Spain does not appear to be a battlefield. There are no armoured columns on its roads and no sirens announcing an invasion. Yet a political figure was shot in Madrid; a Russian pilot who defected to Ukraine was murdered in Alicante; a former Ukrainian official was killed in Pozuelo; an embassy was raided; and the telephones of the prime minister and several ministers were infected with spyware. The absence of declared war does not remove conflict. It changes its methods.

Modern intelligence operations flourish in the space between formal peace and acknowledged aggression. States can monitor, recruit, intimidate, steal information or neutralise perceived threats without publicly accepting responsibility. Spain offers communications, military infrastructure, international communities, diplomatic activity and access to both the Mediterranean and the Atlantic. It also offers something prized by every clandestine service: a society that still tends to regard espionage as a literary genre rather than a domestic security problem.

The gray zone and the strategic value of ambiguity

Spain’s 2025 Annual National Security Report recorded 108 activities involving foreign intelligence services. The figure does not authorise 108 spy novels, but it cannot be dismissed as a collection of anecdotes. It describes sustained efforts to recruit sources, obtain information and influence matters affecting Spanish interests.

A well-designed operation produces an effect without giving the target enough proof to justify an equivalent response. An assassination may resemble a criminal dispute. An industrial investment may be presented as a purely commercial decision. A digital intrusion may be blamed on private hackers. Ambiguity restricts political reaction and fragments public discussion. Everyone suspects; few can prove.

Psychologically, this method exploits the human need to complete an explanation. When information is incomplete, the mind fills the space with whichever narrative best fits its fears or loyalties. Institutions move in the opposite direction: if evidence does not reach a judicial threshold, the state tends to say little. Gray territory grows between public imagination and institutional silence.

Ferrol: investment, employment and military geography

Chinese automaker SAIC’s proposed electric-vehicle factory near Ferrol contains almost every element of the dilemma. It could bring substantial investment and employment. It would also stand roughly five kilometres from the naval arsenal and Navantia’s shipyards. According to RTVE, Spain’s Defence Ministry and intelligence service have assessed the security implications of that proximity.

There is no public evidence that SAIC is conducting espionage. Presenting that allegation as fact would be irresponsible. The serious question is whether democracies should assess an investment through economic returns alone, or also consider location, technology, data flows and the legal obligations affecting the parent company. Employment can function as an excellent geopolitical sedative. Security analysis begins when the press release ends.

Ferrol demonstrates how the terrain has changed. Intelligence no longer depends entirely on agents photographing documents. A connected industrial site produces communications, suppliers, digital traffic, recruitment and routine knowledge about nearby facilities. None of these elements proves a clandestine operation. Together they justify a professional risk assessment.

Vidal-Quadras: assassination attempt and the limits of attribution

On 9 November 2023, Alejo Vidal-Quadras survived a gunshot to the face in Madrid. Spain’s National Court charged eight alleged members of a criminal group and placed the motive in his political activity and support for the Iranian opposition.

The judicial investigation supports discussion of a network, planning and political motivation. It does not establish direct Iranian state responsibility through a final judgment. The distinction is essential, although hardly reassuring. Clandestine operations use intermediaries precisely to prevent the chain of responsibility from reaching whoever may have issued the order.

Kuzminov and Portnov: killings on Spanish soil

Maksim Kuzminov was the Russian pilot who defected to Ukraine with a military helicopter. He was murdered in Villajoyosa in February 2024. Spanish investigators reconstructed a carefully prepared killing, but the inquiry was provisionally closed after no suspects could be identified. The legal outcome does not settle the strategic interpretation: a defector of enormous propaganda value to Ukraine died on a Spanish residential estate, and his killers vanished.

In May 2025, Andriy Portnov, a lawyer and former senior Ukrainian official, was shot dead in Pozuelo de Alarcón. An alleged gunman was arrested in Germany and later extradited, but the identity of those who may have ordered the killing and the ultimate motive remain under investigation. Kuzminov and Portnov had different biographies, relationships and enemies. Assigning both murders to a single hand would be fabrication. Treating them as ordinary local incidents would ignore their international dimension.

