The headline states the hypothesis under examination. The facts establish the existence of a rapidly unfolding, multi-actor pressure campaign originating in Spain and directed against Morocco. They reveal a form of hybrid warfare waged by a constellation of political and non-state actors—the PP, Vox, certain sections of the radical left and various anti-Morocco networks—but not a centralized hybrid war conducted by the Spanish state.
Overall Conclusion
In exactly fifty days, the Ceuta emergency spread into almost every sphere associated with contemporary hybrid pressure: borders, intelligence, parliamentary politics, the judiciary, European diplomacy, funding, trade, football, street mobilization, opinion-shaping and social media. Morocco became the primary target of blame in Spanish public opinion, even as the prime minister and several Spanish security assessments said there was no solid evidence demonstrating that Rabat had planned the mass entry. [3][5][6][18][19]
This accumulation has produced genuine coercive effects, but the terminology must remain rigorous. Hybrid warfare normally implies intentional orchestration by an identifiable actor using several coordinated instruments to coerce a target below the threshold of conventional warfare. The facts examined establish convergence and cumulative pressure. They establish neither a Spanish command center, nor a common plan uniting the right and the left, nor demonstrated Algerian or Polisario direction. The strongest conclusion, therefore, is that of a networked hybrid-pressure offensive generated in Spain and amplified at the European level, rather than a hybrid war conducted by the Spanish state.
What Is Established
- A mass movement towards Ceuta took place on July 30 and 31 following mobilization in large online groups. The figures vary according to the date and institution: the European resolution cites around 80,000 entries, at least 141 deaths and as many as 11,000 people still present; early humanitarian assessments referred to around 72,000 entries and more than 70,000 returns by August 4. These are successive snapshots, not necessarily contradictions. [1][8]
- Spain deployed police and military resources. Morocco accepted mass returns, then mobilized thousands of officers to prevent another attempt while arresting migrants and suspected facilitators. [7][9]
- On July 29, the CNI warned Spanish and Moroccan authorities about calls circulating in groups with a combined membership of more than 180,000. The declassified documents do not reach a single, consensual attribution. [4][5][6][27]
- The PP, Vox and their European allies internationalized the crisis, imposed the terms invasion and hybrid warfare, and called for greater conditionality; some demanded the immediate suspension of funding and agreements with Morocco. [12][13][14]
- The radical or alternative left did not embrace the right’s entire narrative, but Sumar and other actors converged around one coercive instrument: calling Morocco’s participation in hosting the 2030 World Cup into question. [15]
- The Audiencia Nacional opened an investigation. The PP, Vox, Iustitia Europa and Hazte Oír were admitted as popular accusations. The opening of an investigation establishes the seriousness of the case, not the responsibility of the Moroccan state. [11][28]
- The European Parliament adopted a resolution by 339 votes to 225, with 16 abstentions. It characterizes the instrumentalization of migration as hybrid warfare, strengthens conditionality and calls for an examination of possible facilitation, deliberate inaction or the participation of state or non-state actors. It does not formally attribute the operation to Morocco. [1][2][29]
Timeline of the Fifty Days
| Date | Verified event |
|---|---|
| July 29 | The CNI warns Moroccan interlocutors, the Government Delegation in Ceuta and the Guardia Civil of online calls for a mass attempt by sea and over the fence. [4][6] |
| July 30–31 | Mass entries overwhelm the border apparatus. Spain deploys the military. The death toll and other figures remain subject to revision. [1][7][8] |
| August 1 | Twenty-two European leaders partly link the crisis to Spain’s regularization policy and call for Frontex involvement and cooperation with Morocco. [1] |
| August 2–4 | Rabat cites disinformation, trafficking networks and a misinterpretation of Spanish law. Mass returns continue. European interior ministers express their solidarity. [1][8] |
| August 5–6 | Sumar proposes reconsidering Morocco’s role in the 2030 World Cup. An extraordinary meeting of the LIBE Committee turns into a partisan confrontation; Spanish ministers do not attend. [14][15] |
