AFCON 2025: Successes, Blind Spots, and the Intelligence Imperative for Morocco’s 2030 World Cup

Morocco’s intelligence services—DGED externally and DST domestically—have earned their standing through consistent performance in one of the world’s most unforgiving neighborhoods. They have disrupted plots, dismantled networks, and preserved stability against persistent pressures: Algeria’s longstanding ideological misreading of Morocco since independence, the Polisario proxy campaign funded from Algiers, Sahel instability spilling northward, and the calculated maneuvering of France and Spain. Partnerships with the United States, Israel, and select European counterparts have matured into real operational advantages. These are tangible achievements that many regional peers struggle to match.

The Africa Cup of Nations (AFCON) 2025 stood as a clear demonstration of that capability. The tournament delivered record results: more than 1.25 million spectators across nine stadiums, commercial revenues rising over 90% compared to the 2023 Côte d’Ivoire edition, six billion digital impressions (including 5.2 billion video views, per CAF official statements in January 2026), and direct economic returns exceeding €1.5 billion. Those funds provided an indirect but significant boost to 2030 World Cup preparations, accelerating timelines for stadium construction and transport links. CAF called it “the most successful commercial story in African football history”; FIFA leadership cited it as a model for 2030. These outcomes reflect effective ground-level security, crowd management, and logistical resilience—even under rainy-season conditions that tested stadium hardening.

Yet the final against Senegal exposed gaps that cannot be ignored. The match descended into disorder: a disputed late penalty, Senegal players staging a walk-off protest for 15–20 minutes, projectiles damaging stadium seating and barriers, clashes with security, and post-match violence resulting in 19 supporters (predominantly Senegalese) receiving prison sentences of 3–12 months for hooliganism. The escalation followed a deliberate pattern. Pre-match messaging had primed Senegalese fans and media to expect bias—“the game is tilted toward Morocco.” Referee announcements were wrongly blamed on the Moroccan hosts when CAF alone controls that process. Delegation phones were used openly for coordination; fans were directed to unsanctioned street gatherings without security clearance. The sequence—narrative seeding, on-pitch disruption, fan escalation, global media amplification—carried the hallmarks of a multi-stage psychological operation.

Indicators suggest external orchestration, most plausibly aligned with Algerian interests and potentially leveraging Egyptian CAF-adjacent networks to amplify refereeing controversies and bias claims. Dakar maintains liaison channels with Rabat; a purely national operation would have generated earlier friction or cooperation signals. The sophistication points beyond internal Senegalese dynamics.

The core issue was not a lack of tools, but under-utilisation of accessible streams. Open communications in hotels, delegation texts and calls, social media seeding—these were signals that should have raised alarms early. The emphasis remained on physical stadium security while digital and narrative domains were under-resourced. Actionable information likely surfaced but was not fused or escalated with sufficient speed. Post-bid confidence may have contributed to a degree of over-assurance. The result: a standout event left with exploitable headlines that rivals were quick to repurpose.

That under-utilisation of digital streams was partly influenced by recent controversies, including the Pegasus affair, which have made some hesitate on routine collection methods for fear of media blowback. For 2030, lawful intercept, open-source, and liaison tools must be employed deliberately and transparently, with full documentation to defend against narrative attacks and disruptive manoeuvres. Hesitation in this area risks repeating AFCON’s blind spots on a larger scale.

The 2030 FIFA World Cup, co-hosted with Spain and Portugal, is the next high-stakes target. The final venue remains undecided by FIFA (decision expected mid-2028 at the latest), with Morocco strongly advocating for Casablanca’s Grand Stade Hassan II (115,000 capacity, under construction with completion targeted for 2028). The venue choice carries heavy political and symbolic weight. Spain’s involvement should not induce complacency. Despite robust bilateral security cooperation—particularly on counter-terrorism and migration—the Spanish government can maintain plausible deniability. Operating within a democratic framework, Madrid can claim clean hands while other actors (state-linked or independent) plan and execute disruptive operations against Moroccan interests. Spain might passively facilitate certain activities—through lax oversight on migration routes or media ecosystems—or allow proxies to act, all while publicly disavowing any role. This indirect approach, cloaked in institutional pluralism, is a classic asymmetric tool in democracies.

A concrete illustration is Morocco’s repeated experience in the European Parliament and EU bodies. The kingdom has been caught off-guard multiple times by the sudden emergence of a lead critic—often a deputy from a seemingly neutral or unexpected member state—pushing resolutions or hearings on human rights, migration, or Sahara issues. Morocco is frequently surprised by which country is holding the flag against it. Is France quietly directing a non-French deputy to lead the charge? Or Spain orchestrating from the background? These are not random flare-ups; they align with moments when Morocco asserts independence on Atlantic initiatives or Sahara diplomacy. The pattern reflects coordinated influence, where principals use proxies to maintain distance while advancing their interests.

