dynamics, public sentiment, demographic change, social grievances, polarization, elite-society relations, social resilience and information consumption patterns. It must be able to:
    • Study identity and social cleavages: ethnicity, religion, language, class, regional identities, political identities, etc.
    • Assess social stability elements: public trust, institutional legitimacy, protest potential, radicalization, resilience, etc.
    • Analyse and forecast public opinion and sentiment: narratives, fears, aspirations, social mood, etc.
    • Analyse information ecosystem: media, social media platforms, disinformation, influence, trust in institutions, etc.
    • Understand cultural intelligence: history, values, norms, myths, political culture, etc.
    • Examine socioeconomic dynamics: inequality, cost of living, housing, employment, education, services, territorial disparities, etc.
    • Understand social movements and collective action: protest movements, grassroots organizations, online mobilization, activism, political radicalization, etc.
    • Forecasting: social stability, emerging grievances, future polarization, potential unrest, changes in social attitudes, etc.
    • Identify strategic implications, connecting social developments to national security, political stability, geopolitics, economic performance and strategic competition.
  • Legal analyst. Expert in the Moroccan laws, particularly those regulating cyberspace, military activities and intelligence. This skill must interpret legal frameworks, anticipate regulatory evolution, assess legal risk, and translate law into decision-making. It must be able to:
    • Deep legal reasoning, interpreting legislation, regulation, contracts and jurisprudence, and detecting conflicts between norms and legal gaps.
    • Analyse regulation, reviewing laws, guidance, consultation papers, technical standards, etc.
    • Perform legal, regulatory, strategic and reputation risk assessment.
    • Understand policies and governance, particularly public policy, government priorities and institutional dynamics.
    • Work in uncertainty, in emerging areas involving limited regulatory guidance, grey zones, conflicting interpretations, ambiguous terminology or, directly, no case laws.
    • Provide cross domain knowledge, being familiar with cybersecurity, technology, defence and intelligence, corporate governance, critical infrastructures, etc.
    • Perform comparative legal analysis, involving EU and Morocco approaches.
    • Assess evidence, including authority, validity applicability and reliability of sources.
    • Scan regulatory horizon, monitoring legislative initiatives, consultation processes, standardization efforts, regulatory trends and judicial evolution.
  • Economic analyst. Expert in international economics with a specialization in the Moroccan one, studying the material foundations of power. This skill must be able to:
    • Perform macroeconomic analysis: GDP, inflation, employment, productivity, public debt, fiscal policy, monetary policy, etc.
    • Assess economic power, evaluating economic scale and resilience, strategic autonomy, industrial capacity, access to capital or technological competitiveness.
    • Analyse industrial and technological capabilities: manufacturing capability, strategic industries, energy systems (oil, gas, electricity, nuclear), defence industry, etc.
    • Analyse trade and supply chain: routes, ports, shipping, logistics, material, dependencies, etc.
    • Provide financial intelligence: global financial flows, banking systems, investment, sovereign wealth funds, sanctions, etc.
    • Evaluate economic security: strategic dependencies, foreign acquisitions, technology transfers, critical materials, economic coercion, sanctions exposure, etc.
    • Understand corporate and sectorial actors: key national champions, strategic companies, defence contractors, technology ecosystems, innovation clusters, etc.
    • Forecast, assessing economic trajectories, sectoral transformations, structural risks, opportunities, etc.
  • Energetic analyst. Expert in energy trades, particularly in those affecting Morocco, such as gas. This skill must understand how energy is produced, transported, consumed and weaponized, and what are the implications. It must be able to:
    • Understand the whole value chain of energy systems: fossil fuels (oil, gas and coal), electricity (generation, transmission, distribution) and low-carbon technologies (solar, wind, nuclear, hydroelectric and hydrogen).
    • Assess energy geopolitics, understanding producer, transit and consumer countries, chokepoints and alliances.
    • Analyse energy security: supply chain, infrastructure security, system resilience and strategic vulnerability.
    • Provide knowledge about critical infrastructure: electricity (grids, interconnections, substations), gas (pipelines, LNG terminals, storage facilities), oil (refineries, ports, strategic reserves) and nuclear (fuel cycle, power plants, waste management).
    • Understand energy markets and economics: wholesale electricity markets, energy pricing mechanisms, future markets, long-term contracts, LNG economics, etc.
    • Assess technologies, both current (nuclear reactor, offshore wind, combined-cycle gas…) and emerging (SMRs, fusion, green hydrogen, grid scale batteries, etc.).
    • Analyse regulatory: climate policy, carbon markets, net-zero strategies, energy transition policies, etc.
    • Perform quantitative analysis: demand curves, generation mixes, reserve margins, storage levels, grid interconnections, etc.
    • Energy intelligence, integrating geopolitics, intelligence, economics, infrastructure and technology.
  • Cyber analyst. Expert in cyber intelligence, cyber defence and cyber security, with a specialization in the Moroccan cyber ecosystem. It must study cyberspace as a strategic domain, in the same way that a naval analyst studies the maritime domain or an airpower analyst studies the air domain. This skill must be able to:
    • Understand cyberspace as a domain of power: structures, ecosystems, clouds, digital platforms, etc.
    • State cyber capability assessment, evaluating national cyber strategies, cyber commands, intelligence cyber units, regulatory ecosystems, national cyber resilience and public-private cooperation.
    • Understand the cyber threat ecosystem: nation-state actors, APT groups, cybercriminals, hacktivists, cyber mercenaries, commercial vendors, etc.
    • Generate cyber intelligence: strategic, operational and tactical.
    • Be familiar with information and cognitive operations: digital influence, information manipulation, online propaganda, narrative campaigns, bot ecosystems, platforms, etc.
    • Understand critical infrastructure and resilience from a cyber perspective in energy, water, telecommunications, finance, healthcare, etc.
    • Analyse and forecast the technological ecosystem: artificial intelligence, semiconductors, cloud computing, quantum technologies, satellite communications, etc.
    • Understand cyber warfare: campaigns, conflicts, military integration, deterrence, escalation.
    • Forecast the cyber ecosystem, estimating emerging threats, technology shifts, regulatory evolution, future attack surfaces and new forms of digital competition.

