Since the March 11, 2004 terrorist attacks in Madrid, Spanish security forces have carried out 28 operations against jihadist networks. The amount of jihadist activity in Spain demonstrates how it has become a structural phenomenon and poses a threat to Spanish and European security. This article analyzes the main characteristics of the 28 foiled networks: their origin, functions and potential links to wider terrorist organizations. It finds that the majority of those involved in Spanish terrorist plots are of Algerian and Moroccan descent, their primary role is logistics work, and the majority of cells have been linked to wider terrorist organizations.

Primarily Maghrebian Origins

The first discernible fact is that 70% of those arrested come from Algeria and Morocco [1]. This is not surprising because the majority of Muslim immigrants in Spain are Moroccans, followed by Algerians. The overwhelming tendency of jihadist networks in Spain to be composed of Moroccans and Algerians is unlikely to change in the future. The third predominant nationality is Pakistani. Twenty-three Pakistanis have been arrested since 2004. Most of them belonged to two cells that presumably were preparing terrorist attacks in Barcelona (one in September 2004 and another in January 2008). The Pakistani community in Spain is not very open, and security forces find it particularly difficult to infiltrate it or obtain cooperation from its members. Pakistani residents in Spain also travel frequently to their home country [2].

Spaniards represent the fourth most prominent nationality among those arrested in the 28 counter-terrorist operations since the Madrid bombings. Although 14 of the 19 Spaniards arrested were born in the Spanish cities of Ceuta and Melilla, their parents were of Moroccan origin and they were raised as Muslims. Only five are Spanish converts to Islam.

Logistics Functions and Preparations for New Attacks in Spain

Most Spanish police operations have focused on networks that performed logistics tasks. Logistics work is the main task of cells that have settled in Spain since the beginning of the 1990s. In recent years, this work has included the recruitment and sending of volunteers to fight in Iraq. This role corresponds to eight networks uncovered by Spanish security services. There are also the cases of three cells that were apprehended in 2007 for sending volunteers to Algeria with the intention of later entering Iraq. Unfortunately, there is no concrete data available on the exact number of individuals recruited and sent from Spain. Some specific cases are known, such as the Algerian Belgacem Bellil, originally recruited by a network in Catalonia; he later became involved in an attack against an Italian Carabinieri command in Nasiriyya, Iraq in November 2003. Overall, however, a remarkable lack of information exists on this issue.

In addition to recruitment and sending fighters to theaters of jihad, other logistics tasks include providing false documentation or money to established jihadist groups. Spanish security forces arrested five of these cells, and they were tied to the Salafist Group for Preaching and Combat (GSPC)—now known as al-Qa`ida in the Islamic Maghreb (AQIM). In all five cells, financing was managed via the fraudulent use of credit cards, domestic burglaries or selling counterfeit clothing. There is also one case that escapes common parameters involving a GSPC cell that invested in a prostitution house in Malaga with the intention of passing on funds on a long-term basis to Algeria.

After the Madrid bombings, the number of groups that have tried to commit attacks in Spain has increased. Certainty of at least seven terrorist plans of this type exists. Fortunately, most of these plans were foiled in the early phases of preparation. In addition to these seven plots, there were also two cases of suspicious activity undertaken in 2004 by individuals with links to jihadist groups: the video recording of important buildings in Barcelona by members of a Pakistani cell, and the detention of two Moroccans in possession of a camera near a nuclear power station in Guadalajara near Madrid. Almost all of these plans involved attacks on various civilian targets with the intention to cause mass indiscriminate death. Of all the Spanish cities, Madrid and Barcelona were the most frequently listed targets. This again demonstrates the interest to carry out attacks in cities that guarantee the attention of the global media. The information available suggests that beyond the typical rationale of a struggle against infidels, the plans were driven by a desire for revenge in response to Spanish counter-terrorist activities and the presence of Spanish troops in Afghanistan. In four cases, the terrorists sought to acquire explosives by buying them from criminals (such as in the Madrid bombings), and in three cases they supposedly sought to use homemade explosives.

Subordination to Regional Organizations

A third important aspect regarding jihadist militancy in Spain is that most of the cells were linked to wider organizations, mainly the GSPC/AQIM. There have also been cases of autonomous grassroots jihadist networks, but their numbers are significantly lower. One individual even operated alone, on a supposedly “lone wolf” basis. These three types of cells—subordinates to wider organizations, grassroots networks and “lone wolf” operatives—will be explored in this section.

Of the 28 cells analyzed, 22 form part of wider organizations. Overall, two main criteria needed to be fulfilled to consider a cell as part of a wider organization: communication and coordinated action. The cell would need to maintain regular contact with other members of the superior organization and carry out coordinated efforts with other cells of the group [3]. Figure 1 (see PDF) shows the organizations to which the cells belonged. In at least three of the cases, cells simultaneously communicated and coordinated their activities with their original organization (the GSPC or the GICM) and with al-Qa`ida in Iraq. For this reason, they have been noted twice in the data as linked to those organizations.

Five of the 28 cells were grassroots jihadist networks. This is defined as groups of militants who act completely autonomously, without subordination or coordination to a superior group, although they could possibly be in contact with members of other networks or organizations. It is possible that some of these cells were in fact dependent on a superior organization; however, based on the current open source data, that is impossible to verify.

