Spain’s Council of Ministers approved on Tuesday the partial declassification of reports on the mass arrival of people in Ceuta on July 30 and 31. The documents cleared for release will be compiled into a dossier that, according to information published Tuesday morning, is expected to be available as early as Wednesday.
The measure covers situation reports and alerts drawn up between July 1 and August 1 by the National Intelligence Center (CNI), the Armed Forces Intelligence Center (CIFAS), the National Police, the Civil Guard and other agencies that monitored developments on the ground.
The declassification will not, however, be complete. Some documents will remain classified because of the sensitive information they contain or because they include intelligence supplied by foreign services. The government nevertheless intends to provide them to the parliamentary committee responsible for official secrets, as Cadena SER revealed.
Among the documents due to be declassified is a CIFAS report that assessed a mass arrival in Ceuta around Throne Day as highly likely. But the warning did not reach the upper levels of the Defense Ministry until July 30, leaving extremely little time to react. Other documents will address the gradual increase in arrivals by swimming and the consequences of the Supreme Court ruling restricting immediate pushbacks of people entering by sea.
Their publication should help clarify two separate questions that have been deliberately conflated for several weeks. The first is whether the Spanish authorities received sufficient warnings and responded appropriately. The second, entirely different question is who organized the mobilization. At this stage, neither question has received a definitive answer. But that was more than enough to unleash a full-blown political storm.
The Leak That Turned a Hypothesis Into a Verdict
The immediate source of that storm was the report by the National Center for Immigration and Borders (CENIF), a unit attached to the General Commissariat for Immigration and Borders.
Audiencia Nacional judge María Tardón requested the document on August 3 to determine whether the mass arrival had been spontaneous or the result of a coordinated operation. Dated August 26 and running to 55 pages, the report was submitted to the court on September 1.
Its existence and some of its conclusions were leaked that same day to El Español, which ran the headline: “Police Tell Judge Ceuta Invasion Was Guided by Moroccan Gendarmes Acting Under Orders From Plainclothes Agents, for a Purpose Other Than Migration.” The newspaper thus presented as an almost established police conclusion what, on reading the full document, amounts to an interpretation based on open sources.
Interior Minister Fernando Grande-Marlaska learned of the report through the press and asked National Police Director General Francisco Pardo for an explanation. Pardo replied that no police report attributed the planning and execution of the events to the Moroccan security forces.
Reading the document in full explains this apparent contradiction. The text does indeed raise suspicions about the conduct of certain officers. It refers to a degree of permissiveness, the directing of movements and the presence of individuals it believes, based on visual observation, to be linked to the security forces. But it identifies no one responsible for the planning and does not formally attribute the operation to the Moroccan government.
Cadena SER ultimately summarized it more accurately: the report points to the possible involvement of individual officers without directly implicating Morocco.
The document had been submitted directly to the Audiencia Nacional under the strictest confidentiality. It had passed through neither the Directorate General of the Police nor the Interior Ministry. Yet before the relevant institutions had even had a chance to examine it, its most accusatory interpretation was already dominating front pages, television panels and political speeches.
What the Report Actually Says About Morocco
Yet one has to look hard to find a direct accusation. On page 16 of the report, CENIF describes the response of the Moroccan security forces as “total permissiveness” and says that some officers directed crossings toward the beach and the El Tarajal breakwater.
Further on, the report divides the alleged participants into five levels. The first comprises those who crossed the border. The second consists of profiles and telephone numbers that circulated and amplified calls on social media. The third brings together the organizers of movements on the ground, among whom CENIF places “Moroccan officers in uniform” and supposed “mobilizing agents.” We will return to them. The fourth level is said to correspond to planning, while the fifth supposedly represents strategic direction.
As with the preceding levels, when it reaches these last two tiers—which are nevertheless decisive in establishing any responsibility—the report provides no details. It acknowledges that it was unable to identify the people who supposedly made them up and names no political official, commander or institution. Nor does it produce any order, internal communication or chain of command that would allow the operation to be attributed to the Moroccan state.
The document itself acknowledges that the supposed structure was “diffuse,” that the actions were decentralized and that it is impossible to establish “a classic hierarchical pattern of action.” The conclusion therefore precedes the demonstration: CENIF assumes that a mobilization on such a scale could only have been planned, then uses that presumed planning to interpret all the other clues. In other words, it describes a meticulously directed operation without knowing who supposedly directed it.
Approximate Data for a Supposedly Meticulously Planned Operation
The report acknowledges that it has no reliable figure for the number of people who entered Ceuta, returned to Morocco or remained in the city. Its estimates range from 49,200 to 85,000 entries—a remarkably wide range—while the number of people who remained there is put at between 5,000 and 10,000.
Despite this “impossibility of quantification,” the document states that around 90% of those involved voluntarily returned to Morocco and presents that return as evidence that their objective was not migration-related. It also interprets the initial arrival of young people, followed by families, women and children, as two phases designed first to overwhelm the border apparatus and then to neutralize any possibility of a coercive response.
But the report does not demonstrate that these groups received different instructions or that they were mobilized according to a predetermined timetable. The sequence has a simpler explanation. Young people capable of swimming around the breakwater were the first to cross the border. Images of those crossings then fueled rumors that the border was open. A snowball effect followed, drawing in families and people who were less prepared.
Nor does the mass return prove the existence of a political objective. It can be explained by the impossibility of reaching the Spanish mainland, hunger, the lack of accommodation and resources in Ceuta, fear of expulsion, or the discovery that rumors of automatic regularization were false. If the objective really was to keep Ceuta in a prolonged state of saturation, the almost immediate return of the overwhelming majority of participants would in fact appear to contradict that supposed strategy.
