The Ceuta Crisis Puzzle: A Moroccan Operation?

CSDS POLICY BRIEF • 18/2026

By Denis Cenusa and Ivan U. Klyszcz

6.10.2026

Key issues

• The instrumentalisation of migration can be used to conduct hybrid warfare along all of the EU’s external borders, including the southern flank.
• Certain plausible hypotheses about the mass unauthorised crossings into Ceuta, Spanish territory in North Africa, suggest Moroccan involvement.
• The orchestration of illegal migration can have cascading negative effects by boosting the anti-migration discourse of far-right political forces in Europe.

 

Introduction

On 31 July 2026, the Spanish autonomous community of Ceuta (with a population of 83,000) made international headlines. That day, up to 72,000 individuals breached the international border between Spain and Morocco without authorisation, according to Spanish government estimates. Crossing by land and through the shallow sea separating Ceuta and neighbouring Fnideq, over 100 people died, mostly from drowning. The emergency services and migrant support volunteers were overwhelmed from the start. Yet, over the course of the day, most of those who entered had already left. Violent incidents have been reported.

Despite the return to Morocco of most of the individuals who crossed into Ceuta, breaching the Spanish border, the Ceuta crisis continues to make waves, with up to 3,000 Moroccan and Sub-Saharan irregular entrants remaining on Spanish soil. The stakes are high because the Ceuta events have been at the centre of Spanish politics, with the potential to reshuffle the country’s political landscape after the recently announced early elections this November. Moreover, the crisis feeds into the wider far-right anti-migration discourse affecting all of Europe. With casualties, a rattled domestic political scene and a polarised response, lessons must be drawn from the event. However, clouding the picture is the political line swiftly adopted in subsequent declarations, which place the origin of the crisis squarely on Spain’s policies, “smuggler networks”, allegations pointing to representatives of the Moroccan police and intelligence, and, finally, Russia’s footprint.

Despite the decisive tone, the European response left many dissatisfied, starting with Spaniards themselves, over a perceived lack of solidarity from Brussels and the national capitals, and a weak response to Morocco, which the Spanish opposition views as the main source of the Ceuta crisis. As new information has surfaced, the assumptions of the political line must be evaluated, starting with the cause of the crisis, which, at large, is shaped by the history of the Spain-Morocco relationship. What was at the origin of the major border breach that happened in July? Clarity would benefit both crisis preparedness and prevention, and more cohesive European solidarity mechanisms. The Ceuta crisis prompts a discussion about the broader range of hybrid operations that involve the well-known instrumentalisation of illegal migration, which certain neighbours – such as Libya or Türkiye – have used in the past to extract concessions from the European Union (EU) in exchange for external border protection.

For this reason, this CSDS Policy Brief argues that the Ceuta events were not a sudden crisis, given that European borders increasingly face hybrid threats involving unauthorised crossings on both the Eastern and Southern flanks. The singularity of the Ceuta hybrid operation lies in how it was organised (mechanisms), the intentions behind the instrumentalisation of illegal entries (motivations) and the results pursued (outcomes). These elements provide the parameters for a comparative analysis with other hybrid actions that have targeted the EU and other players. In this sense, three cases are highlighted that underline similarities with the Ceuta crisis and the aims of Morocco-aligned actors: the instrumentalisation of illegal crossings by Belarus since 2021, the rekindling of Venezuela’s threats to annex Guyana’s territories in 2023 and Russia’s annexation of Crimea in 2014.

The Ceuta crisis and Spain-Morocco relations

Before drawing parallels with the three cases, it is worth clarifying the areas of tension between Spain and Morocco. The background of the bilateral ties can be understood by employing four major dimensions: 1) the administration of Western Sahara; 2) the status of Ceuta and Melilla; 3) the relations with Algeria; and 4) migration management. Across all these areas, the “balancing act” best characterises the Spanish approach, as shown by the recent policy and political decisions.

In relation to the Western Sahara, Spanish authorities endorsed the 2007 Moroccan autonomy proposal as the most realistic basis for resolving the dispute over the contested region. Thus, Spain effectively ceased political support for the UN-related decolonisation framework and the Polisario Front’s self-determination efforts. Since the US recognised Moroccan sovereignty over Western Sahara in December 2020, tensions over the region have become more complicated. Spain’s decision to medically treat Brahim Gali in April 2021 in Spain, the leader of the Polisario Front, which is fighting for the self-determination of Western Sahara, coincided with the first wave of mass illegal migration via Moroccan territory in 2021.

