What Spain can do and doesn't: operational catalogue against Morocco

1. Premise: zero cost does not exist

Any action that genuinely disciplines Morocco will trigger countermeasures. Rabat has invested too much in the current position to abandon it without resistance. The operational question is not finding measures without cost, but identifying those where cost is manageable, asymmetric —more expensive for them than for us— and politically sustainable.

These three criteria filter the catalogue. What remains is a set of instruments meeting three additional conditions: within current legal framework, technically realistic with existing capabilities, and with precedent of use by European allies in comparable situations.

What follows is not theoretical invention. It is what other states already do and Spain has decided not to do.

2. Financial intelligence on Makhzen wealth in Europe

Mapping, documentation and, when appropriate, public exposure of real estate, shell companies and bank accounts of the Moroccan security apparatus in Spanish and European territory. Yassine Mansouri (DGED), Abdellatif Hammouchi (DGST) and the Makhzen inner circle have documented patrimonial presence in Spain, France, Belgium, UK and Switzerland. The 2024-2025 leaks on Mansouri's millionaire properties already generated internal tensions between DGED and DGST.

How. Coordinated activation of SEPBLAC and UDEF. Add the Tax Agency on origin-of-funds review. European coordination with Tracfin (France), CTIF-CFI (Belgium), MROS (Switzerland) and FCA (UK) under the 5th and 6th Anti-Money Laundering Directives.

Why it works. Touches the personal pocket of those who design operations against Spain. Generates internal Makhzen friction by exposing wealth tensions between factions. Perfectly legal: money laundering and origin-of-funds investigation is routine activity for any financial intelligence unit. Very low cost, low retaliation risk.

3. Systematic public attribution doctrine

Institutional policy of public attribution by default when Moroccan service operations are detected against targets in Spanish territory. The US does this with Russia, China and Iran. The UK publishes detailed technical indications via NCSC. The Netherlands made public in 2018 the Russian OPCW hacking attempt with names and surnames of GRU officers involved. Spain instead manages Moroccan operations in silence.

How. Coordinated communication between CCN, MCCE and Foreign Affairs. Publication of indicators of compromise, technical infrastructure used, operational patterns and, where legally possible, operational identities. Support on public investigations by Citizen Lab, Amnesty Tech and journalistic consortia.

Why it works. Raises reputational cost of each operation. Complicates reuse of offensive infrastructure, which has to be rebuilt from scratch when publicly burned. Discourages commercial technical partners (NSO Group and equivalents) from continuing collaboration. Creates legal precedent usable for later individual sanctions.

4. Structural support to the critical Moroccan diaspora in Europe

Structured programme of protection and support for Moroccan journalists, activists and dissidents resident in Spanish territory. Morocco fears the organised critical diaspora more than European chancelleries. Today they operate dispersed, without specific protection against transnational harassment documented by Moroccan services on European soil.

How. Real security cover (not only formal asylum). Specialised legal assistance on transnational harassment claims. Institutional visibility spaces. Coordination with French and Belgian counterparts. Technical support on personal digital security (anti-spyware audits, OPSEC training).

Why it works. Generates permanent reputational cost for Rabat by feeding continued journalistic investigation. Turns every Moroccan operation against dissidents on Spanish soil into an automatic diplomatic incident. Asymmetric pressure of low cost and high sustained return.

5. Silent activation of European financial leverage

Morocco depends critically on EU funds: development aid, NDICI-Global Europe neighbourhood instrument, EIB financing, preferential trade agreements, migratory cooperation with millionaire disbursements. Spain is net contributor and has determining voice in the Council on relations with southern neighbours.

How. Selective blocking or slowing of European financing tranches until Rabat delivers verifiable guarantees on cessation of cyber operations against European citizens. Managed in Council technical committees, COREPER and working groups, not in headlines. Requires coordination with at least one other affected Member State —France is natural candidate—.

Why it works. Morocco cannot counter symmetrically because it has no equivalent funds to withdraw from Spain or the EU. Total asymmetry. The mechanism is legally impeccable: European funds to third countries carry standard conditionality on human rights and cooperation; activating it requires no new legislation.

6. Selective reactivation of the Algerian and Mauritanian axis

Diversified Maghreb diplomacy. Not as substitution for Morocco but as counterweight. Morocco lives obsessed with Algerian diplomacy and pays significant strategic cost every time Spain approaches Algiers. The 2022-2023 Algerian gas crisis proved the sensitivity. Mauritania offers real alternative for Atlantic migratory management.

How. Regular ministerial visits to Algiers and Nouakchott. New bilateral agreements on security, counterterrorism, energy and regional cooperation. Reactivation of the Friendship, Good Neighbourhood and Cooperation Treaty with Algeria, currently dormant.

Why it works. Every Spanish move toward Algiers raises the cost of pressure for Morocco. Mauritania reduces the Moroccan monopoly on Atlantic migratory management, currently the highest-volume route to the Canary Islands. Diversification reduces Moroccan leverage on points where it most hurts Spain.

7. Individual sanctions under the European regime

The EU Global Human Rights Sanctions Regime —the so-called "European Magnitsky", approved in December 2020— allows asset freeze and entry ban in the Schengen area for individuals responsible for serious human rights abuses. Mass surveillance with commercial spyware against European journalists, activists and political leaders falls within the regime's material scope.

