Spain Warns of Jihadist Calls for Attacks During Demonstrations in Four European Countries — But Were France and Italy Notified?

Spanish security officials detected online calls for jihadist attacks against police officers and demonstrators in four European countries on 23 October 2026, raising questions about whether the warning was communicated to neighbouring governments as authorities prepared for another weekend of widespread demonstrations and public disorder.

The warning, issued by Spain’s Office of Cybersecurity Coordination (Oficina de Coordinación de Ciberseguridad, OCC), identified messages published on a website sympathetic to Islamic State. The material encouraged attacks during large public gatherings and referred to demonstrations in Spain, France, Italy and Portugal.

Spain’s Interior Ministry received an internal security alert, and Portuguese authorities subsequently confirmed that they were monitoring the threat. However, no publicly verified acknowledgment has been identified establishing whether France and Italy received a formal notification from Spain, when such a notification might have been transmitted or which agencies would have received it.

France and Italy were among the countries identified in the warning, but being identified as potential targets does not establish that their security authorities received Spain’s intelligence assessment.

Nor does the absence of a public acknowledgment prove that the information was withheld. Counterterrorism intelligence is frequently exchanged through restricted channels, and the details of those exchanges are not necessarily made public.

Spain Detects Calls for Attacks on Police and Demonstrators

The Spanish warning was identified in an internal document titled Llamamiento a atacar a policías y manifestantes, meaning a call to attack police officers and demonstrators.

According to Spanish reporting based on access to the document, the alert carries the reference OCC-00055-097 and was prepared following the detection of extremist messages during routine monitoring of online activity associated with jihadist propaganda.

The messages encouraged supporters to exploit crowded demonstrations and confrontations between police and protesters as opportunities to commit violence. They discussed several forms of attack, including explosives, edged weapons and vehicles.

The material specifically identified the large numbers of people gathering in France as an opportunity for attackers. Police officers attempting to control violent confrontations were also portrayed as potential targets.

The alert is significant because the proposed victims included both law enforcement officers and members of the public attending demonstrations.

It was therefore not simply a call for participation in the existing unrest. It was an incitement to commit terrorist violence against people who might already be exposed to danger during large public gatherings.

However, the available evidence does not establish that the messages originated from Islamic State’s official leadership or represented an authenticated operational instruction from the organisation.

Spanish counterterrorism sources have described the material as originating within an online environment sympathetic to Islamic State. That distinction matters when assessing the source, authority and operational significance of the threat.

The Warning Was Circulated Within Spain

The OCC operates within the Spanish Interior Ministry’s security structure and is involved in identifying digital threats that could affect public safety.

Its alert was sent to the Secretariat of State for Security. Spanish reporting also described the warning being circulated to national police authorities.

In Catalonia, the Mossos d’Esquadra reportedly issued an internal reminder to officers about personal safety precautions during operations scheduled between 23 and 26 October.

The Catalan communication followed the detection of the extremist messages and advised officers to remain attentive to their surroundings and existing security procedures.

This provides evidence that the warning prompted attention within Spain’s policing arrangements.

Spain has maintained a reinforced Level 4 counterterrorism alert since October 2023. Level 4 represents a high threat assessment on the country’s five-level scale.

The October 2026 warning did not, on the available public evidence, produce a new increase in that national alert level.

Spanish officials have also emphasised that detecting extremist propaganda is not equivalent to identifying an imminent terrorist operation.

Portugal Confirms It Is Monitoring the Threat

Portugal provided the clearest public acknowledgment outside Spain.

On 23 October, Portugal’s Internal Security System (Sistema de Segurança Interna, SSI) confirmed to the Portuguese news agency Lusa that its secretary-general was monitoring the reported jihadist calls for attacks.

The SSI stated that the matter was being followed closely within its responsibilities and in continuing coordination with the competent authorities.

The response was subsequently published by Portugal’s public broadcaster RTP and other news organisations.

The Portuguese Ministry of Internal Administration had referred questions about the warning to the SSI, which is responsible for coordinating information between the country’s security services.

Portugal’s acknowledgment establishes that the country’s security authorities were aware of the threat and were monitoring it.

It does not establish precisely how Portugal obtained the information, whether a classified notification was received from Spain, or whether the alert was transmitted through a European security-information system.

These remain separate questions requiring confirmation from the governments concerned.

France Was Named — But Did It Receive the Warning?

France featured prominently in the extremist messages, which referred to the scale of public demonstrations and the opportunities presented by large crowds and clashes with police.

The warning emerged as French authorities were preparing a major security operation for Saturday, 24 October, following extensive violence during demonstrations the previous weekend.

On 23 October, the French Interior Ministry issued instructions to regional authorities concerning the protection of businesses, government buildings, transport routes and people attending demonstrations.

The ministry stated that highly mobile groups had attacked centres of authority, looted shops and assaulted police officers during the disturbances on 17 October.

Approximately 70,000 police officers and gendarmes were being mobilised nationally, with specialist units and additional equipment available where required.

These measures demonstrate that the French government regarded the risk of further public disorder as serious.

They do not, however, establish that the deployment was connected to the Spanish jihadist warning. The French security preparations were also a response to the violence that had already occurred.

