Abstract
The July 2026 Ceuta crisis exposed two weaknesses in Spain’s response to gray-zone pressure: an early tactical reaction was followed by a much slower activation of the formal national-security coordinated mechanism, while public attribution remained focused on whether Morocco had engineered the original mobilization. The available evidence does not establish Moroccan authorship, but there is considerably stronger evidence of Moroccan foreknowledge, the breakdown in Moroccan border enforcement, possible facilitation during the main crossing period, and later political exploitation. This case suggests that governments should separate attribution by phase and consider how dependence on an indispensable partner can narrow their freedom of action.
Introduction
Gray-zone crises, or coercive actions designed to remain below the threshold of open armed conflict, rarely present governments with a clean attribution problem. The Ceuta crisis of July 30-31, 2026 is a useful example because Spain faced two problems at once: it had to manage an immediate border emergency while trying to determine what role, if any, Morocco had played in producing it.
The complication for Madrid was that Morocco was also indispensable to ending the crisis. Spain could reinforce its side of the border, deploy forces, and process those who had entered. It could not control the roads and gathering points on Moroccan territory, and large-scale returns depended on Rabat, Morocco’s capital and seat of government, cooperation. Two issues matter beyond Ceuta itself: how quickly a government moves from operational reaction to an integrated political response, and how it handles attribution when the actor under scrutiny is also a partner it still needs.
A Tactical Response, a Strategic Delay
Spain began reacting on July 30, 2026, but the initial response was tactical rather than strategic. Police and Civil Guard units were reinforced, the armed forces were mobilized, and Madrid expanded maritime and aerial surveillance. Within 72 hours, around 63,000 of the roughly 70,000 people who had crossed had returned to Morocco.
The returns eased the immediate pressure at the border, but they did not end the crisis. As the border stabilized, attention shifted toward reception, humanitarian assistance, public services, health, and the broader economic impact on Ceuta – precisely the areas the government later cited when it activated the national-security mechanism. Official messaging in mid-August continued to frame the situation primarily in humanitarian and migratory terms, even as Ceuta’s authorities were pressing for a national emergency and unified command. The initial response was therefore largely bottom-up in implementation and sectoral in organization, relying on the authorities and services already dealing with the emergency. Those measures addressed the immediate border crisis, but they had not yet been brought together within an integrated political response to the wider situation developing in the city.
Ceuta was already asking for more centralized coordination. On July 30, the city’s president, Juan Jesús Vivas, called for a national emergency and a unified command. Madrid nevertheless continued to manage the crisis mainly through existing departmental structures. Police handled the border, the military provided surveillance and support, and other ministries dealt with migration, humanitarian assistance, foreign relations, and public services through their own chains.
On August 25, Madrid declared Ceuta a “Situation of National Security Interest”, appointed a functional authority, and activated a common coordination framework. The decree acknowledged that the crisis had exceeded Ceuta’s ordinary capacities and required coordinated national and local resources.
The government later defended the timing of this formal mechanism. Spanish Prime Minister Pedro Sánchez argued that it became necessary only once the crisis moved beyond border security and migration management into health, economic, and broader intergovernmental issues. That explanation addresses the timing of the legal mechanism, but not necessarily the wider criticism that the overall response had been too slow. Vivas had called for a unified command on July 30, while Defense Minister Margarita Robles later acknowledged that the state had “arrived late” and apologized to Ceuta residents who felt abandoned.
Ceuta does not reproduce Jerae Perez’s recognition-authorization gap exactly. Police, military, and border authorities did not wait for permission to act; they were already responding. The comparison is useful for a different reason. In both cases, delay above the tactical level can leave the government reacting to events rather than shaping them. In Ceuta, the lag was not between recognition and permission to act, but between sectoral action and political integration.
Nor is the problem simply that tactical action came before strategy; that sequence is normal in a fast-moving emergency. What is striking is the length of the gap. Almost four weeks passed before the crisis was brought under a common national-security framework.
Attribution Is Not a Single Question
Attribution presented a different problem. Madrid consistently resisted claims that Rabat had planned the mass mobilization, and the public evidence does not establish that Moroccan authorities generated, financed, or directed the original movement. Sánchez stated on September 3 that no Spanish or international institution had provided the government with solid evidence that Morocco planned or carried out the mass influx.