• Production. Skill expert in reporting, to generate a detailed report, as stated before. It must be fluent in English, use words of estimative probability and include references when applicable, in ACM format. Report must be readable, avoiding excessive sentence and paragraph length; paragraphs should generally remain below 180 words, with occasional longer passages only where evidence requires it. The rule “One principal analytical proposition per paragraph” must be applied. Appropriate figures (for example to show dependencies and  relationships) and tables (for example, to ease the understanding of enumerations) must be included.

As you can see, the analyst skills are the most detailed ones: I wanted Claude to be specific enough to provide valuable information and not to hallucinate.  In addition, I provided a skeleton file which the contents for my final product, for the intelligence report. This skeleton file also provides S2GRUPO’s format (yes, it is our format, don’t blame me for the colours 🙂 and, apart from the format and the simple structure, it also specifies contents for each section and subsection.

In addition to these skills, I also asked Claude to generate a review skill (called “Agent in the Loop”) that can perform a critical review of intelligence reports with the point of view of an intelligence analyst, including:

• Issues to improve readability: English expressions, chronograms, tables, figures, etc.
• Contents that must be highlighted or delved into.
• Elements that are missing in the report.
• General recommendations.
• New references or sources to consider.
• Repeated concepts.

Finally, I enjoy having different platforms (and models) competing between them, so I wrote a simple prompt for other models/applications (Copilot, ChatGPT…) to improve the final product:

I want to publish a detailed report about Moroccan intelligence, security and military ecosystem, with a particular focus on cyberspace. This is a first version of the report, done with the help of Claude. Which elements do you think can be improved? I am willing for readability improvements, topics to be covered, topics to be in depth analysed, elements that you are missing in the report… Please provide feedback with the lens of an intelligence analyst, although this is not a final intelligence product, but a comprehensive research monograph.

At this point, we have the base for our experiment: a set of skills that can, following the intelligence cycle, generate a final intelligence product about Morocco, so I provided Claude with the following instructions:

Once the appropriate skills have been created, you must

1. Gather data from open sources (mainly Moroccan, Spanish and Algerian) relevant to Morocco and cyberspace and store these references in local disk, with the following features:
   1. Markdown format.
   1. Unique identifier for each reference.
   1. Identification of the original URL, author, journal, institution, date of publication and date of acquisition for each reference.
2. Translate it into English before analysing.
3. Analyse the full data to generate a report in S2GRUPO format, with right and left justified text. In the file ‘skeleton.docx’ there is a basic structure for the document’s contents, as well as a brief description for the contents of each section. Please note that although the basic contents are identified, they can be expanded. Each section must be continuous, considering all its contents but not separating them into items. Once the report has been generated, update the table of contents.
4. The report must use words of estimative probability and appropriate references must be included at the end of the document using ACM format.

Et voilà. The final product has been generated. Of course, this final product is not one shot: I have updated skills, skeleton and prompts several times, and I have also asked my reviewer skill, Agent-in-the-Loop, to improve the final document, restarting the loop. In addition, Copilot and ChatGPT have been also used to improve the final product, as well as the skills. With some cycles (less than 10), the report is the one that is attached to this post.

This is the first step of my experiment: a report about Moroccan intelligence ecosystem, with a particular view on cyberspace. This a general, aseptic document: it only describes the Moroccan intelligence ecosystem, with a particular point of view on Spain but without delving into thorny issues. At this moment, it is being reviewed by our team as an exercise to check the accurateness of my private intelligence partner, codenamed CLAUDE 🙂 Of course, any improvements will be welcome!

I am attaching to this post not only the final report in PDF format, but the skills and skeleton (also in PDF, not Word) to generate it. Except for our corporate format, feel free to use and improve them. Of course, any suggestions or feedback about the process or the product are welcome. Enjoy!

One final note: perhaps, thorny issues regarding Morocco will be in future reports, although I don’t know if I’ll publish them. In my mind, I’d like to generate at least the following ones:

1. Pegasus and commercial surveillance
2. Morocco-Algeria cyber confrontation
3. Western Sahara as a cyber-intelligence theatre
4. Spain: liaison, espionage and strategic leverage

NB. I also asked Claude to translate the report into Spanish. Here is also the result.