Abstract
The July 2026 mass crossing into Ceuta exposed a security vulnerability that cannot be understood through migration pressure or counterterrorism capability alone. Approximately 80,000 people entered the Spanish autonomous city over two days after Moroccan upstream border enforcement deteriorated, overwhelming the capacity to encounter, identify and differentiate entrants under normal processing conditions. Yet Spain's counterterrorism intelligence, databases, legal powers and bilateral cooperation with Morocco remained intact. The crisis therefore illustrates how a security capability can lose part of its preventive effect when the operating conditions on which it depends are disrupted.
Drawing on newly declassified Spanish intelligence and security documents and the subsequent operational response, this report examines the consequences across border management, human security and counterterrorism. Previously identified terrorism-related subjects, including individuals expelled from Spain and prohibited from returning, re-entered during the crossing and were located retrospectively, shifting part of the security task from prevention to recovery.
The report argues that externalised border cooperation creates strategically significant dependence when an external contribution is critical, cannot be substituted at equivalent speed and scale, can deteriorate faster than alternative capacity can be activated, and generates downstream demand faster than receiving systems can expand. Comparisons with Turkey and Poland further demonstrate the importance of substitutability, flow geometry and controlled encounter points. Ceuta consequently highlights a central problem of European external-border resilience: not whether national and EU capabilities can eventually restore control, but how much legal, humanitarian and security exposure accumulates during the substitution gap before they do.
Author: Juncal Fernández-Garayzábal, PhD