In academic terms, a black swan denotes an event that is both unexpected and highly consequential. By contrast, a grey rhino refers to a foreseeable, significant, and potentially damaging threat that develops gradually, remains visible, and is nevertheless insufficiently addressed.
The episode experienced by Ceuta in 2021 followed a pattern closely resembling that which emerged in July 2026 (see here). Similar dynamics were observed on the Moroccan side of the border: a disinformation campaign, the circulation of unusual news linked to a football match in the Spanish city involving prominent players such as Cristiano Ronaldo, a prior increase in migrant arrivals by sea, and intensified online activity encouraging migrants to move towards Ceuta.
In 2021, the episode could plausibly have been interpreted as a black swan, given that the most comparable precedent was the Green March of 1975. Five years later, however, the recurrence of an almost identical pattern, unfolding in plain sight, indicates that the 2026 crisis in Ceuta should instead be understood as a grey rhino.
The role of the intelligence services is key in the detection of the movement of migrants at the other side of the border. Both times —2021 and 2026— information was missing, the available information was wrongly analysed, it didn’t reach out the right authorities, the authorities reacted slowly, showed poor determination and weak decisions were made.
The Spanish minister of Defence appeared before the Defence Commission of the Congress on 25 August 2026. She did not confirm, nor dismissed, if the CNI or CIFAS sent notes to authorities. She conveyed two messages which do not help much to the Spanish intelligence community:
- The President of the autonomous city and the Delegate of the government in Ceuta held a meeting on 27 July 2026 where the main topic was the increase of migrants by sea which had happened continuously during the previous week[1]. No information about what was being cooked in Morocco was conveyed. The minister said that the CNI had behaved as it could be expected, stating that no more could be asked for.
- The minister stated that the movement was evident in the web and that there was no surprise to admit[2] that was going on was known.
Meetings involving local CNI representatives are shaped by the institutional standing and political capacity of their interlocutors, which in this case appear to have been relatively limited. In any event, no warning was issued regarding the importance of the large-scale movement that was being prepared in Morocco.
The minister of Defence mentioned that the CNI has many ways to convey messages to the authorities which are not required to be in the written form.
The minister of Home Affairs and the Delegate of the government in Ceuta deny any report or warning that anticipated something like what happened on 30 July 2026. This insistence is quite telling. If they were lying, they could jeopardize their respective political lives.
The minister of Defence was also clumsy to admit that the invasion was not unexpected due to the numerous messages in the web inciting migrants to go to the border of the Spanish city. Therefore, she was admitting inadvertedly that the government did not react consciously.
The minister just defended the intelligence community under her patronage by stating the professionalism and dedication of the men and women in those institutions.
In any case, both warring parties are being very careful with the language they use to express the existence of reports or the way they deny the existence of reporting about the magnitude of the avalanche and the date.
Following this hearing, it may be argued that the notes or warnings issued by the CNI or CIFAS failed to provide an adequate assessment of the situation developing in Morocco. It is highly likely that the CNI produced at least one note concerning the celebration of Morocco’s Throne Day on 30 July 2026. Such reporting is routine, given that this date usually generates developments of analytical interest. The celebration often reveals nuances in international politics, including attendance patterns and invitations, as well as aspects of domestic politics, where an informed observer may discern which advisers and government figures are gaining influence before the King and which are falling out of favour.
It was very clear that in the web (social networks) there was a campaign inciting migrants and Moroccan youngsters to move towards Ceuta. It was also noted the increase of migrants arriving in the city by sea that might collapse social services in Ceuta (that’s the reason why the meeting among local authorities took place on 27 July 2026).
Those inputs were clearly identified by the CNI as well as some typical movements in Fnideq (the closest Moroccan town to Ceuta) before migrants’ avalanches usually take place. Those signs were detected but not properly assessed. They were allegedly downplayed by analysts.
This interpretation further suggests that the CNI failed to draw meaningful lessons from the events that occurred in Ceuta in 2021. A broadly similar sequence of developments unfolded in plain sight, yet its scale and significance were not adequately identified or assessed by the intelligence services.
Considering the arrival of migrants by sea in previous days, it is also revealing that those arrivals did not raise any awareness in law enforcement agencies in Ceuta.
Neither law enforcement agencies nor the intelligence services can plausibly deny the failure incurred in this case. The prior information available to them was insufficient, incomplete, and incorrectly interpreted.
Moreover, the principal failure lies in the national security system’s inaction following the 2021 events in Ceuta. It appears that no lessons were drawn from those events or, at the very least, that any lessons identified were not translated into concrete contingency plans.
The department of national security should have implemented a plan to counter this type of actions in the border that cannot be taken as a black swan anymore (after the 2021 events). They had five years to elaborate such a plan.
King Mohammed VI is eager with the result. Morocco has been able to sow discord in the Spanish society, between ministers (Home affairs and Defence) and dig in the cleavage between the Royal Household and the government. What else? It might end up with a government crisis, forcing the President to change one of the ministers if society and public opinion demand a scapegoat. In this case both ministers have been part of the cabinet since the appointment of Sánchez as President. Who will remain if the situation forces Sánchez to choose?
This can be stated after the discourse pronounced by the Moroccan minister of Religious Affairs on 25 August 2026, demanding the sovereignty of both Spanish cities before the King of Morocco and the Crown Prince.
It means that it is irrelevant whatever the Spanish government does (related to Morocco). Spanish available concessions are running out. Spain has already admitted the Moroccan sovereignty over the Sahara. There are other pending topics which might play a role in the coming years. One of them would be related to the exploitation of the oilfields located between the Canary Islands and the Moroccan coast.
Another issue would be Ceuta and Melilla. It’s obvious Morocco will neither lower its expectations nor surrender its claims. But that’s it. Internationally the attention is focused on the public exposure of the rift between ministers of the cabinet that weakens the government. The fact that the mobilization was openly orchestrated on social media and ultimately bypassed border response and containment capabilities demonstrates a concerning lack of adaptation in European early warning mechanisms to new forms of asymmetric pressure.
[1] The minister, when asked later about this issue, introduced the connection of the delegate of the government with the CNI local representatives, but without stating their presence in that meeting.
[2] (00:30:05 → 00:30:11). The minister states verbatim: “…the networks were clearly moving. And so, the swimmers who managed to reach Ceuta…”, continuing her explanation of how they disseminated and made the information go viral on social media until minute 30:33 (00:30:13 → 00:30:33).
Transcription
Pax Consulting 
Leave a comment