Regarding the status quo of Ceuta and Melilla, Madrid rejected Morocco’s proposal to co-administer the Spanish cities in North Africa. In the context of the Ceuta crisis, Moroccan Minister of Justice, Abdellatif Ouahbi, proposed establishing a “dialogue commission” to discuss the future of the two Spanish cities. Spain, instead, reasserted Spanish sovereignty over the cities.

As for Algeria, Spain is actively pursuing increased direct Algerian gas supplies, further bypassing Morocco, which, before 2021, served as a transit country for Algerian gas supplies to Spain and Portugal via the Maghreb-Europe Gas Pipeline under a 25-year gas contract (transporting 12 billion m³ of gas annually).

In terms of migration management, Spain relies heavily on the 2009 extradition agreement with Morocco, signed in 1992 and in force since 2012, under which illegal entrants who enter Spanish territory are subject to immediate return to Morocco. Spain is constantly targeting smuggler networks going through Moroccan territory towards Ceuta and Melilla – the Sub-Saharan route (land route) – and the Canary Islands – the Atlantic coastal route (by vessels). The mass arrival through the described routes was reported to Ceuta in 2021 (6,000 individuals) and to the Canary Islands in 2024 (47,000 individuals).

The 2026 Ceuta hybrid operation and the cases of Belarus, Guyana and Crimea

Mechanism: illegal crossing instrumentalisation

The most recent case of coordinated illegal migration was observed at the EU’s eastern borders. Since 2021, citizens from third countries, particularly from the Middle East and Afghanistan, have been smuggled into the EU (Poland, Lithuania and Latvia) via Belarusian territory, including underground tunnels. The co-participation of Russia in the transport of would-be unauthorised migrants was also reported. Belarus’s involvement is attributed to its retaliation against the EU for sanctions on representatives of the governing elites, following violent repression in the wake of the falsified Belarusian presidential vote that took place in 2020. In response to the well-documented orchestration of the border operation, the EU resorted to sanctions on hybrid actionsby Belarus. At the national level, Poland, Lithuania, and Latvia strengthened border oversight with Belarus by building metal fences in 2022, reinforced by a second line of barriers on the Polish side from 2026. The choice of Minsk to weaponise border crossings against Europe was likely designed to force the EU to resume cooperation on migration management, which would require recognition of the legitimacy of Lukashenko’s regime. This hybrid strategy, however, led to a securitisation of the bilateral borders, starting in 2021.

The scenario which asserts that Moroccan law enforcement partook in the orchestration of the Ceuta crisis echoes Belarus’ logic partly. However, unlike Belarus’ top-down, horizontal approach to instrumentalising illegal migration, the Moroccan case indicates a strongly decentralised character, under “total permissiveness”, making a clear-cut attribution more complicated. Whereas the Moroccan government rejected involvement, demanding the return of the Moroccan minors, Minsk accused the EU of having a pull effect on migrants.

Motivation: sovereignty contestations

While we do not have a definitive answer about the central actor in orchestrating the Ceuta crisis, the context of Moroccan territorial claims on Spain should inform our analysis, as these raise the stakes even further. Moreover, as mentioned above, many of the social media groups that coordinated the Ceuta breach deployed a nationalist and anti-colonial narrative about the Spanish territories.

Anti-colonial territorial revisionism links the Moroccan case to Venezuela’s claims against Guyana. Three years before the US captured President Nicolas Maduro in early 2026, Venezuelan authorities organised a so-called “annexation” referendum in which over 90% backed the territorial claims against neighbouring Guyana. More precisely, Caracas sought control over two-thirds of Guayana’s lands, whose maritime waters include oil fields discovered in 2015 by the American multinational oil company ExxonMobil.

Like the irredentist claims of some political actors in Morocco (see below) vis-à-vis Spanish Ceuta, Caracas argues that Guyana’s Essequibo territory was attached to it as a result of British colonial expansion in the 19^thcentury. In the post-2015 anti-colonial discourse, Venezuela added a neo-colonial argument against ExxonMobil’s ongoing offshore oil exploration in Guyana. The EU has firmly supported Guyana’s territorial integrity. Furthermore, it warned against using military force for annexation, endorsing the role of the Hague-based International Court of Justice in settling this territorial dispute. With the US capture of Maduro, threats of territorial annexation by Venezuela subsided considerably.