Moroccan Numbers in Morocco, and Agents Identified by Their Clothes
CENIF also emphasizes that 90.8% of the telephone numbers analyzed had Moroccan country codes. A different result would have been difficult to expect, since the mobilization took place in Morocco and its participants were predominantly Moroccan. A country code indicates the country in which a line was registered. It neither identifies its user, establishes that person’s affiliation with an institution, nor proves that they were acting on instructions from an authority.
Nor does the report establish the existence of an automated network, common financing, shared technical infrastructure or verified links between the profiles studied and a public body. It observes that the messages went viral and infers from this the existence of a “direction” that it remains unable to identify.
More tenuous still is the identification of 24 supposed plainclothes “mobilizing agents.” The document describes them as men aged between 30 and 50, of “strong or athletic build,” with short hair, wearing neutral colors, long trousers and sports shoes, and sometimes carrying a cap, backpack or shoulder bag.
It also considers suspicious the fact that they move against the flow of the crowd, observe the scene, use their phones or help others cross obstacles. Yet none of these elements establishes that they belong to the security forces.
Nor do the photographs make it possible to hear the supposed instructions, identify those involved or reconstruct the full context of each scene. The report interprets visible behavior and inserts it into a structure whose existence it had already posited. An accumulation of suspicions may justify an investigation. On its own, it cannot constitute evidence against a state.
The Images Left Out of the Narrative
More striking still, while part of the Spanish press was turning cropped images into evidence against Morocco, other videos circulating as early as July 30 showed a far more complex reality.
They show dozens of Moroccan officers equipped with helmets, shields and riot-control gear deploying near Bab Sebta. Other footage shows interventions aimed at containing groups, charges, warning shots and Moroccan forces attempting to regain control of roads and access points that had been completely overwhelmed.
These images were not discovered several weeks after the events. Moroccan and even Algerian media outlets circulated them on July 30 and 31. EFE itself reported from the ground that the Moroccan authorities were using riot-control equipment, tear gas and water cannons to disperse the crowd.
The highly credible Spanish fact-checking outlet Newtral geolocated one of these sequences to the Bab Sebta taxi station in Fnideq. It also confirmed that the video was already circulating on July 30 and 31 and that the uniforms matched those worn by the Moroccan security forces.
Newtral rightly points out that an isolated video cannot establish with certainty what the officers were doing at that precise moment or confirm the exact date on which it was recorded. But that caution must work both ways. If an out-of-context video is not enough to demonstrate that officers were containing the crowd, an isolated photograph is no more sufficient to prove that they were deliberately organizing its entry into Ceuta.
The circulation of these images did not escape Spanish Transport Minister Óscar Puente, who shared them on his X account while denouncing the bias that had shaped the initial narrative. “It is curious that all these images did not emerge in the first few days, unlike others that had nothing whatsoever to do with the events. The bias of social media has never been so obvious.”
These images do not erase the fact that the Moroccan security deployment was overwhelmed, nor that there may have been moments of retreat. They do, however, make it impossible to reduce 48 hours of chaos to the single photograph that best fits an accusation formulated in advance.
The Report Itself Mentions Spanish Warnings
Reading the full report also reveals another element relegated to the background in the initial leaks. CENIF lists several warnings issued within the Spanish apparatus before the events.
On July 27, Ceuta’s Provincial Immigration and Borders Brigade sent a communication entitled “Mass Entry of Migrants by Swimming,” in connection with Supreme Court ruling 814/2026. On July 29, CENIF itself issued an alert over the risk of irregular entries the following day. On July 30, it again warned of a risk of saturation, before updating the alert on July 31.
The report even raises the need to examine possible responsibility at different levels of the Spanish response. The declassification approved on Tuesday should make it possible to determine who received each warning, how it was assessed and what decisions were taken.
The investigation therefore cannot be limited to Morocco. It must also examine how the Spanish apparatus functioned, how the warnings were assessed, the insufficiency of reinforcements and the decisions taken during the most critical hours.
Investigating Does Not Mean Convicting
The Audiencia Nacional decided on Monday to investigate the events on the grounds that they could constitute offenses against territorial integrity, involuntary manslaughter and criminal organization. In her order, Judge Tardón considers that facilitating action may have been carried out from Moroccan territory. Nothing more is known at this stage.
Opening an investigation does not, however, turn that hypothesis into an established fact. Investigations have been ordered precisely because what happened and who may have been responsible remain to be determined.
The CENIF report may provide a starting point. It contains data, compiles messages, classifies images and advances hypotheses that deserve to be verified. But it in no way demonstrates any responsibility on Morocco’s part.
It does not identify the supposed mastermind. It produces no order. It reconstructs no chain of command. It does not demonstrate institutional links between the digital profiles examined and the authorities. It does not establish that the men presented as plainclothes agents actually were security officers. Finally, it fails to properly incorporate the images showing Moroccan forces attempting to contain the situation.
The difference between suspecting certain individuals of one form of conduct or another and accusing a state of organizing a hostile operation is not a semantic nuance. And in both cases, the evidence is lacking.
Whatever its conclusions, the declassification does not appear likely to bring Spain’s political cacophony to an end. Before even seeing the documents, Alberto Núñez Feijóo, leader of the opposition conservative People’s Party, was already claiming they would be “redacted,” while the far-right Vox party denounced a “smokescreen” and leveled fresh serious accusations without the slightest evidence.
Everything suggests that, for some, political interests carry more weight than the search for truth. Or at least more weight than any truth that does not conform to the one they have already chosen to promote. The publication of the reports may provide new answers. It will not be enough to silence a din that has, in the meantime, become a deafening electoral battle.
