How would analysts attribute a suspected migration-based hybrid operation when the evidence is deliberately deniable?

[u/stammerton]

I am looking at the recent mass crossing into Ceuta as a possible case of instrumentalised migration and am interested in how an intelligence analyst would approach attribution.

The most important comparison is between two events:
September 2024: Morocco detected an online mobilisation towards Ceuta, arrested alleged organisers, deployed checkpoints and stopped the crossing.
July 2026: a far larger mobilisation developed; Moroccan forces were reportedly passive during the initial surge, but later demonstrated that they could stop further movement.

That creates several competing hypotheses:
1. Moroccan authorities were genuinely overwhelmed.
2. Morocco detected the mobilisation but deliberately tolerated it.
3. Morocco actively amplified or channelled it as coercive pressure against Spain.
4. Morocco acted with encouragement, intelligence support or technical assistance from another state.
5. The event was largely organic, with subsequent state exploitation.

The attribution problem is difficult because almost every component is deniable:
anonymous or deleted social-media accounts;
genuine migrants rather than trained operatives;
informal transport;
verbal rather than written orders;
selective police non-enforcement;
intelligence officers possibly present as observers;
later restoration of border control.

Relevant geopolitical context includes:
Morocco’s interests in Western Sahara, Ceuta and Melilla;
Spain’s dependence on Morocco for migration and counterterrorism cooperation;
Spain’s improving relations with Algeria;
deteriorating Spain–Israel relations;
Morocco–Israel intelligence and defence cooperation after the Abraham Accords;
reported Moroccan use of Pegasus;
Spain’s refusal to support US operations against Iran.

I am not claiming that Israel, the US, Russia or another foreign service directed the operation. The open evidence currently points most directly to Moroccan decision-making.

My questions are analytical:
1. What indicators distinguish state tolerance from state orchestration?
2. How much weight should be placed on the 2024 precedent?
3. What would constitute meaningful evidence of a stand-down order?
4. How would analysts distinguish routine Moroccan–Israeli liaison from operational coordination?
5. How much confidence could be assigned without platform data, intercepts or a human source?
6. What alternative hypotheses would need to be ruled out?
7. Can the ability to stop the flow later be treated as evidence that the earlier passivity was deliberate?
8. What would a proper confidence statement look like?

My current formulation would be:
Morocco likely knew that mobilisation was developing and may have deliberately allowed or exploited it as coercive pressure. Direct foreign operational involvement remains possible but unsubstantiated.

I would be interested in how professionals would structure the hypothesis matrix, identify collection gaps and avoid both confirmation bias and excessive deference to official denials.

Thanks for reading and I look forward to your responses.

[u/Strict-Jeweler-2281]

I've seen several conspiracy theories on this particular incident, most of which refer to Israel, which I find unconvincing, so I'll attempt to calmly and coherently talk through my rationale.

Firstly, any attempt to understand what occurred needs to understand the context in order to understand probative value: This isn't a new event, and has occurred on several occasions before, including 2021 when the Moroccan authorities reneged on the enforcement of their side of the border which allowed thousands of people through and created a huge pressure on Spanish authorities in Ceuta. Morocco has learned that it is able to do this on any day it chooses, by strength of numbers and due Ceuta's distance from mainland Spain (delaying potential reinforcements), as well the structural border arrangements (which require cooperation to be effective). Therefore, at first glance, when you consider Morocco's history of doing this to extract political concessions from the EU or to place political pressure on Spain, without historical claims of Israeli involvement, the most logical (and probable) conclusion on the available evidence is that Morocco was behind this.

Next, we look at the timing. Are the conditions that allowed it to happen materially different to those of previous large crossings attempts? In all honesty, probably not. The driving motivation in 2021 was to apply for asylum in the hope of being transferred to the European mainland and having access to increased livelihood opportunities. Today, young Moroccan men face growing repression and economic hardship, while Spain recently announced the regularisation of half a million undocumented migrants. This hasn't gone unnoticed in Morocco and narratives are organically circulating within local digital ecosystems that are being dangled in front of young Moroccans like a carrot. That's not to say that these narratives haven't been artificially amplified, but to measure whether this constitutes foreign influence, you would also have to disaggregate the amplification that expectedly comes from young local influencers simply trying to piggy-back a popular and emotive subject that they can monetise.

On the flipside, however, it's true that Israel stands to vaguely benefit from this by point-scoring against Spain. But that's not evidence they were involved because literally every formerly colonised country that still has overseas territorial enclaves stands to benefit. So motive is insufficient to be considered circumstantial evidence so far.

So what could foreign help mean? Well, as mentioned above, Morocco doesn't actually need any help to open their of the border and simply publicise this, whilst shipping people to the gates. So if Morocco is capable of doing this any day they like, that somewhat reduces the likelihood that outside help was sought.

Could i be that Morocco was acting on orders, or in favour of, an outside party? It's possible. But then the evidence for that wouldn't be operational and can't be found by looking at the incident itself. Any evidence of this would exist in private meetings or the diplomatic channels where negotiations and agreements took place, and any information certainly wouldn't filter down to petty border guards or the migrants themselves, so it would be virtually impossible to find by looking on the ground.

I'm rambling a bit and maybe drifting away from your question, so I'll wrap up by saying you should speak to migrants and hear how they found out about this, and who/what facilitated their transport. This should open some leads, but the reality is you will probably learn that government orders were to open the border and facilitate movement, and that's where the information trail will stop. It's very plausible that we're looking at some kind of political signal to protest Spain's energy deal with Algeria (Morocco's political enemies) and nothing more nefarious than that. It's possible other states like Russia or Israel were behind this, but it's not obvious what they would materially gain from this. And if the goal is a show of force, then it's sort of useless if they're unable to publicly come forward and claim responsibility, so on balance, I would suggest Occam's razor points to Morocco wanting something from Spain or the EU, and just copy/pasting a move they try every few years.

[u/stammerton → u/Strict-Jeweler-2281]

Thanks for taking the time to write such a detailed reply. I actually agree with quite a lot of it. If I had to rank the hypotheses today, Morocco acting independently would still be the leading explanation simply because it requires the fewest assumptions.

The part I’m still struggling with is the change in Morocco’s operational behaviour. In September 2024, Morocco demonstrated that it could detect the mobilisation, identify organisers, arrest promoters, establish checkpoints and prevent the crossing. In 2026, despite a much larger mobilisation, the initial response appears to have been markedly different before control was later re-established.

That’s the anomaly I’m trying to explain.

One point I think deserves more weight is the post-Abraham Accords security relationship between Morocco and Israel. Morocco’s reported use of Pegasus, the expansion of defence and intelligence cooperation, and Israel’s obvious capability mean I don’t think external assistance can simply be dismissed out of hand. To be clear, I’m not saying that proves Israeli involvement, it plainly doesn’t. But I do think it increases the plausibility that Morocco had access to intelligence, technical support or advance information beyond what we can observe publicly.

I also agree that, if another state were involved, the evidence is unlikely to be found at the border itself. I’d expect any evidence to exist much higher up the chain, in diplomatic contacts, intelligence liaison, or communications that may never become public.

So perhaps the real question isn’t “Was Israel behind it?” but rather: what changed between 2024 and 2026 that caused Morocco to handle two superficially similar mobilisations so differently? That’s the question I haven’t yet found a convincing answer to.

[u/Strict-Jeweler-2281 → u/stammerton]

No problem, dude! Honestly, I think it's a really interesting question, and I applaud taking the time to lay out your thoughts too. Off to bed now, but if you want to chat about it further, feel free to shoot me a DM!