A review of the publicly available official statements examined for this report did not identify a French government acknowledgment that Spain’s OCC alert had been received.

That leaves an important question unresolved: whether the French authorities had already obtained the warning through intelligence-sharing arrangements, or whether awareness of the Spanish findings developed through another channel.

Italy Had Just Agreed to Strengthen Security Information Sharing With Spain

Italy presents an additional issue because its government announced a relevant security-cooperation agreement with Spain immediately before the jihadist warning became public.

On 22 October, Italian Interior Minister Matteo Piantedosi and Spanish Interior Minister Fernando Grande-Marlaska held a telephone conversation concerning security arrangements and the Schengen area.

According to an official statement from Italy’s Interior Ministry, the ministers agreed that existing temporary Schengen suspensions would not be extended and that information exchanges would be strengthened to safeguard security within the common travel area.

The announcement demonstrates an existing ministerial channel for cooperation between the two governments.

However, it was issued on 22 October and does not establish that the subsequent OCC jihadist warning was transmitted to Italian authorities.

Italy was already increasing security preparations following serious disturbances in Milan and other cities. Authorities were deploying additional police and military personnel, protecting commercial areas and monitoring calls for further demonstrations.

These measures demonstrate concern about public disorder, but they cannot independently verify Italy’s receipt of the Spanish counterterrorism alert.

No specific acknowledgment from the Italian Interior Ministry confirming receipt of the OCC warning has been identified in the official material examined.

European Security Systems Allow Cross-Border Intelligence Sharing

The four countries identified in the warning are members of the European Union and participate in established mechanisms for police and security cooperation.

Directive (EU) 2023/977 establishes rules governing information exchanges between law enforcement authorities in EU member states.

The framework provides for national single points of contact and the exchange of information required to prevent, detect and investigate criminal offences.

Europol also operates the Secure Information Exchange Network Application, known as SIENA, which enables authorised authorities to exchange sensitive law enforcement information.

These mechanisms demonstrate that channels exist through which a warning discovered by Spanish authorities could be shared with security services in France, Italy and Portugal.

But the existence of those channels is not evidence that a particular warning was transmitted.

To establish what happened in this case, investigators would need confirmation of a communication, its date, the issuing authority, the receiving organisation and the type of information shared.

Public disclosure of the contents of intelligence communications may be restricted for operational reasons. Nevertheless, authorities can sometimes confirm whether a warning was received without revealing classified details.

What Was the Actual Level of Threat?

The warning should be understood in the context of the distinction between extremist propaganda and an identified terrorist operation.

The Spanish document described calls for violence published on a website sympathetic to Islamic State. It did not publicly identify an operational cell, named suspects preparing an attack, an agreed date or a specific location selected for an imminent operation.

Counterterrorism specialists consulted in Spanish reporting cautioned that extremist propaganda frequently attempts to exploit major public events and social unrest.

Such messages may be intended to inspire individuals to act, generate fear or encourage violence without direct operational control from an organised terrorist group.

This does not make the content harmless. Public incitement can present a security concern, particularly where vulnerable or radicalised individuals may act without direct contact with a terrorist organisation.

However, describing a general online incitement as an established terrorist plot would go beyond the available evidence.

The distinction also matters when considering the wider European disturbances. The detection of jihadist messages seeking to exploit demonstrations does not establish that the demonstrations themselves were organised by jihadist networks.

Indeed, the proposed targets included demonstrators as well as police, indicating that the extremists regarded the public gatherings as opportunities for attacks rather than necessarily as events under their control.

The Unanswered Questions for Four European Governments

Spain’s investigation has established that extremist messages advocating attacks were detected and that an internal security alert was issued.

Portugal has publicly confirmed awareness and monitoring of the threat.

The missing evidence concerns the international circulation of the warning, particularly to France and Italy.

Several questions now require answers from the authorities responsible for counterterrorism coordination.

Did Spain send an official notification to France, Italy and Portugal following the OCC alert? If so, when was each notification transmitted, through which security channel, and to which receiving authority?

Did the warning result in additional protective measures, or was it assessed as already covered by existing national counterterrorism arrangements?

Was Europol informed, and did any joint assessment follow?

Have investigators subsequently identified particular suspects, operational preparations or further communications that materially alter the original assessment?

These questions concern the effectiveness of international security coordination, not simply the existence of threatening messages on the internet.

What Is Established as of 25 October 2026

The available evidence establishes that Spain’s Office of Cybersecurity Coordination detected jihadist incitement against police and demonstrators in four European countries and produced an internal alert that was circulated within Spain.

Portugal’s Internal Security System publicly acknowledged the matter and confirmed that it was being monitored in coordination with relevant authorities.

France and Italy were identified in the extremist messages, but no publicly verified record has been established demonstrating whether either country’s security authorities received a formal notification of Spain’s specific warning.

The incident does not, on the evidence currently available, establish an imminent terrorist attack, a coordinated jihadist organisation behind the European riots or a failure by any government to share information.

It does establish a security warning involving four countries and a consequential gap in the public record concerning how that warning was communicated internationally.

Until the relevant authorities clarify the communication chain, the distinction between countries named in the threat and countries confirmed to have received it remains unresolved.