Outcome: the dangers of Moroccan grey zone opportunism

The use of illegal migration crossings, alongside territorial revisionism by Moroccan government figures, solidifies the concerns over the long-term security of Spain’s southern territories, including a potential scenario of a direct threat to Ceuta. Russia’s annexation of Crimea in 2014 bears certain similarities to the developments around Ceuta. Both Ceuta and Melilla are, like Crimea, precariously connected to their respective mainlands, creating a form of structural weakness between Spain and Morocco, the way it existed between Russia and Ukraine. The political crisis in Kyiv distracted attention from the situation around Crimea, which Russia exploited to deploy its special military forces without insignia (known as “the little green men”) – a hybrid operation – to occupy the Ukrainian territory. The EU sanctions and non-recognition diplomacy in response did not stop Russia from incorporating the Ukrainian territory and from building a 19 km-long bridge to create a direct link to mainland Russia. Later, annexed Crimea served as one of the military fronts during Russia’s full-scale invasion in 2022.

When examining the annexation of Ceuta (and Melilla), rather than the “little green men” in Crimea, the driving factor would be the mass irregular crossing into Spanish cities in North Africa. If the number of unauthorised crossings is twice as high as what was witnessed on 30-31 July 2026, when about 80,000 individuals, the majority of whom were of Moroccan origin, crossed, then the Spanish security forces could become easily overwhelmed. If exposed to irredentism by nationalist forces in Morocco or geopolitical actors, such as Russia, through easily accessible social media channels, these dynamics can become a security issue. In this sense, it is worth noting that the claims of “liberation” of Ceuta, Melilla and the islands, actively promoted on Moroccan social media in early September 2026, somewhat resemble Russian propaganda preceding the 2014 Crimea annexation. It is also fair to reckon that any attempts to implement an annexation scenario against NATO and EU member states, such as Spain, by using a form of illegal migration instrumentalisation, will face a tough response ranging from sanctions to even tougher measures.

Table 1. A comparative framework for hybrid operations targeting Europe

Mechanism	Motivation	Outcome
Illegal migration instrumentalisation	Sovereignty contestation	Annexation scenarios
Compared cases:
2021: Belarus illegal migrant smuggling	2023: Venezuela’s revisionism regarding Guyana	2014: Russia’s annexation of Crimea
The EU’s and Member States’ response:
– Sanctions on Belarusian authorities – Construction of metal fences by Poland, Lithuania and Latvia, using mixed EU and Member States’ funds	– Endorsing the ICJ’s role in settling the territorial dispute – Demonstrating political solidarity with Guyana	– Post-annexation sanctions – Non-recognition diplomacy

Source: authors.

Hypotheses about the origin of the Ceuta crisis

Analysts have pointed out that the material causes of the Ceuta crisis include economic inequality and economic underperformance in Morocco, the lack of regular migration paths to the EU, climate change and Morocco’s long-standing irredentist claims over Ceuta and Melilla, including open territorial revisionist statements. However, none of these factors accounts for the final cause of the crisis, providing an immediate explanation for why the crisis happened when it did and the way it did. As of October 2026, four hypotheses have been circulating, each one describing a different origin of the Ceuta crisis. We examine the following hypotheses: the perfect storm, a Moroccan fingerprint, external meddling and an internal power struggle.

Hypothesis 1: the perfect storm

Different versions of the hypothesis of a partly spontaneous event have been endorsed by Morocco, European Commissioner Brunner and Prime Minister Sanchez’s public hearing on 3 September 2026. This version casts the events as the result of coordinated disinformation and smuggling networks seeking profit. In this case, the Ceuta crisis was the result of a campaign to distort Spanish migration policy to suggest that the land border with Morocco had become open. In turn, the celebration of Throne Day in Morocco meant security services were busy protecting the celebrations in nearby Tetouan, the seat of the monarchy. So, a “perfect storm” brewed, catching all authorities by surprise. Adding to the case has been Morocco’s unprecedented acceptance of those returning through immediate pushbacks (devoluciones en caliente) into its territory, as well as fining seven taxi drivers for transporting people to the border.