| August 15 | Morocco deploys substantial resources against another announced attempt and arrests 294 sub-Saharan migrants and 61 suspected Moroccan facilitators. No comparable second wave occurs. [9] |
| August 21–28 | Madrid summons Morocco’s ambassador, requests €32 million in emergency aid, then seeks assistance from Frontex, Europol and the European Union Agency for Asylum. [1][3] |
| August 25 | OBERAXE reportedly detects 9,590 hate messages during July 30 and 31 alone. [17] |
| August 31 | Sánchez accuses networks linked to Russia, Israel and the international far right of fuelling disinformation. The states implicated deny the allegations. [21] |
| September 2 | Thousands demonstrate in Ceuta and elsewhere in Spain. The Por Ceuta citizens’ petition approaches 65,000 signatures; left-wing rallies denounce racism and Islamophobia. [16] |
| September 3 | Sánchez says no Spanish institution possesses solid evidence of Moroccan planning. Feijóo intensifies his calls for resignations and legal action. [3] |
| September 7 | The Audiencia Nacional opens an investigation. A 40dB poll indicates that 89% of Spaniards hold Morocco responsible and that the government’s handling of the crisis is widely rejected. [11][18][19] |
| September 9 | Spain releases forty intelligence communications containing divergent assessments. The European Commission grants €114.7 million in emergency aid. [1][5][6][27] |
| September 14–16 | Seven competing draft resolutions are tabled. The EPP and the radical right harden their demands for conditionality. Football becomes another arena of confrontation with the Todos somos caballas campaign. [2][12][13][22][23] |
| September 17 | The European Parliament adopts its resolution, condemning the instrumentalization of migration as hybrid warfare while leaving attribution open. [1][29] |
The Trigger and the Attribution Gap
The operational trigger is documented. Large online communities circulated instructions after a Spanish Supreme Court ruling was interpreted online as making it impossible to immediately return people who arrived by swimming. The CNI warned both countries before the events. The movement then coincided with the Throne Day celebrations, a circumstance that may have affected the availability and positioning of Moroccan forces. [4][6]
«Vox and its allies used the most maximalist language, describing the entries as an invasion and alleging Moroccan orchestration. The Patriots for Europe position called for the immediate suspension of European funding.»
— Lahcen Haddad
Intent, however, remains undetermined. A Spanish police report describes a reduced Moroccan presence and apparent permissiveness during a decisive period. Other Guardia Civil documents consider a deliberate withdrawal unlikely and describe Moroccan forces as overwhelmed and caught operationally by surprise. The CNI speaks of generally reasonable cooperation despite the saturation. Sánchez acknowledges a critical period during which Moroccan police allowed people through but says it is impossible to determine whether this resulted from inability or choice. [3][5][6][27]
This distinction is fundamental. Failing to prevent something, deliberately tolerating it, covertly facilitating it and directing an operation represent four different levels of responsibility. Public debate has frequently conflated them. The European Parliament’s final request for an investigation into possible facilitation or deliberate inaction demonstrates that, on the fiftieth day, attribution remained open. [1]
The Actors and Their Objectives
The Spanish Government
Pedro Sánchez, Fernando Grande-Marlaska and the PSOE defended cooperation with Rabat and rejected any definitive accusation in the absence of evidence. Their objective was to restore order while preserving Moroccan cooperation, which was essential for returns and migration control. The government nevertheless summoned the ambassador, requested European assistance, deployed forces and reaffirmed Spanish sovereignty. This was pressure combined with interdependence, not a policy of rupture. [1][3][10]
The Partido Popular and the European People’s Party
Alberto Núñez Feijóo and the PP turned the emergency into a crisis of sovereignty and government legitimacy. The PP called for Sánchez’s resignation, joined the judicial proceedings, mobilized its municipal networks and took the issue to the European Parliament. Tomas Tobé and Dolors Montserrat denounced Sánchez’s failure or complicity. Contrary to some headlines, the EPP text did not explicitly call for the immediate suspension of the EU-Morocco Association Agreement, although it significantly hardened conditionality. [12][13][16]
