A Day of Warnings Before the Storm
On July 29, 2026, hours before more than 70,000 migrants crossed into Spain’s North African enclave of Ceuta, Spain’s National Intelligence Centre (CNI) was already sounding the alarm. Newly declassified government documents show that the intelligence agency sent explicit written warnings to Moroccan authorities, the Spanish Government Delegation in Ceuta, and the Civil Guard all pointing to the same threat: a coordinated, large-scale attempt to breach the border “by fence and sea.”
This blog post breaks down what the CNI knew, who it told, when it told them, and how the crisis unfolded regardless.
What the CNI Actually Said
According to the documents released by the government, the most concrete alert came at 1:52 p.m. on July 29. In a message sent to the Cabinet of the Government Delegation in Ceuta, the CNI wrote plainly: there was a call circulating on social media for an assault by fence and sea, planned for the following day at 8 p.m.
The agency explained that organizers intended to exploit Morocco’s Throne Day celebrations a national holiday during which Moroccan security forces would be heavily occupied with official events, leaving the border comparatively under-resourced.
Separately, the CNI reached out to the Civil Guard’s UCE-3 unit with an even more urgent framing, warning that there was information pointing to an attempt to enter “by swimming and jumping the fence” the very next day.
The Numbers Behind the Alert
The CNI’s warnings weren’t based on vague rumor. The agency had identified specific, highly active social media groups on platforms including WhatsApp and Facebook. One prominent group was named “Assault on the Ceuta Fence,” while others such as “Ceuta Fnideq” and “Hraga Ceuta” had accumulated hundreds of thousands of members between them, totaling roughly 180,000 followers across the two most significant groups.
It’s worth noting, however, that fact-checkers who reviewed the same declassified documents have pushed back on how that figure was later used in public debate. The CNI itself clarified in its messaging that the 180,000 figure represented the reach of the online calls the number of people potentially exposed to the messaging not an estimate of how many people were actually preparing to cross. This distinction became a flashpoint after some commentators cited the number as if it were a headcount of intended border-crossers.
Three Scenarios, One Rated “Extreme”
Spain’s National Centre for Infrastructure Protection and Security (CNPIC) reportedly modeled three possible scenarios for how the border breach might unfold, each assigned a different probability:
- Entry by swimming alone rated as the highest probability scenario.
- Entry by swimming combined with fence-jumping rated as medium probability.
- A fully coordinated assault by both sea and fence simultaneously rated medium-low in probability, but flagged as carrying “extreme” risk if it materialized.
The report acknowledged genuine uncertainty about whether the online calls would translate into real action, but noted a pattern: this type of social media mobilization had, on past occasions, foreshadowed real crossing attempts.
Warning Morocco Directly
The CNI’s outreach wasn’t confined to Spanish institutions. At 6:26 p.m. on July 29, the agency sent an “early warning” notice directly to Morocco’s intelligence services the DGST and the DGED. The note stated that Spanish intelligence had, in recent days, gathered knowledge of planning for coordinated entries into Ceuta, both by swimming and via the fence, timed to coincide with the Throne Day festivities.
The message to Moroccan counterparts included the same details about the “Assault on the Ceuta Fence” WhatsApp group and its highly active administrator, underlining that this wasn’t a last-minute tip but a warning built on days of monitoring.
What Happened Next
Despite the warnings reaching multiple layers of Spanish and Moroccan security apparatus, the crisis unfolded largely as the CNI had feared. Beginning around July 30, tens of thousands of migrants crossed into Ceuta over a short span, triggering what officials have since called an unprecedented migration emergency for the enclave with defense ministry documents from that period describing the situation on the Moroccan coast as “migratory chaos.”
The scale of the event has since become intensely politicized in Spain. Public opinion polling conducted in the aftermath showed sharp shifts, with parties on the right gaining ground and pointed criticism directed at Prime Minister Pedro Sánchez’s government over whether the early warnings were acted upon with sufficient urgency.
Separating Fact from Political Noise
Notably, some of the same declassified documents that confirmed the CNI’s warnings were also used to debunk exaggerated claims that had circulated online in the crisis’s aftermath. Fact-checking outlets reviewing the full communication logs concluded that while the CNI had clearly flagged the dissemination of assault calls and the possibility of a breach, it had not, at that point, issued a definitive warning of a “massive entry” on the scale that ultimately occurred a distinction some commentators reportedly blurred when assigning blame after the fact.
The Bigger Picture
This episode raises a familiar and difficult question for border security and intelligence agencies everywhere: what should authorities do when they detect credible but uncertain online mobilization? The CNI did flag the threat repeatedly, and to the right institutions days and hours in advance. Yet the eventual scale of the crossing appears to have outpaced even the “extreme risk” scenario intelligence analysts had modeled.
As the political fallout continues in Madrid and Rabat, the declassified paper trail offers a rare, granular look at how early-warning intelligence moves or sometimes doesn’t move fast enough between agencies, delegations, and international partners in a fast-developing border crisis.