On Thursday morning, while tens of thousands of Moroccans threw themselves into the water or advanced toward Tarajal, the Spanish government had a certainty and a doubt. The certainty was that there was a violation of Spain’s territorial integrity taking place. The doubt consisted of how much could be stated about the role played by Morocco. Pedro Sánchez spoke of an attack, pointed to the mafias and described the Alawite kingdom as an ally. Spain had identified the fact, but held its attribution in suspense. In international politics, the use of the omitted subject is more than a stylistic license: it is a strategic decision that determines who appears as the victim, who can be considered responsible, and what kind of solidarity can be claimed.
Five years earlier, the opposite happened. In May 2021, more than 10,000 people entered Ceuta in less than 48 hours after Spain discreetly hosted in a hospital in La Rioja Brahim Ghali, the leader of the Polisario Front. Rabat withdrew its ambassador. Margarita Robles accused Morocco of “blackmail” and of “aggression”. One could discuss Spain’s management or the disproportion of the Moroccan response, but no one ignored what crisis was unfolding. There was a trigger, a retaliation, and an actor. Europe understood that the Ceuta border was also European.
“In 2026 the figure has been five times higher and the diagnosis five times lower”
In 2026 the figure has been five times higher and the diagnosis five times lower. Some 50,000 people entered in barely a day, although 48,300 had returned to Morocco hours later. There were signals before, swimming attempts increased, Ceuta asked for help and the Civil Guard reported the uptick. Yet, the Government was focused on the fires. “Ceuta was not on the radar”, government sources acknowledged. The border had been speaking in a low voice for days, but Madrid only heard it when it shouted.
The Supreme Court ruling that limited immediate returns of those arriving by sea could act as a trigger. The Supreme Court ruling that limited immediate returns of those arriving by sea could act as a trigger. Other explanations have also been ventured: the trip of Sánchez to Algiers, the proposal to grant nationality to certain Sahrawis, the revelations about Pegasus or even a preemptive warning to Alberto Núñez Feijóo. They are hypotheses; none alone proves the facts. Attributing a hybrid operation requires more than intuitions, background, and coincidences.
But evidentiary prudence does not compel strategic blindness. Between asserting that Mohamed VI personally organized the march and maintaining that Morocco was an overwhelmed bystander there is a wide margin. The essential thing is not to figure out who wrote the first message on a social network, but to explain how tens of thousands of people reached one of the Maghreb’s most watched borders without a state with powerful police and intelligence services being able to prevent it. The images show Moroccan passivity and the sequence recalls, at least in its mechanics, 2021. In Morocco itself many asked what Spain would have done “to have us punished like this” (a phrase journalist Ignacio Cembrero attributes to Moroccan users on social networks).
Attribution Also Forms Part of Defense
“In a hybrid threat, attribution rarely allows identifying a single, complete chain of command”
In a hybrid threat, attribution rarely allows identifying a single, complete chain of command. What matters is to reconstruct the different levels of responsibility: what act acted as a detonator, who amplified the mobilization, which networks seized the opportunity, which authorities deliberately reduced — or failed to exercise — their capacity to contain it, and which actors subsequently gained a political or strategic advantage. That fragmentation is not accidental, but part of the method. The operation substitutes an identifiable order with a mix of rumors, intermediaries, omissions, and plausibly deniable decisions. Its effectiveness lies precisely there: in dispersing so much responsibility that the victim can describe the effects, but has difficulty attributing them and responding proportionally.
The Spanish Government has chosen the easiest formula to maintain cooperation with Rabat and the least useful for obtaining external solidarity. It denounces a territorial violation but blames nameless mafias. It presents Morocco as an ally while asking that ally to readmit those who crossed from its territory a border that its forces had stopped guarding effectively. The domestic slogan was to avoid any attack on Rabat. Perhaps that caution facilitated the rapid return of the majority. It also sent abroad the message that, if Morocco helps us and the mafias strike, Spain is not a victim of state coercion, but a manager of a migratory crisis.
Defending oneself does not consist only of deploying soldiers or reinforcing patrols; defense begins earlier, in the act of naming. Something is always defended against someone. Even when attribution cannot be definitive, it should be gradual: who generated the movement, who facilitated it, who failed to fulfill their obligations, and with what level of certainty is each thing asserted. Defending oneself is, in that sense, to accuse with method. Without attribution there is management; without a subject there is an incident; without a recognizable adversary, allies do not know whom they should stand against.
That is where the difference lies between 2021 and 2026. Five years ago Spain pointed at Morocco and Europe saw pressure on Spain. Now Spain points at the mafias and a large part of Europe sees a problem caused by Spain. The ambiguity, designed to protect the bilateral relationship, has ended up weakening the multilateral position.
