Portugal's intelligence services were kept in the dark about documented terrorist threats from a neo-Nazi cell targeting the country's highest political leaders—a breakdown in institutional communication that has sparked questions about inter-agency coordination and the protection of public figures under threat.
Neither the Portuguese Security Intelligence Service (SIS) nor the Strategic Defense Intelligence Service (SIED) received information about the Armilar Lusitano Movement (MAL), a supremacist group that compiled a list of more than 170 individuals for potential attack, including Prime Minister Luís Montenegro and former President Marcelo Rebelo de Sousa. The lapse meant no security assessment was conducted and no protective measures were implemented for those named.
The case has exposed a critical gap in how Portugal's anti-terrorism apparatus functions—and raised uncomfortable questions about whether established protocols were followed when the stakes were highest.
Why This Matters
• No warning issued: Despite discovering detailed attack plans in late 2025, neither the Judicial Police (PJ) nor the Public Prosecutor's Office (MP) shared intelligence with the Anti-Terrorism Coordination Unit (UCAT), the body created specifically to coordinate responses to terrorist threats.
• Victims learned from media: Prime Minister Montenegro and others on the target list first learned of the threats through news reports, not official channels.
• Accountability unclear: Both the PJ and MP have refused to confirm whether they shared the information with UCAT, while the Portuguese Intelligence System (SIRP) stated categorically that nothing was communicated.
The Information That Never Traveled
The Armilar Lusitano Movement—a neo-Nazi organization formed in September 2019 from earlier extremist cells—was under investigation by the Judicial Police since 2021. The group's ideology centers on white supremacism, fascism, and nationalist rhetoric, and its members explicitly sought to subvert Portugal's democratic regime through violence.
In June 2025, the PJ arrested six suspects tied to the MAL in coordinated raids. Investigators seized 8 terabytes of digital evidence, including encrypted communications, weapons designs, and operational plans. But the scale of the conspiracy only became clear months later, after forensic analysts completed their painstaking review of the data in late 2025.
What they found was chilling: a "List of Undesirables" containing the names of over 170 individuals—politicians, journalists, academics, activists, and artists—whom the group deemed threats to their vision of Portugal. Also listed were 89 institutions and civic organizations associated with immigration support, anti-racism, anti-fascism, and minority rights.
Among the specific plots uncovered was a plan to attack Prime Minister Montenegro's Lisbon residence with a grenade. One of the arrested men, a PSP (Public Security Police) officer seconded to the Lisbon Municipal Police, allegedly accessed confidential databases to obtain the Prime Minister's home address and security details. The PSP National Director later described the involvement of a serving police officer as a "grave and exceptional" breach.
The group had also acquired and manufactured weapons, some using 3D printing technology—a first in Portugal, according to investigators. Explosives and firearms were seized during the June 2025 raids.
The UCAT Silence
The Anti-Terrorism Coordination Unit exists precisely to prevent scenarios like this. Established under Decree-Law 2/2016 and operating within the framework of Portugal's Internal Security Law (Law 53/2008), UCAT is the central hub for sharing intelligence on terrorist threats among all relevant state bodies: the Judicial Police, the Security Intelligence Service, the Public Security Police (PSP), the Republican National Guard (GNR), and representatives from the Public Prosecutor's Office.
Yet according to an official statement from SIRP, which oversees Portugal's intelligence services, "no information was shared in UCAT meetings" regarding the MAL threats. SIRP added that "any situation shared with SIS requiring urgent threat assessment is responded to immediately"—a pointed reminder that the system works only when information is fed into it.
Both the Judicial Police and the Public Prosecutor's Office have declined to say whether they communicated the findings to UCAT, citing ongoing judicial proceedings.
Political Fallout and Institutional Accountability
Prime Minister Luís Montenegro learned of the plot against him while attending a European Council meeting on a Friday in mid-June. He was, by his own account, "completely surprised" and expressed frustration that his family—his wife and children—discovered the threat through media reports rather than official briefings.
"It is extremely delicate that my family received this news in such a surprising way," Montenegro said in remarks to journalists. "A matter that puts at risk the security of a citizen—in this case the Prime Minister and his family, but it could apply to any Portuguese person—should have been shared with those directly concerned."
The Minister of Internal Administration, Luís Neves, who previously led the Judicial Police during the period when the intelligence was uncovered, acknowledged "there was a failure" in communication. Speaking at a PSD (Social Democratic Party) congress in Anadia, Neves told RTP that "communication could and should have been different because, in matters of State, it makes no sense for people to be informed through the media."
Justice Minister Rita Alarcão Júdice confirmed she had held discussions with both the Public Prosecutor's Office and the Judicial Police and said a "reflection" was underway to ensure such lapses do not recur. She emphasized the importance of information-sharing protocols between entities responsible for national security.
Meanwhile, Miguel Poiares Maduro, a prominent legal scholar and former government minister, acknowledged the success of the investigation in dismantling the MAL but criticized the failure to notify victims. "What makes no sense is that the list became public knowledge through newspapers without people first knowing they were on it," Maduro told Rádio Renascença. "I think it's a failure, and it's a significant one."