Cross sectioning the data above provides interesting results regarding cell categories and functions. Of the 22 local cells that coordinated with a superior organization, only three cells were preparing attacks in Spain (two of them performed both logistical and preparatory tasks). Of the five grassroots jihadist networks, however, four cells focused on the preparation of attacks in Spain and the fifth cell was committed to the development and distribution of propaganda via the internet. Although not part of this study, the network that executed the 2004 attacks in Madrid also corresponds, given the available information, to the category of a grassroots jihadist network [4].

All of the grassroots jihadist networks that prepared attacks in Spain lacked professionalism and were too open to their social surroundings, making them vulnerable to authorities. The terrorist plot that came closest to success was to be executed by a cell tied to a wider organization. That plan involved a series of attacks on the Barcelona metro from a cell composed of trained Pakistanis under the subordination of Tehrik-i-Taliban Pakistan (TTP). The cell and its plan were detected and uncovered by an undercover agent from the French intelligence services who had infiltrated it. The cell possessed enough knowledge to build homemade explosives, had already selected six suicide bomber candidates and chose the targets to attack. After the attacks, Baitullah Mehsud, the leader of the TTP, planned to release a statement demanding the withdrawal of European troops from Afghanistan [5].

Among the 28 cases examined, there is one that falls into the category of a “lone wolf.” In September 2007, the Mossos d’Esquadra (Catalonian Police) arrested a French individual of Moroccan origin in Girona, traveling by car from Toulouse in France. He had in his car two gas canisters, firecrackers, a leaflet of the Islamic Army in Iraq that praised acts of martyrdom and, most surprisingly, a Ninja sword situated behind the driver’s seat. The presence of the sword in the back seat, aimed at his body, is perhaps proof of his suicide intentions. The individual was possibly inspired by the attack in June 2007 that took place in Glasgow when two individuals crashed a car into the city airport. Perhaps to avoid being burnt to death, the sword was placed behind the driver so as to kill him rapidly upon impact.


The presence of jihadist networks in Spain has become a structural phenomenon. The majority of cells consisted of individuals from Algeria and Morocco, and many were linked to the GSPC/AQIM. The 28 police operations conducted following the attacks in Madrid demonstrate the pressure that Spanish security forces exert over jihadist cells, but also the degree of implantation of jihadist elements on Spanish soil.

Although the Islamic community in Spain has generally displayed a firm rejection of the Madrid terrorist attacks, in the long-term jihadists could benefit from the wide diffusion of non-violent Islamist movements within Spain’s Muslim immigrant community. Some of these groups indirectly pose the question of how best to integrate Muslim immigrants into Spanish society, and in exceptional cases these groups may even act as a step toward radical socialization. In Spain, groups of concern include the Moroccan movement al-`adl wa’l-`adl Ihsan (Justice and Spirituality), numerous Salafist Wahhabist preachers who control nearly 30 oratories (of the more than 200 mosques and oratories) in Catalonia, Tablighi Jama`at and, to a lesser extent, Hizb al-Tahrir. Additionally, the radicalization of Muslim inmates in Spanish prisons must also be considered, with serious problems in the control of visits, dissemination of books and religious preaching inside the penitentiary facilities [6].

This evidence guarantees that dozens of militants will arise in the future. Fortunately, almost all of the attempts to target Spain after the Madrid attacks in 2004 have been carried out by networks that are mostly unprofessional and vulnerable. Yet, the risk of new attacks on Spanish soil remains high. Some of the grassroots networks might achieve success in the future, such as the group that executed the Madrid attacks. The degree of threat would also rise if AQIM actually modifies its strategy [7] and instructs its logistics cells to attack targets in Spain and France.

Dr. Javier Jordan is Senior Lecturer in Political Science at the University of Granada in Spain, and Director of Athena Intelligence Foundation, a Spanish think-tank that specializes in the study of Terrorism and Armed Conflicts.


[1] This fact, along with most of the information in this report, is based on the author’s study of the 28 Spanish counter-terrorist operations that have occurred since the 2004 Madrid attacks.

[2] In fact, many are currently petitioning for direct flights between Barcelona and Pakistan—at present, they use indirect flights via the United Kingdom.

[3] Examples of communication and coordinated action include recruiting and placing volunteers, transferring money and shipping false documents, and preparing attacks following the directives of a superior organization. These criteria are thus merely functional, not formal. For example, it is not required as formal criteria that the cell leader pledge an oath of loyalty to the amir of the superior organization or that the other cell members, except the leader, consider themselves as members of the wider organization.

[4] Javier Jordán, Fernando M. Mañas and Nicola Horsburgh, “Strengths and Weaknesses of Grassroots Jihadist Networks: The Madrid Bombings,” Studies in Conflict and Terrorism 31:1 (2008): pp. 17-39.

[5] Antonio Baquero and Jordi Corachán, “Los 14 detenidos en BCN planeaban atentados en España y en Francia,” El Periódico de Catalunya, January 20, 2008.

[6] José Antonio Gutiérrez, Javier Jordán and Humberto Trujillo, “Prevention of Jihadist Radicalization in Spanish Prisons. Current Situation, Challenges and Dysfunctions of the Penitentiary System,” Athena Intelligence Journal 3:1 (2008): pp. 7-16.

[7] Although AQIM has issued incendiary statements toward France and Spain, it does not appear to have changed its targeting strategy to Europe.

Stay Informed

Sign up to receive updates from CTC.

Sign up