Other parts of the sequence are better documented. On September 9, the Spanish government published forty police, military, and intelligence reports covering the weeks before and during the crisis. They show that Spain’s National Intelligence Center (CNI) warned Morocco’s domestic and foreign intelligence services on July 29 about coordinated land and maritime attempts expected the next day. Reuters also reported that warning indicators had been accumulating before the mass crossing.
Foreknowledge is not authorship, and it does not prove deliberate facilitation. It does, however, make simple surprise a less satisfactory explanation for what followed.
Pedro Sánchez later described Moroccan border enforcement in three phases. Border enforcement functioned normally before July 30; for roughly 10 hours that day, in his account, “the Moroccan Gendarmerie allowed people to cross the border”; and effective control was restored afterward. He left open whether the breakdown reflected incapacity or deliberate inaction. The quick restoration of control does not prove intent, but it does show that Morocco retained substantial gatekeeping capacity.
There is also evidence pointing beyond simple failure. Spanish military and intelligence reporting described prolonged passivity, while other material referred to possible guidance toward crossing points. A preliminary order by Spain’s National Court referred to a “clear and indisputable” facilitative process from Moroccan territory and alleged “active guidance” by Moroccan personnel. That is an investigative assessment, not a final judicial finding. It does not identify who authorized the conduct, still less prove that Morocco created the original mobilization.
The evidence carries different levels of confidence at different stages. Mobilization authorship remains unresolved. Moroccan institutional foreknowledge is established. The case for facilitation during the access phase is materially stronger than the case for original direction, although the level at which any such conduct may have been authorized remains unknown. Later political exploitation is a separate question again.
A NATO Strategic Communications Centre of Excellence framework highlighted by SWJ makes a useful methodological point: attribution should use practical evidentiary thresholds and confidence levels rather than force a complicated episode into a single yes-or-no judgment. It was developed for information influence operations, but the underlying point applies here as well. Different claims about the same episode can rest on evidence of very different quality.
A related problem appears in attribution itself. Uncertainty can spread from one stage of a crisis to another. If a government cannot establish who initiated an event, it may become reluctant to assign responsibility for later conduct even when the evidence is stronger. Caution is not the problem. Allowing uncertainty over the origin of a crisis to color every subsequent judgment is.
The Gatekeeper Problem
Madrid’s caution also had a practical basis. Morocco was not only the state whose conduct Spain was assessing; it was the state Spain needed to prevent renewed crossings and enable large-scale returns.
Spain has greater aggregate resources, but those resources cannot reproduce what Moroccan authorities can do immediately outside Ceuta. Madrid can reinforce the perimeter, deploy forces and surveillance, and absorb some of the costs of a mass crossing. It cannot establish roadblocks around the Moroccan border town of Fnideq, disperse gatherings inside Morocco, restrict transport toward the frontier, or intercept people before they reach Spanish jurisdiction. Once people have crossed, large-scale readmission also depends heavily on Rabat. Sánchez acknowledged that the rapid returns would have been legally and logistically impossible without close Moroccan coordination.
Gatekeeper leverage is control over a function the other side cannot replace quickly once a crisis is underway.
Spanish policy has long tried to soften that vulnerability through the “cushion of interests”: deeper economic, political, and security ties intended to make confrontation more costly for both sides. The logic is reasonable. Geography makes sustained cooperation unavoidable.
Mutual costs, however, do not necessarily produce equal restraint. If one side is more willing to tolerate short-term disruption over an issue it regards as especially important, interdependence can still produce asymmetric leverage. During a crisis, the relevant question is often less about who would lose more from a total rupture than about who controls the function that matters immediately and how much risk each government is prepared to accept.
The 2021 precedent sharpened this problem. During the dispute over Spain’s admission of Polisario Front leader Brahim Ghali, Moroccan border controls were relaxed and thousands entered Ceuta. The European Parliament later rejected Morocco’s use of border control and migration as political pressure against Spain. Spain adopted a new position on Western Sahara the following year, describing Morocco’s autonomy proposal as “the most serious, credible and realistic” basis for resolving the dispute.
