There is a number that summarises the 2026 World Cup better than any speech about the festival of football. One hundred and eighty thousand people. Sixty thousand military personnel, one hundred thousand police officers at every level, twenty thousand private security staff, in the United States alone. That is more armed and uniformed people than there are inhabitants in a mid-sized Spanish city, deployed to watch over those who have come to see balls roll. And the figure that accompanies it, one point six billion dollars between federal funds and FIFA's contribution, lays bare what the modern football business is really buying. Not emotion. Peace of mind.
The thesis is uncomfortable for anyone who still believes a World Cup is played on the pitch. The main product of the 2026 tournament is not the sporting spectacle; it is the promise that forty-eight national teams, one hundred and four matches, sixteen cities and millions of visitors will pass without a single thing going wrong. FIFA does not sell goals. It sells the absence of news. And the most perverse part of the whole arrangement is that the success of this entire machinery is measured by its invisibility. If it works, you never find out. If you find out, it failed.
That is why making nothing seem to exist costs so much. One point six billion dollars so that a fan can walk into a stadium, pass through a biometric scanner, show a digital ticket with a unique QR code, cross a perimeter cordon fitted with explosive detectors and believe they are simply queuing for a beer. Recent editions moved security budgets in roughly comparable orders of magnitude, but 2026 surpasses them by a wide margin, and the reason is not that the world has become more dangerous. It is that there are now three countries, three bureaucracies, three borders and a logistical choreography that requires coordinating the Canadian RCMP, the FBI, the National Guard, Mexico's Sedena and its Plan Kukulcan with its weekly drills and its one hundred and forty mapped risks, from drones to disinformation campaigns.
Here is the tension nobody wants to look at directly. All of this architecture exists to ward off a threat that has historically almost never materialised. In recent editions there has not been a single successful attack inside a stadium. Not one. The most cited case, Kampala in July 2010, with dozens of dead, took place in Uganda, at an improvised screen set up to watch the South Africa final, thousands of kilometres from any official venue. Al-Shabaab hit a bar, not a stadium. And that is precisely the evidence that the money is spent where the risk is not, while the real risk lurks in the margins that nobody fully controls.
The figures tell the story better than any press release. The United States provided federal funds through FEMA, and FIFA matched that commitment with an equivalent contribution. A large share goes on counter-drone technology, with FEMA allocations spread among the host states, also earmarked for drones. Canada, more discreet, reinforced Toronto with cameras and personnel for a fraction of that outlay. Mexico does not publish a single budget figure, but twenty agencies working simultaneously do not come cheap, and thousands of officers were trained in crowd and protest management. Because the lesson left by Brazil, where investment in non-lethal weapons was made in anticipation of protests, is that the discontent of a country's own people is as frightening as imported terrorism.
The digital front is where the investment becomes less photogenic and more revealing. Qatar 2022 left a quiet scare. Analysts detected a compromised router that could have cut transmissions. Paris 2024 absorbed a wave of cyberattacks without serious consequences, all neutralised by prior preparation. For 2026, cybersecurity operations centres are being set up to run around the clock, regular pentests are planned on venue infrastructure, end-to-end encryption will be applied to official apps, and redundant servers will guard against DDoS attacks on the ticketing system. The ticketing system is one hundred per cent digital and verified, shielded against bots and fraudulent markets. A veteran of the Secret Service puts it with professional bluntness. Physical attacks have become difficult, but vulnerability now comes through remote access. The enemy no longer climbs a fence. They slip through an open port.
It is worth acknowledging the strongest objection before someone else raises it. Perhaps the risk is not inherently low; perhaps it is low precisely because this enormous sum is spent. Deterrence works because it is visible, and the invisible thing that truly matters is what never happened because of it. This is the classic argument of every security industry, the umbrella that justifies its price because it is not raining. And it has a point. Coordinating a strike across three countries simultaneously demands a logistical effort that discourages almost anyone; attackers tend to be lone wolves with no military training who give themselves away on social media before carrying anything out; and the high visibility of the event turns any suspicious movement into an immediate alert. A DHS commander closed the matter without embellishment. They believe they are as safe as it is possible to be. Which is another way of admitting that absolute security does not exist and that what is being purchased is a probability, not a guarantee.
But honesty requires pointing to the blind spot. All of this force is concentrated in the heavily surveilled spaces, the official venues, the main transport corridors. The so-called soft targets, the outdoor queues, the improvised fan fests, the bars where people gather without a scanner or a cordon, are by definition less protected. The DHS acknowledged this and ordered extra patrols to project strength around the venues. The problem is that strength is visible where there are cameras, and Kampala showed that horror prefers places without floodlights. The paradox of the most robust security apparatus in football history is that its very strength draws, by contrast, a precise map of exactly where the flank lies.
The most expensive match of 2026 will not be played by any national team. It will be played by one hundred and eighty thousand people so that you do not notice they are playing it, and they will only win if, when the tournament ends, nobody remembers they were there.