In clandestine work, the message rarely arrives on official letterhead. The body communicates, the suspected state remains silent and the host government promises an investigation. That distribution of roles protects the organiser and leaves the territorial state with the political cost.

The raid on North Korea’s embassy

On 22 February 2019, a group entered North Korea’s embassy in Madrid, restrained staff and removed computers, telephones and documents. The participants were linked to the opposition group Free Joseon. Information about the operation later appeared in United States judicial proceedings.

The episode combined an attack on diplomatic premises in the Spanish capital, the extraction of intelligence material and actors with international reach. Claims that state intelligence services directed the raid have not been judicially established. The verified facts are disturbing enough. For several hours, an organised operation unfolded in Madrid against the diplomatic mission of one of the world’s most closed regimes.

Pegasus: the telephone as occupied territory

Pegasus moved the gray zone into the centre of executive power. The telephones of Prime Minister Pedro Sánchez and several ministers were infected. Spain’s National Court closed the investigation for a second time because Israel did not cooperate.

A personal device contains conversations, contacts, calendars, photographs, locations and access to other accounts. Infecting the telephone of a head of government penetrates a mobile section of the state’s architecture. Yet digital sovereignty appears to end with impressive punctuality where diplomatic courtesy begins.

Spies within and spies without

Spain has also experienced the classic problem of an insider transferring secrets. Former CNI officer Roberto Flórez was convicted of treason for obtaining classified documents connected with Russia. His original twelve-year sentence was later reduced to nine by the Supreme Court. The case demonstrated that vulnerability does not always arrive from a foreign embassy; it may possess credentials, an office and authorised access.

In 2023, two CNI officers were arrested over an alleged transfer of classified information to the United States. The proceedings have been secret and procedurally complex. It must be described as an investigation, not a conviction. Strategic allies also conduct intelligence. Alliances reduce conflicts of interest; they do not abolish the appetite for information.

The case of Pablo González, also known through his Russian identity Pavel Rubtsov, adds another kind of ambiguity. Poland detained him in 2022 and accused him of working for Russian military intelligence, which he denied. In 2024 he was transferred to Moscow in an international prisoner exchange. Spanish media reported in 2026 that the Polish courts had issued a European arrest warrant. His story recalls that journalistic cover, multiple identities and access to political communities belong to the historical repertoire of intelligence services, while accusations still require evidence and trial.

Gerald Bull: when knowledge makes a person a target

Gerald Bull did not die in Spain, but his story helps explain the European environment. The Canadian engineer worked on Project Babylon, Saddam Hussein’s supergun programme. He was assassinated in Brussels in March 1990. No court has established who ordered the murder.

His case contains an elementary rule of power: specialised knowledge can acquire the strategic value of a weapon. When one person concentrates a technical capability that is difficult to replace, his biography no longer belongs entirely to him. The suspected authors of Bull’s murder have multiplied over the decades. The abundance of suspects is part of the mystery and part of the real perpetrator’s protection.

Robert Maxwell in the Canary Islands: the official death and Juval Aviv’s account

On 5 November 1991, Robert Maxwell was found dead in the Atlantic after disappearing from his yacht near the Canary Islands. The official inquiry concluded that he suffered a cardiac episode and drowned accidentally. It did not establish murder.

Juval Aviv has advanced a different account. He argues that Maxwell was eliminated and connects him with the KGB, MI6 and Mossad. The thesis fits Maxwell’s public image as a businessman with access to political and intelligence circles, but narrative coherence is not proof. No conclusive public evidence has converted Aviv’s account into a judicial finding.

The case matters because it shows how secrecy operates socially. An accidental death may appear implausible when the individual accumulated extraordinary connections. A murder theory may appear inevitable because much of the relevant information remains beyond public reach. Suspicion feeds on known facts and on the expectation that unseen files exist.