When Europe Stops Seeing a Common Threat
La reacción europea fue rápida, pero no precisamente solidaria. Ursula von der Leyen calificó de “inaceptables” las imágenes, exigió devoluciones rápidas y pidió desmantelar las redes de tráfico. Friedrich Merz reclamó retornos “sin demora”. Italia, Dinamarca, Finlandia y la República Checa plantearon suspender a España del espacio Schengen. Francia reforzó los controles. Solo después llegaron apoyos claros, como el de António Costa. La Comisión tuvo que recordar, además, que no se había detectado ningún desplazamiento desde Ceuta hacia la península ni hacia otros Estados miembros y que la ciudad mantiene controles en sus conexiones con el continente.
The European reaction was swift, but not exactly solidarity. Ursula von der Leyen called the images “unacceptable,” demanded swift returns and urged the dismantling of trafficking networks. Friedrich Merz demanded returns “without delay.” Italy, Denmark, Finland, and the Czech Republic proposed suspending Spain from the Schengen area. France tightened controls. Only later did clear supports arrive, such as from António Costa. The Commission also had to remind that no movement had been detected from Ceuta toward the peninsula or toward other member states and that the city maintains controls on its connections with the continent.
The 2015 comparison is tempting and misleading. Then, hundreds of thousands of refugees fled the Syria war and moved along several routes toward central Europe. The disagreement revolved around sharing, reception, and responsibility. In Ceuta there is no consolidated continental route. There is a sudden concentration, in a singular enclave, coming from a stable country that rigorously controls its territory when it chooses to do so. In 2015 Europe argued about how to distribute a burden. In 2026 some governments have preferred to discuss how to isolate the country bearing it.
It is also inevitable to recall the Poland-Belarus border. Warsaw described that movement as Minsk’s instrumentalization of migrants, raised barriers and deployed forces. The European debate focused on how to help Poland protect its eastern border. Now Donald Tusk recommends Spain follow that example and militarize its border with Morocco. The difference lies not only in Europe’s greater sensitivity toward Russia and its allies. Poland offered from the outset a recognizable aggressor; in contrast, Spain offers aggression without an author.
“Facts never arrive alone; they always come accompanied by an interpretation that orders them, assigns responsibility, and determines the possible response”
Thus, facts never arrive alone; they always come accompanied by an interpretation that orders them, assigns responsibility, and determines the possible response. If a population movement is defined as an instrument of pressure by a third state, the border country appears as the victim and solidarity consists of reinforcing it. If it is interpreted as poorly managed irregular immigration, that same country becomes a risk to others and solidarity takes the form of surveillance, demands, or closure. The people are the same; so are the beaches, the fences, and the uniforms. The difference lies in the political category into which they are placed. Spain publicly described the episode from the second frame while waiting for its partners to respond according to the first.
The Strategic Cost of Ambiguity
There is a deeper European contradiction. The Union has delegated part of migratory control to neighboring countries and grants political centrality to those who curb departures. That outsourcing reduces arrivals, but gives the guardian a lever. Morocco does not need to open the border formally; it is enough to adjust its surveillance, remind of its indispensability, or permit for a few hours that geography speaks. The more Spain depends on Moroccan cooperation, the more costly it becomes to attribute any responsibility to Rabat, and the less it attributes, the less it can ask Europe to interpret what happened as a common threat.
There is a common claim that the strength of an alliance depends on the unity of its members, though that formula confuses unity with concurrence. Allies do not need to fear exactly the same things; they need, at least, to agree on which threats are priorities, when pressure exerted against one affects the whole, and what response corresponds to each level of risk. Europe has achieved that convergence against Russia because years of war have reduced the space for divergent interpretations. However, on the southern border we lack much in the way of threat-education projection. Without the correct interpretive framework of what Spain regards as a hybrid attack in migratory terms, European states translate the images into the language of their own internal politics. We must not forget that the interpretive frameworks of what happens within borders also concern the sovereignty of the state itself. Thus, the Spanish Government has asked for solidarity, surprised that its partners took at face value the narrative it had built.
“Ceuta has exposed a great vulnerability of European unity”
Ceuta has exposed a great vulnerability of European unity. Hybrid threats do not always seek to conquer territory or provoke a military response; they are enough to exploit the gray areas between security, diplomacy, immigration, and defense, force the attacked state to first discuss what happened and cause its allies to view the same episode from different categories. While some see coercion, others see disorder. While some call for solidarity, others demand containment. There lies their effectiveness: in turning the ambiguity of the method into political divergence among those who should respond together.
We still have a long way ahead. Spain and Europe have advanced in means, surveillance and coordination, but continue reacting to many hybrid threats with monolithic institutions designed for traditional conflicts and with a language that arrives always after the events. We will need to learn to detect earlier, attribute with prudence but without evasion, and distinguish when a flow, an infrastructure or a digital campaign has ceased to be mere vulnerabilities and has become instruments of pressure. We will also need to decide which threats occupy the top places in the common hierarchy, because no alliance can effectively defend what each one interprets differently. The next crisis may perhaps again begin on a beach, a social network or an apparently secondary border. The difference will be whether, when it arrives, we continue debating how to name it or whether we have already learned to recognize it.