That sequence does not prove that the pressure of 2021 caused Spain’s policy shift in 2022, but the possibility cannot be excluded. The crisis had already shown how costly disruption of Moroccan cooperation could be for Spain. By 2026, both governments knew it.
Against that background, the Spanish government’s language during the 2022 reset is revealing. During his April visit to Rabat, Sánchez described bilateral interdependence as an “incontestable reality” and said deeper cooperation was necessary because “the opposite is not an option”. That phrasing captured the logic of the reset and the value Madrid attached to preventing another breakdown.
Ciprian Clipa argues in SWJ that capability, authority, and integration all have to align before military capability produces strategic effect. Ceuta adds a political constraint: willingness to bear the costs of using available authority. Spain had substantial capabilities, legal authority, and increasingly detailed information. None of that removed the potential cost of measures that might jeopardize cooperation with the actor still controlling the ability to prevent crossings on the Moroccan side and accept large-scale returns.
The Politics of Not Naming
This background helps explain Madrid’s restraint, but it does not fully explain how the government described Moroccan conduct.
On July 31, Sánchez thanked Morocco for its cooperation while saying Spain had demanded a much stronger response. A few days later, Foreign Minister José Manuel Albares insisted that Morocco had collaborated “from the first moment” to contain the flow and organize returns. The documents released later complicate that description. They do not prove a Moroccan-directed operation, but advance warning, reports of passivity, and the abrupt variation in enforcement are difficult to reconcile with uninterrupted cooperation.
Madrid appeared to demand a high evidentiary threshold before making an adverse attribution against Morocco while speaking more confidently about Morocco’s reliability as a partner.
There was an operational logic to that asymmetry. Publicly accusing Rabat of deliberate facilitation while Spain still depended on Moroccan prevention and readmission might have endangered the cooperation needed to end the immediate crisis. Morocco’s Foreign Ministry later made the sensitivity explicit when it rejected attempts to make the kingdom a “scapegoat” and emphasized the value of the post-2022 relationship.
The longer-term question is what such restraint may signal to the other side. After the migration route had largely closed, Moroccan Justice Minister Abdellatif Ouahbi returned publicly to the sovereignty issue, describing Ceuta and Melilla as a Moroccan “historical and geographical right” and calling for dialogue on their eventual return. Those statements do not prove that Morocco engineered the July mobilization. They do show why later political exploitation has to be separated from authorship. A state does not need to create a crisis to exploit the opportunity it presents.
When Restraint Becomes Vulnerability
A recent SWJ discussion of David Maxwell’s argument against the gray-zone label warns that describing observable coercion as inherently ambiguous can itself generate hesitation. Ceuta illustrates the problem. There is genuine uncertainty over mobilization authorship. That does not make everything else unknowable.
A useful rule is to attribute by phase and respond by phase. The standard required to accuse Morocco of planning the entire mobilization should be high, and the current public evidence does not clear it. Prior warning, facilitation during the access window, and later political exploitation are different propositions. Treating them separately is not an argument for escalation. It simply keeps uncertainty in one part of a crisis from paralyzing policy elsewhere.
The same applies to restraint. Spain had good reasons to preserve cooperation while tens of thousands of people remained in Ceuta. The concern arises when a temporary calculation becomes predictable.
Jeffrey Michaels uses self-deterrence to examine how policymakers’ own fears and expectations can restrict their choices even without an explicit adversary threat. Ceuta does not prove that Spain has reached that point, and the public evidence is not enough to characterize Spanish policy as appeasement. Nevertheless, the possibility is worth considering.
Conclusion
Spain reacted tactically on July 30 but did not activate its formal national-security coordination mechanism until August 25. It remained cautious about adverse attribution even as the evidentiary picture became more differentiated. Some of that caution was reasonable and, during the immediate crisis, operationally necessary.
The wider lesson is not that Spain should attribute what it cannot prove. It is that uncertainty over who initiated a crisis should not obscure responsibility for conduct that can be established later in the sequence. A partner does not need to be stronger if it controls a function the other side cannot easily replace. Restraint preserves freedom of action when it prevents unnecessary escalation; it becomes a vulnerability when preserving the relationship begins to define the limits of that freedom.
