The attack
At the height of the morning rush on 11 March 2004, ten bombs exploded on four commuter trains converging on Madrid's Atocha station. One hundred and ninety-one people died that day; the toll reached 193 with a victim who died in 2014 after ten years in a coma. Around two and a half thousand were injured. It remains the deadliest attack in modern Spanish history.
Spain was three days from a general election.

The memorial at Atocha to the 193 people killed on 11 March 2004. Wikimedia Commons — Felipe Gabaldón, CC BY 2.0
Three days
Within hours, Interior Minister Ángel Acebes told the country there was no doubt that ETA, the Basque separatist organisation, was responsible. The government repeated the attribution through diplomatic channels and pressed for a United Nations Security Council statement naming ETA, and held to it publicly.
The investigation was moving in another direction almost immediately. A van near the Alcalá de Henares station yielded detonators and a cassette of Qur'anic recitation. An unexploded device recovered from a train contained a mobile phone whose SIM card led investigators to a shop in Lavapiés. By 13 March there had been arrests, and they were not of Basque separatists.
On 14 March the country voted. The Socialists, who had opposed Spanish participation in Iraq, won by about five points, reversing a Popular Party lead of roughly the same size. Something like a million voters moved.
What the courts found
On 3 April 2004, police surrounded a flat at Leganés where suspects had been traced. The men inside detonated explosives rather than surrender, killing themselves and a police officer and wounding eleven. Several other suspects were not in the flat.
The trial concluded in October 2007. Twenty-eight defendants, twenty-one convicted on charges ranging from forgery to murder; two received nominal sentences running past forty thousand years, against a Spanish cap of forty years actually served.
Two findings from that judgment matter here, and they cut in different directions.
The court found no evidence linking ETA to the bombings. The government's three-day attribution was simply wrong.
The court also rejected the claim that al-Qaeda had directed the attack, or that there was an external mastermind. What it found was a local cell — radicalised in Spain, using stolen explosives obtained domestically, acting without a chain of command reaching outside the country.
The two theories, and why only one is interesting
The version that circulates most widely is that the attack was arranged or permitted to change the election, usually with the Socialists or a foreign hand as beneficiary. There is nothing behind it. Twenty-one convictions, a cell traced from physical evidence within forty-eight hours, and four of its members dead by their own explosives in Leganés do not describe a staged event.
The version that is supported is smaller and more uncomfortable, and it does not require anyone to have planned anything. A government three days from an election was told by its own investigators that the evidence pointed away from ETA, and continued to say ETA publicly for three days — because ETA was the attribution that suited it, and an Islamist attack would have been read as a consequence of the Iraq deployment it had carried against overwhelming public opposition.
That is not a conspiracy to commit an atrocity. It is a government handling an atrocity in the way that served it, during the three days when handling it was worth the most.
What it cost
Analysts broadly agree that it was the handling rather than the bombing that moved the vote. An electorate that watched its government insist on an attribution the evening news was steadily dismantling did not punish it for failing to prevent the attack. It punished it for the three days.
That is the durable lesson of the case, and it is the opposite of the usual one. The thing that brought down a government was not a secret. It was a public insistence, maintained slightly too long, in front of everybody.