Vox and Europe’s Radical-Right Networks
Vox and its allies used the most maximalist language, describing the entries as an invasion and alleging Moroccan orchestration. The Patriots for Europe position called for the immediate suspension of European funding and of the Association Agreement until the crisis was resolved and guarantees obtained. ECR lawmakers also organized events devoted to Ceuta and promoted the characterization of the episode as hybrid warfare. [12][14]
Sumar, Podemos, Izquierda Unida and Convergence on the Left
These parties did not form an alliance with the PP or Vox and frequently opposed their rhetoric on migration. Some nevertheless converged around a means of applying pressure on Morocco: the 2030 World Cup. Sumar’s non-binding proposal called on Spain to reconsider co-hosting the tournament with Morocco; similar calls were associated with Podemos and Izquierda Unida. Convergence around an instrument does not demonstrate common command, but it does show that anti-Morocco coercion crossed ideological lines. [15]
Ceuta’s Institutions, Civil Society and the Judiciary
The Ceuta Assembly unanimously called for the border to be closed, emergency measures to be adopted, the National Security Council to be convened, a unified command to be established and the military to provide support. Human-rights organizations, meanwhile, warned against collective expulsions and racist violence. The Audiencia Nacional investigation added judicial pressure and gave parties and associations a forum in which to seek evidence and influence the public narrative. [1][11][16][28]
The European Union
European institutions simultaneously acted as emergency funder, border coordinator and political multiplier. The Commission granted €114.7 million; member states and Parliament called for tighter controls; and the final text linked cooperation, funding and market access to results. The internationalization of the issue thus gave the Spanish accusations potentially material consequences. [1][25]
Morocco
Morocco is not merely the accused party: it is also the indispensable operational partner. Rabat accepted a considerable number of returns, deployed thousands of officers against a second mobilization and arrested suspected facilitators. According to official figures reported by Reuters, Morocco prevented 73,640 irregular migration attempts and dismantled more than 300 networks in 2025. These facts do not rule out a possible failure during the decisive hours, but they contradict the idea of continuous or total non-cooperation. [8][9][10]
Algerian and Polisario Relays
Pro-Morocco accounts have accused Algerian or Polisario-linked actors of planting or amplifying hostile narratives, sometimes built on chains of anonymous sources. This research found examples of partisan amplification, but no sufficient public evidence of operational direction, financing or coordination by the Algerian state or the Polisario. They must therefore be presented as alleged or opportunistic relays, not as established sponsors.
The Arenas of Pressure
Information Warfare and the Making of the Narrative
The decisive semantic shift consisted in replacing migration crisis with invasion, attack and hybrid warfare. This vocabulary moved from partisan statements and television studios into the European Parliament’s text. It conflated three propositions that are nevertheless distinct: a massive breach of the border occurred; the Moroccan apparatus failed during part of the events; Rabat directed the operation. The first is established, the second is supported by evidence but disputed as to its causes, and the third has not been demonstrated. [1][3][5][13]
Disinformation circulated in several directions: old videos presented as current, posts hostile to migrants or Moroccans, and government accusations of Russian, Israeli or far-right amplification, denied by the states concerned. Another story about 68 girls allegedly removed from an orphanage relied on a succession of anonymous intermediaries, was itself presented as still requiring corroboration and was accompanied by an AI-generated illustration. It cannot be treated as fact without a document, institution, identified witness or independent evidence. [17][21]
Economic and Diplomatic Coercion
The main levers proposed were the suspension or conditionality of European funds, pressure on the Association Agreement, market access, visas and trade. The final resolution did not immediately suspend the agreement but called for mechanisms allowing funds to be suspended or recovered in cases where cooperation was deemed insufficient. This constitutes a genuine coercive instrument, even before its activation. [1][12][25]