How. Spain pushes in Brussels for an individual sanctions package against DGED and DGST officers documentedly involved in Pegasus operations against European citizens. Starting with chain-of-command leaders. Requires Council unanimity, meaning intense prior diplomatic work.

Why it works. Personally touches those who execute operations. Blocks access to Europe, where they have wealth, family and personal projection. The kind of measure that changes the individual calculation of an intelligence officer: the difference between operating with impunity and with real personal cost.

8. Administrative tightening of visas and mobility

Rigorous application of visa, residence permit and real estate investment authorisation criteria over personnel linked to Moroccan services and their direct families. Children, spouses and close relatives of senior Makhzen officials study, live and have properties in Spain, France, Belgium and UK.

How. Without need for public statements. Strict application of criteria routinely applied to other nationals: origin-of-funds documentation, investment justification, reinforced background verification. Coordination between Interior, Foreign Affairs and consulates.

Why it works. Touches the real Makhzen way of life, not its rhetoric. Whether the child of a senior official studies in Madrid or not matters more in family intimacy than any official communiqué. Silent, individualised and persistent pressure.

9. State offensive cyber capabilities

MCCE has explicit public mandate to conduct military operations in cyberspace, including legitimate, timely and proportionate response to threats or aggressions affecting National Defence. This is not theory: it is published doctrine and existing technical capability. What is missing is not legal framework, it is willingness to use.

How. Degradation operations —not destruction— against DGED command and control infrastructure. Targeting of servers hosting operations against European citizens, exfiltration endpoints, relay infrastructure. Technical exposure operations where Moroccan offensive infrastructure is publicly burned. All within the framework of applicable international law, with reference to Tallinn Manual 2.0.

What does not enter. Private hack-back contracted to firms. Sabotage of Moroccan civil critical infrastructure. Kinetic operations. These options remain out due to escalation, disproportion and legal risk.

Why it works. Raises real operational cost. Each burned infrastructure takes months to rebuild. And sends clear signal that Spain can reach the technical core of operations against it. High cost and retaliation risk: belongs to highest response level.

10. Application architecture: three layers

None of these measures in isolation disciplines Morocco. The combination of several, applied with patience and without theatricality, does. Smart architecture works in layers.

Layer 1 — Silent core. Immediate action, low cost, high cumulative impact: financial intelligence on Makhzen wealth, systematic public attribution doctrine, structural support to critical diaspora, European funds slowdown in technical committees. This layer alone, sustained for 12-18 months, already alters Rabat's calculation.

Layer 2 — Visible pressure. Moderate cost, requires diplomatic preparation: active diplomacy with Algeria and Mauritania, administrative visa tightening, European individual sanctions on DGED and DGST officers. Raises personal and elite cost, not only institutional.

Layer 3 — Force backup. Reserved use, high activation cost: MCCE offensive cyber capabilities, formal expulsion of DGED operatives under diplomatic cover. Activated only when other levers have failed or upon a graver incident. Its real value is the credibility of its existence, not frequent use.

11. Why this architecture works

The virtue of combination is asymmetric cumulative effect. Morocco cannot counter symmetrically because Spain operates on planes where Rabat has much to lose and little to respond with: no EU funds to withdraw from Spain, no equivalent capability to investigate Spanish wealth in Morocco, no organised critical Spanish diaspora to harass, no offensive cyber capability equivalent to MCCE, no European allies willing to back retaliation against Madrid.

What Morocco does have —and why response must be dosed— is pressure capability over asymmetric points where Spain is vulnerable: enclaves, migration, business exposure. The layered architecture allows gradual escalation, measuring Rabat's response before moving to the next level.

And, above all, it does not require breaking diplomatic relations or assuming open crisis. It is managed, professional, sustained pressure. Exactly how France, Germany, Netherlands and UK manage states with services active in their territory.

12. Predictable objections

"Morocco will respond with migratory pressure". Yes, it will. And precisely for that reason the architecture starts with diversification toward Mauritania (Layer 2). Mauritania controls the Atlantic route, currently the highest-volume to the Canary Islands. Reducing Moroccan migratory monopoly is prerequisite for response margin on other fronts. Also, instrumentalisation of people has operational and reputational limits.

"The US will not support Spanish escalation". True in general terms. But none of Layer 1 measures requires US support. Financial intelligence, public attribution, dissident support and European financial leverage are internal Spanish and European actions. Washington may not back them but cannot veto either. NSO is already on the US Commerce blacklist since 2021.

"This will break counterterrorism cooperation". CT cooperation is bilateral with mutual benefit: Morocco also obtains useful intelligence for its own internal security. Breaking it unilaterally would have cost for Rabat too. It also operates at technical-police level between services, not political, making it more resilient to diplomatic turbulence than many assume.

13. Series close

The Spain-Morocco managed asymmetry is not destiny. It is a decision renewed by inaction, and therefore reversible by decision. The catalogue exists, is available, is legally impeccable and has allied precedent. What is missing is not capability: it is political will and State consensus.

For the professional audience —executives, boards, security leads, journalists, observers— the operational conclusion is twofold. First: institutional cover will not arrive in the short term, so operational protection against Moroccan pressure is own work, not the State's. Second: space for intelligence, analysis and professional private action will grow, precisely because official channels remain blocked.

Knowing this catalogue is the first step. That it one day be used depends on something harder to build than any of the eight measures: political will, institutional consensus and willingness to assume the cost of doing what any equivalent European ally has been doing for years without drama.