The Prosecutor's Defense
The Office of the Prosecutor-General (PGR) issued its own statement, arguing that investigators only learned of the target list "at an advanced stage of the proceedings" during the "very extensive and time-consuming analysis of 8 terabytes of digital evidence seized from the accused."
According to the PGR, by the time the list was discovered, the main suspects were already in preventive detention, meaning "no concrete danger existed for any of the entities" named. The implication: there was no urgency to alert potential targets because the immediate threat had been neutralized.
Critics, however, argue that this logic misses the point. Even if the primary suspects were behind bars, the existence of such a list—and the group's demonstrated capacity to recruit, procure weapons, and plan attacks—warranted immediate communication to intelligence services and to those named.
The Legal Process Moves Forward
In June 2026, the Public Prosecutor's Office formally accused nine individuals linked to the Armilar Lusitano Movement of 29 crimes, including charges related to founding, leading, and joining a terrorist organization; terrorist offenses involving weapons, munitions, and explosives; recruitment for terrorist activities; incitement to terrorism; terrorism financing; illegal weapons trafficking; and abuse of power.
The charges detail that the accused "identified people and entities they classified as 'targets' and saw as a 'threat' to the country," collecting detailed intelligence on political officeholders, civic movements, journalists, commentators, academics, artists, and activists associated with causes such as immigration, anti-racism, anti-fascism, diversity, social inclusion, and minority rights.
For years, the group attempted to "gather human, material, financial, and logistical resources for future actions against these targets and the State, using weapons." The attacks were never carried out because the accused believed they lacked the necessary means or that "the moment for those actions had not yet arrived," according to the DCIAP (Central Department of Criminal Investigation and Prosecution).
Four of the accused remain in preventive detention. One defendant was recently released after the court determined that "cautionary requirements had diminished" and his procedural status was now equivalent to another accused who had been free throughout.
The case now enters the instructional debate phase, where a judge will evaluate whether sufficient evidence exists to proceed to trial.
What This Means for Residents
For anyone living in Portugal, this case highlights vulnerabilities in how the state responds to domestic extremism. The UCAT framework is sound on paper—but it depends entirely on voluntary information-sharing by entities that may have conflicting priorities, legal constraints, or institutional rivalries.
International precedent offers cautionary lessons. The European Court of Human Rights has ruled against states—most notably Russia following the Beslan school massacre in 2004—for failing to warn potential victims despite possessing "sufficiently precise information indicating that a terrorist attack was planned." In that case, the court found that neither school staff nor the public were warned, contributing to the tragedy.
While Portugal has robust victim compensation mechanisms—and EU frameworks increasingly mandate support for terrorism victims—the principle that citizens have a right to be warned of documented threats remains a gray area in Portuguese law.
The debate over when and how to inform potential targets is complex. Premature disclosure can compromise ongoing investigations, tip off suspects, or cause public panic. But as this case demonstrates, complete silence until the threat is public knowledge erodes trust and leaves individuals unable to take even basic precautionary measures.
Broader Security Landscape
The MAL case unfolds against a backdrop of heightened vigilance across Portugal. Just this week, authorities have dealt with a range of serious incidents, though unrelated to terrorism:
• A pre-dawn shooting in Rio de Mouro, Sintra left two men wounded early Tuesday; the Judicial Police are investigating.
• In Oeiras, a 28-year-old man was detained after police discovered a 28-centimeter knife in his backpack—16 centimeters of blade—which he claimed to carry "daily for personal defense." He was found to be in Portugal illegally, with residency documents expired since 2021.
• A 34-year-old man in Moura was arrested and placed in preventive detention for 17 crimes, most involving extortion attempts, along with robbery, assault, and possession of a prohibited weapon.
• In Vila do Conde, four suspects aged 23 to 44 were arrested for robbery, kidnapping, and drug trafficking, with police seizing €29,170 in cash, a firearm, and narcotics.
These cases underscore the daily pressures on Portugal's law enforcement and judicial system—pressures that make effective coordination all the more essential when existential threats like terrorism emerge.
A System Under Scrutiny
The Armilar Lusitano Movement has been dismantled. Its members face serious charges. The investigation, by most accounts, was thorough and ultimately successful. But the failure to alert those who were in the crosshairs—and the reluctance of key institutions to explain why—has left a troubling gap in public confidence.
As the case moves toward trial, the instructional debate beginning today at the Criminal Court of Monsanto will determine whether the evidence supports the terrorism charges. Legal experts have noted that the Public Prosecutor's Office "set the bar extremely high" by framing the charges around terrorism statutes, which carry prison sentences of 8 to 15 years but require proof of intent to subvert the state through violence.
What remains unresolved, however, is whether Portugal's security architecture will be reformed to ensure that when investigators uncover a list of assassination targets, the people on that list—and the agencies tasked with protecting them—are told before the evening news does it for them.