An informal boycott of Moroccan products and tourism to Morocco emerged in Spanish media and on social networks. Its visibility was sufficient to generate national television coverage, but no reliable participation rate, comprehensive list of organizers or measured commercial impact was available by the research cut-off date. It should therefore be regarded as emerging grassroots economic pressure, not as a coordinated and successful nationwide boycott. [24]
Legal and Institutional Pressure
The Audiencia Nacional investigation, the popular accusations, demands for declassification and parliamentary initiatives transformed political accusations into institutional procedures. Such mechanisms can establish the truth, but they can also prolong a damaging accusation before responsibility has been established. Opening an investigation means that a judge considers the matter sufficiently serious to warrant investigation; it does not mean that Morocco has been declared responsible. [11][28]
Sport and Reputation
The 2030 World Cup became a coercive lever targeting one of Morocco’s most prestigious international projects. The Todos somos caballas campaign subsequently brought Ceuta into LaLiga. Moroccan international Ezzalzouli defended his participation as a humanitarian rather than political gesture; other players covered the message, while Real Madrid invoked freedom of expression. The episode demonstrates the migration of the conflict into sport, not the involvement of clubs or players in a state operation. [15][22][23]
Street Mobilization and Social Pressure
The September 2 demonstrations gave tangible expression to national pressure. In Ceuta, slogans defended sovereignty, demanded expulsions or called for Sánchez’s resignation; other rallies took place in Madrid, Barcelona, Bilbao and elsewhere. The FEMP, dominated by the PP, had called the nationwide demonstrations. The Por Ceuta initiative collected nearly 65,000 signatures around a platform combining human rights, orderly returns and stronger security. Counter-demonstrations denounced racism and Islamophobia. [16]
OBERAXE reportedly detected 9,590 hate messages in just two days. This does not turn every criticism of Morocco into racism, but it does establish that a significant xenophobic component accompanied the legitimate security debate. [17]
The Shift in Public Opinion
The 40dB survey of 2,000 people recorded a consensus of blame without an equivalent consensus on the evidence: 89% held Morocco responsible, 75% trafficking networks, 74% online disinformation, 73% migrants and 72% the Spanish government. Only 14.2% rated Sánchez’s handling positively, while around two-thirds considered the response too slow. [18][19]
The hardening went further: 70% preferred stricter borders even at the expense of vulnerable people. A majority wrongly believed that at least half of those who had entered were still in Ceuta. Vox was considered the most competent party on immigration by 27%, ahead of the PSOE at 18.4% and the PP at 13.9%. On sovereignty, 63.6% considered Ceuta and Melilla non-negotiable; 63.8% supported military intervention in the event of aggression; and 53.9% were prepared to accept the economic cost of sanctions. [19]
The September CIS barometer put the PSOE at 31%, the PP at 25.5% and Vox at 16.6%. It does not directly measure the causal effect of Ceuta, but the rise attributed to Vox is consistent with an environment dominated by security and immigration. [20]
Evidence Matrix
| Claim | Assessment | Basis |
|---|---|---|
| Mass entries and border collapse | Established | Multiple official and independent sources |
| Prior online mobilization | Established | CNI warning and declassified communications |
| Temporary Moroccan passivity or failure | Supported, but cause disputed | Divergent police and intelligence assessments |
| Moroccan state direction of the operation | Not established | No solid evidence identified by Sánchez or in the published documents |
| Multi-domain pressure against Morocco | Established | Parliamentary, judicial, economic, sporting, media and social arenas |
| Unified Spanish command | Not established | Government, right- and left-wing opposition pursued different objectives |
| Algerian or Polisario direction | Not established | Observable amplification, but command, financing and coordination unproven |
| Effectiveness of a nationwide boycott | Not established | Calls documented, but scale, impact and organizers not measured |
Can This Be Called Hybrid Warfare?