Challenges to the “perfect storm” hypothesis have highlighted the nationalist narratives promoted by the social media networks associated with Morocco against Spain’s sovereignty over Ceuta and Melilla, casting these two cities as “occupied territory”. These narratives have also been endorsed by top Moroccan officials since the Ceuta crisis, prompting an initially unreported 21 August 2026 summoning of the Moroccan ambassador by Madrid. Moreover, a recently leaked Spanish migration police (CENIF in Spanish) report states that existing smuggling networks do not have the capacity to produce a surge in border crossings of the magnitude registered in late July 2026. Not even the 2021 Ceuta crisis reached figures as high as those seen in 2026 (10,000 in 2021 vs. 80,000 in 2026). Finally, analysts have suggested that the Moroccan government had the capacity to do more, not only to prevent, but also to respond as the crisis unfolded. Testimonies from those who crossed the border in Ceuta have been quoted as saying that representatives of Moroccan law enforcement ‘opened the border’.

Hypothesis 2: a Moroccan fingerprint

The hypothesis of Moroccan government authorship of the crisis, either by design or wilful neglect, has been endorsed (as of writing) by parts of the Spanish ruling coalition, the Spanish opposition, the official press in Algeria and the conclusions of the Spanish migration police report. The argument suggests that Rabat orchestrated the Ceuta crisis by either actively supporting or allowing social media manipulation to go on unimpeded, combined with the opportunity to relax border surveillance during the national celebrations. Indeed, a leaked 28 July 2026 Spanish intelligence report suggested that the 30 July 2026 date was chosen by Rabat to ‘temporarily relax border controls’, and to put pressure on Madrid to ‘reaffirm the perception of dependence of Spain and the EU on Moroccan border control’. Furthermore, this hypothesis also considers the dimension of “poverty weaponisation”. As part of the most socially vulnerable groups, young Moroccans seeking better living standards in Spain and Europe were easily swayed by the calls for a facilitated crossing into Ceuta. Analysts weighing this version have pointed to several potential reasons: punishment for the Madrid-Algiers rapprochement, Spain’s changing Western Sahara policy and irredentism. Likewise, Ignacio Cembrero attributes the crisis to a desire for the Moroccan services to seek retribution for the unveiling of the Moroccan surveillance campaign in Europe (the Pegasus scandal).

The evidence mobilised relies on the assumption that the Moroccan government could not have been unaware of the approximately 80,000 individuals travelling to Ceuta. Indeed, the Moroccan security services have deep surveillance capabilities, both online and through their large human intelligence network inside the country. Notably, the Moroccan border police is a division of the intelligence service (the Direction Générale de la Sûreté Nationale, DGSN). The Spanish migration police report also points to the crowds of people entering Ceuta being ‘actively guided’ by Moroccan security forces, the videos of which have been circulating on social media since 30 July 2026.

This interpretation has been criticised for its lack of specific proof, showing definitive, smoking-gun evidence that the Moroccan government indeed masterminded the operation, with some suggesting it is a ‘conspiracy theory’ or ‘manipulation’. Other analysts suggest that the precedent of the 2021 Ceuta crisis has led observers to have a distorted view of migration management in the region, which created a disposition to interpret incidents there as political signals. Moreover, many commentators have stressed the fact that Rabat’s closest economic and cooperation partners are the EU and Spain, so seeking a conflict with them would risk the country’s reputation and economic growth. This hypothesis assumes the Ceuta crisis resulted from “an indirect hybrid operation” with Moroccan involvement, featuring, unlike the Belarusian model, a decentralised operational dimension.

Hypothesis 3: external meddling

This version suggests that the crisis was indeed the result of a plan in which the Moroccan government would have a secondary role, if at all. Here, Russia, Israel and even the US have been mentioned, including by Prime Minister Sanchez, as instigators, or at least as amplifiers of the disinformation campaigns that propelled the 30 July 2026 crisis. Similarly, a version suggests that Moroccan “Islamist actors” could have masterminded the operation to ‘overhaul Morocco’s government’. As of writing, the Spanish government has hinted at the relevance of external meddling, though in his 3 September 2026 speech Prime Minister Sanchez did not repeat the mention of Israel and Russia as potential players.