Sandra Mozarowsky, Villarejo and the problem of late revelations

Sandra Mozarowsky was eighteen when she fell from the terrace of her Madrid home in August 1977. She died weeks later. Her pregnancy, her age and rumours of a relationship with Juan Carlos I turned the tragedy into a recurring story of Spain’s transition to democracy. No court ruling has established that she was murdered or that the then king was involved in her death.

José Manuel Villarejo claims that Mozarowsky was a KGB agent, that she approached the future monarch as part of an intelligence operation, and that her death was a concealed assassination. These are Villarejo’s allegations. No publicly available Soviet records, declassified Spanish files or judicial investigation independently corroborates them.

The distinction may sound repetitive, but it protects the credibility of the analysis. A recording proves that someone spoke certain words; it does not automatically prove their truth. Villarejo operated around opaque areas of the Spanish state and has been convicted in some proceedings while receiving acquittals or revisions in others. His archive merits investigation. Treating every statement as doctrine would create precisely the confusion a clandestine apparatus requires.

Villarejo and the privatisation of intelligence

The Villarejo affair reveals a broader institutional transformation: methods, contacts and information acquired within the state can become private services. Companies, political figures, lawyers and media organisations appear around surveillance commissions, reputational campaigns and leaks. The many branches of the Tándem proceedings have produced different judicial outcomes, so a responsible account must avoid both a general absolution and the rhetorical conviction of every defendant.

Sociologically, the consequence is corrosive. Citizens begin to suspect that public rules coexist with informal circuits in which information is bought, exchanged or used to discipline adversaries. That perception may rest on real events and still expand until every event becomes a conspiracy. The state loses legitimacy when it acts illegally and when it cannot explain.

The psychology of uncertainty and the sociology of silence

Secret warfare seeks to control behaviour, not merely obtain documents. A targeted killing may intimidate defectors, dissidents and witnesses thousands of miles away. A digital intrusion can force ministers and officials to wonder which conversations have been compromised. A leak can break internal alliances without requiring publication of the entire file.

Sustained uncertainty produces two complementary pathologies. The first is absolute credulity: every dark account appears true because institutions have concealed information before. The second is automatic denial: nothing can be accepted until there is a judgment, even when clandestinity is designed to prevent that judgment. Both responses simplify a reality that requires degrees of evidence.

A democratic society needs three separate categories: established facts, reasonable inferences and uncorroborated allegations. Mixing them benefits propagandists, foreign services and officials seeking to evade responsibility. Separating them permits determined investigation without manufacturing culprits.

Conclusion: living without closing the file too soon

Spain should not answer these events with paranoia. It also cannot continue treating them as unrelated stories that cease to matter when they disappear from the front page. Contemporary security requires scrutiny of investments near critical infrastructure, effective counter-intelligence, digital protection, judicial cooperation and public communication capable of admitting what is known and what remains unresolved.

Gray territory exists because attribution is slow, expensive and politically uncomfortable. States, intermediaries, criminals, companies and former officials operate there. Some cases end in court. Others survive as plausible suspicions. The democratic obligation is to prevent secrecy from becoming impunity and suspicion from becoming a religion.

Spain is already part of the silent war. The remaining question is whether its institutions are prepared to explain it.

Sources and documentation

• Spain’s 2025 Annual National Security Report.
• RTVE: security assessment of the proposed SAIC plant near Ferrol naval arsenal.
• Spain’s National Court: charges in the Vidal-Quadras assassination attempt.
• Reuters: provisional closure of the Kuzminov investigation.
• RTVE: investigation into Andriy Portnov’s murder.
• TIME: the raid on North Korea’s embassy in Madrid.
• Spain’s National Court: second closure of the Pegasus inquiry.
• RTVE: Roberto Flórez treason case.
• RTVE: investigation involving two CNI officers.
• El País: Pablo González released in the 2024 prisoner exchange.
• Spain’s National Court: first Tándem judgment.
• The Canadian Encyclopedia: Gerald Bull.
• The Guardian: the life and death of Robert Maxwell and an interview with Juval Aviv.
• Universidad Isabel I: documentary forensic discussion of Sandra Mozarowsky and Villarejo’s allegations.