If the expression is used descriptively to denote simultaneous pressure through information, institutions, the economy, law, diplomacy, sport and public mobilization, the fifty-day dossier contains many such instruments. Morocco’s international image, its relationship with the European Union, its market access, its flagship sporting project and its bilateral relations were all placed under pressure.
If the expression is used in its strict analytical sense, three elements are missing. First, no central direction has been demonstrated. Second, the actors were not pursuing a single objective: some wanted to bring down Sánchez, others to strengthen migration deterrence, defend human rights or target Morocco, while the Spanish government sought to protect its cooperation with Rabat. Third, attribution of the initial border event remains open.
The most accurate formulation is therefore the following: from July 30 to September 17, 2026, Morocco was the target of a networked hybrid-pressure campaign originating in Spain, internationalized by European institutions and amplified by the media, political competition and collective fear. Speaking of Spanish hybrid warfare is defensible only as a thesis about the cumulative effect, not as an established fact concerning a unified state intention.
Conclusion
Who is waging hybrid warfare against whom? The facts allow neither the simplistic answer that Morocco attacked Spain nor the claim that the Spanish state attacked Morocco. They reveal a more troubling reality: an as-yet unexplained border failure became the raw material for a decentralized coercive ecosystem. Opposition parties, European allies, associations, civil parties, media personalities and online networks pushed overlapping narratives and sanctions. Part of the left joined them over the World Cup lever. The government rejected attribution while applying diplomatic and security pressure. Morocco cooperated extensively after the entries, while questions surrounding the decisive hours remained unanswered.
The danger lies precisely in this ambiguity. Hybrid pressure does not require every participant to receive orders from a single center: it can emerge when different actors discover that the same target serves different interests. But rigorous analysis must stop where the evidence stops. On the fiftieth day, the pressure campaign remains real. A unified Spanish plan does not. The decisive facts will have to come from the Audiencia Nacional investigation, the complete intelligence archives, documented chains of command and measurable evidence of economic or political coordination.
Source Notes
Order of priority: official and judicial texts, news agencies, public-service media, major newspapers, partisan statements and specialist sources. Figures describe the situation as of the publication date of each source and may evolve.
[1] European Parliament Resolution P10 TA 2026 0317
[2] European Parliament motion and amendments dossier
[3] Reuters on the absence of evidence of Moroccan orchestration, according to Pedro Sánchez
[4] Reuters on the CNI warning preceding the entries
[5] Cadena SER on the Guardia Civil’s assessment regarding Morocco
[6] RTVE on the forty declassified intelligence communications
[7] Associated Press on the initial entries and Spanish military deployment
[8] International Rescue Committee on the figures, returns and conditions
[9] Associated Press on the Moroccan arrests and deployment of August 15
[10] Reuters on Moroccan migration enforcement in 2025
[11] Spanish judiciary statement on the Audiencia Nacional investigation
[12] Newtral on the respective positions of the EPP and Vox
[13] EPP Group statement on Ceuta
[14] Eunews on the extraordinary meeting of the LIBE Committee
[15] Associated Press on Sumar’s proposal regarding the 2030 World Cup
[16] Reuters on demonstrations in Ceuta and elsewhere in Spain
[17] Euronews on the 9,590 hate messages detected by OBERAXE
[18] Reuters on the 40dB poll
[19] El País on the detailed results of the 40dB poll
[20] RTVE on the September CIS voting estimate
[21] Reuters on allegations of foreign disinformation and the denials
[22] Reuters on LaLiga’s solidarity campaign and Abde’s response
[23] Reuters on players who covered the Ceuta message
[24] Antena 3 on the emergence of a boycott of Moroccan products and tourism
[25] Reuters on European migration-related leverage over Morocco
[26] Cadena SER on the police report and criminal networks following the entries
[27] El País on divergent assessments by Spanish services
[28] El País on the parties admitted as popular accusations
[29] European Parliament agenda concerning Ceuta