In some of these cases, however, evidence has been slim. Notably, on 6 August 2026, European Commission spokesperson Guillaume Mercier stated that European External Action Service monitoring of disinformation did not find evidence of a Russian disinformation campaign about Ceuta taking place before 30 July 2026. Likewise, an investigation by newspaper El País found one pro-Israel Foreign Information Manipulation and Interference network acting on Ceuta from 30 July 2026, but not before. Moreover, amplification does not necessarily imply authorship, as these external actors could be opportunistic, targeting Spain or Prime Minister Sanchez himself.

Hypothesis 4: power struggle

As many analysts have remarked, any version of the Ceuta crisis that misses the internal Moroccan dimension would be overly reductive. In this case, the hypothesis of domestic conflict overlaps with the Moroccan authorship version but shifts the main actor from the top leadership to lower rungs, acting independently. So, sources quoted by The Objective pointed to Fouad Ali El Himma, sometimes called Morocco’s “viceroy”, as the mastermind. In this version, El Himma would have sought to destabilise the Moroccan government led by his political rival Aziz Akhannouch by producing a major diplomatic crisis with Spain. While Moroccan palace politics are opaque, the 23 September 2026 parliamentary elections were seen as a key moment where these rivalries came to the fore.

As of October 2026, we cannot definitively conclude, with full certainty, in favour of any of these hypotheses. However, in our assessment, the version of an intentional operation by Moroccan actors, either by design or laissez-faire, must be pursued seriously. First, out of the hypotheses analysed here, only one (the “perfect storm”) suggests that there was no real actor behind the crisis, other than amorphous smuggler networks. Second, the fact that the exact motive and actor are yet to be precisely determined does not make the hypothesis of a “perfect storm” more likely. Indeed, plausible deniability is a feature of some hybrid operations. Third, the magnitude of the event, much larger than the 2021 crisis, points to coordination going well beyond that documented on social media. Fourth, the fact that top-level Moroccan officials have continued to make irredentist claims after the crisis is a signal of defiance, not solidarity, towards Spain. When weighing explanations and evidence, we find the balance leaning towards the Ceuta 2026 crisis being a hybrid attack.

Table 2. Summary of potential explanations for the 2026 Ceuta crisis

Hypothesis	Actor	Presumed objective
Perfect storm	No ultimate instigator	Profit for smuggler networks
Moroccan agency	State or state-linked actor	Pressure on Spain
External meddling	A third country	Pressure on Spain
Power struggle	Moroccan politician(s)	Advanced position in Moroccan politics

Source: authors.

Conclusions

Taken all together, it would be prudent to consider the 2026 Ceuta crisis as a hybrid attack. Despite the assertion that Moroccan police (Gendarmes Royale) and the DGSN intelligence services were involved in operating the instrumentalisation of unauthorised crossings, neither the Spanish central authorities nor the EU attributed the Ceuta crisis to the Moroccan state. Unlike the Belarusian case, the orchestrated breach of the border in Ceuta stems from a decentralised use of dissatisfied Moroccan youth, manipulated and coordinated through various social media channels. The widespread poverty among young Moroccans facilitated their mobilisation and involvement in irregular entry into Spanish territory.

The humanitarian cost, the security risks and the complex geopolitical forces entangled in the crisis make this a high-stakes affair. After more than a month of internal debates, Spanish policy appears to lean in this direction. While not putting the blame on the country, Prime Minister Sanchez mentioned on 3 September 2026 that Spain’s cooperation policy with Morocco ‘will have to change’ as a response to the crisis. Tellingly, opinion polls found large majorities of Spaniards affirming that Moroccan authorities are responsible for the crisis, either by planning or wilful neglect, an opinion fuelled by the right- and far-right-leaning Spanish opposition. With mounting evidence suggesting a coordinated operation, Spanish prosecutors launched on 4 September 2026 an investigation to find those responsible for the crisis.

The Ceuta case raises serious questions for the EU as a whole about how best to protect the southern European borders against actions resembling hybrid warfare. Due to its proximity to the Strait of Gibraltar, a critical chokepoint for Europe’s security and the supply of trade, energy and more, Ceuta’s vulnerability to the instrumentalisation of migration requires the EU to apply lessons learned from countering similar hybrid operations faced on the eastern flank.

__________