The vulnerabilities are real and adaptable. Below are seven of the most plausible “seed events” that could appear organic yet inflict disproportionate reputational and operational damage if timed correctly:

• Provocation of opposition figures (journalists, activists) leading to arrests or trials under cybercrime or public-order laws—ideal for “repressive regime” headlines timed just before a FIFA venue decision or during build-up.
• Viral campaigns spotlighting stray cats and dogs (millions roam urban areas), framing Morocco as inhumane. Animal-rights organisations are already attuned; staged cruelty footage could spread rapidly.
• Orchestrated media operations focusing exclusively on negatives (inequality, natural catastrophes, petty crime) while sidelining positives (renewables, tourism growth, AFCON success). AFCON saw crude variants from Algerian, Tunisian, and Egyptian-linked accounts; a refined push with Western media would carry greater weight.
• Engineered migrant surges at borders or ports, portraying Morocco as a crisis epicentre.
• “Creative” crimes in tourism hotspots (Marrakesh medina, Fez old town)—elaborate enough to appear indigenous and difficult to attribute externally.
• Mass food or water tampering exploiting open, high-volume logistics chains.
• LGBTQ+ flashpoints—visitors harassed or arrested, mirroring Qatar 2022 scrutiny as borders open to global crowds.

These draw from real precursors: the Tangier Maersk ship protests (fake news about Israeli arms, yet crowds mobilised), the recent Casablanca judicial police headquarters incident (a man under questioning jumped from the fourth floor; available reporting suggests injuries consistent with deliberate fall). One event involving one person, mishandled, can spiral uncontrollably. Tunisia’s Arab Spring ignited from a single humiliation—a policewoman slapped Mohamed Bouazizi, prompting his self-immolation and nationwide upheaval. Iran’s widespread riots followed Mahsa Amini’s death in custody over a hijab violation. Custody incidents are among the highest-risk sparks: a single death or injury, even if later ruled suicide or accident, can be framed as state brutality and ignite public anger before facts emerge.

Emerging urban threats also demand attention. Biker gangs and electric-scooter groups are increasingly visible in big towns and cities alike—not just Casablanca or Marrakesh, but Tangier, Agadir, Fez, and beyond. They already speed through streets, ride in packs, and intimidate regular citizens—pedestrians startled on crossings, drivers forced off roads, families unable to walk safely. These are not yet hardened criminal gangs, but young, impulsive groups chasing quick thrills, money, drugs, or social status. A collision involving a pedestrian, cyclist, or even a local resident could become a national black spot overnight, let alone a global story during 2030. More alarming, they could be weaponized and become somebody’s operatives.

The regular bikers are creating another chaos that Morocco is struggling to contain. They don’t follow circulation rules, endangering everybody. Serious thinking and enforcing should start early.

Preparation for 2030 must begin immediately and systematically. The following framework groups recommendations into thematic clusters to maintain analytical coherence while preserving practicality:

Institutional Architecture
Establish a dedicated 2030 security think tank—compact, trusted, direct-reporting to leadership—combining DGED/DST veterans, academics, private-sector risk analysts, and red-team innovators. Form structured creativity/brainstorm groups to run regular “novel attack” simulations, cataloguing risks and refreshing the vulnerability matrix quarterly. Initiate comprehensive early planning that fuses intelligence, police, judiciary, tourism, and infrastructure into a unified 2030 security hub. Political leadership must be involved from day one—ministers and the Palace need to own narrative and proportionality hazards.

Operational and Narrative Defense
Conduct intensive scenario-based training on all identified seed events, including crowd psychology and narrative countermeasures. Develop a core of credible Moroccan influencers—not official spokespeople—to deliver rapid, measured responses that avoid amplifying attacks. Assemble a team of skilled journalists and analysts (internal and allied media) trained to counter false narratives with facts and context. Create a 24/7 real-time crisis cell with immediate decision authority to shape the narrative before opposing versions harden. Strengthen digital infrastructure security (ticketing systems, stadium Wi-Fi, transport control, broadcast feeds) as critical attack surfaces.

Human and Ground-Level Risk Management
Tackle known pitfalls proactively—refine police/judiciary protocols for high-visibility arrests, custody oversight (cameras, medical checks), and swift public disclosure to prevent “spark” escalations. Establish grassroots threat reporting—empower frontline police, municipal officers, and community watches to flag anomalies (e.g., biker gangs or electric-scooter packs in tourist zones and urban centers). Build a secure, user-friendly channel for immediate input, filtered centrally.

External Coordination and Cooperation
Mandate seamless DGED-DST collaboration—external threats materialise internally; compartmentalisation slows response time. Engage friendly governments early—preemptive liaison with partners (e.g., Senegal, U.S., France, Spain) converts them to allies rather than bystanders claiming ignorance.

This framework is not exhaustive. It is a foundation to be expanded and tested. Morocco has already proven it can deliver world-class events. The imperative now is ensuring that excellence is matched by equally world-class foresight. In this domain, perceived strength must equal actual strength—or the gaps will find you.