Phoenix 24
Pegasus, Ceuta, and the New Cost of Proximity
Spyware turns visits into liabilities.
Madrid, February 2026.
Reports reviving the allegation that Morocco infected Spain’s prime minister’s phone with Pegasus during his 2021 visit to Ceuta are not simply resurfacing a scandal, they are reopening a question about how modern statecraft is conducted under the cover of technical ambiguity. The claim matters because it ties an intrusion to a precise geopolitical moment, when migration pressure, border optics, and bilateral bargaining converged in an unusually tight window. In intelligence terms, that is exactly the kind of window in which targeting becomes easier, because the environment is predictable, the device is active, and the potential value of intercepted decision-making is unusually high. The allegation is not just about what was taken, it is about what the suspected actor believed could be shaped.
Spain has already treated the compromise itself as real in the public record, even if attribution has remained contested. When a head of government’s phone is assessed as infected, the damage is not limited to a list of files, it extends to the confidence of the system around him. A compromised device can expose contacts, calendars, internal dynamics, and the tempo of decision-making, which are often more valuable than any single document. Even if the extraction is partial, it provides a map of who speaks to whom, when pressure is rising, and where political flexibility exists. That is why the political shock of such incidents persists long after the technical details fade.
What makes the Ceuta timing salient is not mysticism, it is operational logic. High-profile travel creates dense connectivity, radios, temporary networks, logistics coordination, and frequent device use, which increases attack surface in multiple ways. It also concentrates strategic attention around a small set of individuals, reducing the attacker’s uncertainty about whose communications matter. Border visits, in particular, generate sensitive exchanges involving security services, interior ministries, and diplomatic channels, often in compressed timeframes. The allegation therefore fits a plausible model of opportunity, even before one argues about who pulled the trigger.
Attribution, however, is where spyware cases become political minefields. Pegasus is a commercial-grade tool sold under restrictive licensing, but deployed in environments designed to minimize forensic residue and plausible responsibility. Proving that a given state ordered or executed a specific intrusion usually requires more than a technical finding of infection, it requires infrastructure traces, vendor records, human sources, or legal cooperation that rarely materializes. This is why many democracies can confirm compromise yet fail to name an actor in a way that survives legal challenge. The gap between forensic certainty and judicial certainty is the space where narratives compete.
That narrative contest is central to this episode because it sits on top of a bilateral relationship already loaded with historical sensitivity. Spain and Morocco manage an intricate border reality where migration, trade, security cooperation, and territorial symbolism interact constantly. When that relationship enters a crisis cycle, intelligence collection becomes more than curiosity, it becomes leverage, a way to anticipate red lines and shape the opponent’s internal deliberations. In this context, an alleged intrusion would function less like surveillance for its own sake and more like strategic positioning. The message, implicit rather than declared, is that private decision space is not safe.
The domestic political consequences in Spain are equally structural. A leader whose communications may have been exposed is forced to tighten internal channels, narrow sensitive conversations, and increase the role of secure systems, which can slow decision-making and concentrate authority. That concentration is not necessarily a choice, it is a defensive adaptation. Over time, defensive adaptation can erode transparency, because the state begins to treat normal political communication as a security risk. The public then experiences a paradox: surveillance threats can lead to less openness inside government, even when openness is precisely what citizens demand after a scandal.
The broader European context also matters because spyware is no longer an exotic outlier, it is an ecosystem problem. Over the last several years, multiple European controversies have shown that mercenary surveillance tools can migrate from counterterror justifications into political intelligence collection, especially when oversight is fragmented. Once such tools are normalized in a region’s strategic imagination, every political crisis becomes a potential targeting environment. That normalization changes behavior across institutions, parties, and civil society, because everyone begins to assume that phones can be turned into microphones. The psychological effect is quiet but corrosive, and it weakens the trust layer that democratic governance depends on.
From the perspective of international governance, the recurring failure is not only technical, it is regulatory. Commercial spyware markets operate in a space where export controls, vendor opacity, and cross-border legal barriers impede accountability. When investigations depend on cooperation that is slow, partial, or absent, the system effectively rewards deniability. That reward structure incentivizes repeated use, because the expected cost of being conclusively identified is low. As long as this remains true, allegations will continue to function as strategic instruments, even when courts cannot close the loop.
The key point is that this is not merely a story about one phone, it is a story about how proximity has become a vulnerability in the era of weaponized software. State visits used to be evaluated primarily through physical security and diplomatic choreography, now they must be evaluated through technical exposure as well. The more leaders rely on mobile ecosystems for speed and coordination, the more those ecosystems become contested terrain. If the allegation is accurate, it signals an intelligence posture that treats diplomatic crisis as an opportunity for covert collection; if it is not accurate, it still signals how fragile trust has become. Either way, the structure is the same: in modern geopolitics, the line between negotiation and intrusion is thinner than official language will admit.
Detrás de cada dato, la intención. / Behind every data point, the intention.