A network of forums and chats spread the message of the jump to Ceuta among 1.5 million people

A human tsunami arrived on July 30 at El Tarajal beach in Ceuta, leaving thousands of clothing items, flip-flops, and personal belongings, but also a huge political crisis that is gnawing at Pedro Sánchez’s government, and a question that no one has answered so far: where and how does the wave start?

Read more Burn the ships in Morocco

Exactly one month earlier, a Supreme Court (TS) ruling establishes that an immigrant detained after irregularly crossing the border can only be returned immediately if they have proactively avoided physical barriers, but not if they arrive by swimming; in this case, a procedure with a lawyer, interpreter, and legal guarantees must be opened.

The ruling, dated June 29, is not made public until July 8 when the TS explains it in a press release, which is soon echoed by the newspaper El Faro de Ceuta : “The Supreme Court confirms it: the law does not allow hot returns of immigrants at sea.”

It is 13:01 hours. The Facebook version of El Faro has 149 reactions, 106 comments, and is shared 21 times. At 19:15, the Moroccan newspaper TelQuel replicates the information. It receives 11,297 “likes.” Readers’ comments encourage going to Spain. Some suggest doing it during Spain’s next World Cup match, on July 10, against Belgium, to take advantage of a possible relaxation of border forces.

The message is simplified: if you enter by sea, you are inside. The earth has started to shake. And the sea. Three weeks later, about 72,000 people will enter Ceuta by swimming. At least 141 drown in the attempt.

Although most who cross the border will voluntarily return to Morocco in the following hours, several thousand remain there, becoming a huge problem and Twitter fodder for the international far-right and an enigma: was it Morocco itself that stimulated the avalanche to highlight the Moroccan identity of the plaza? Was it stirred up by Russia or Israel, as Pedro Sánchez or his Foreign Minister, José Manuel Albares, or even his Ukrainian counterpart, Andri Sibiga, have suggested? Or was it only exploited afterward, in favor of the far-right anti-immigration discourse?

On July 31, the owner of X, Elon Musk (with 218 million followers), posts a tweet under images from the dystopian movie World War Z , exclaiming: “Wow, the situation in Spain looks crazy!”. Donald Trump will also take the opportunity to attack Spain.

Five analyses – police and social media experts – agree in highlighting how the illegal immigration business, always active in this part of the Maghreb, receives extra fuel from July 8. Facebook, Instagram, TikTok, Telegram, and WhatsApp nodes carry the message of “open doors,” or “open beach,” to hundreds of thousands of people.

The report prepared for the investigation opened in the National Court by the National Immigration and Borders Center (Cenif) of the Police is categorical: social networks have been “an element of extraordinary relevance” and clearly show “the importance of the actions of certain profiles and phone numbers that play a decisive role in the massive dissemination of key messages.”

The Spanish police, infiltrated in some groups, detect between July 24 and 28 a “sudden increase” in messages urging people to approach Castillejos (Fnideq in Arabic) to jump to Ceuta. The agency alerts Madrid of movements in the area on the 27th.

Between July 29 and August 1, messages grow by 3,363%. The massive entry is on the 30th, but the same networks are inviting another jump on August 15.

The conversation starts in open Facebook, Instagram, and TikTok groups with encouraging messages, data exchange, and calls to go to Ceuta. As interest grows, activity migrates to closed WhatsApp groups where more precise operational instructions appear. Among other things, they know they are being watched.

Police investigators identify administrators and users present in several groups, acting as diffusion nodes. More than 90% of the phone numbers analyzed are Moroccan. The rest are a rosary of 28 different countries.

For Cenif, the mobilization of between 75,000 and 85,000 people cannot be explained solely by chance or the spontaneous spread of rumors.

The report speaks of a “viralization design process” aimed at reducing dependence on random factors and emphasizes that moving such a number of people without blockages on access routes or public order incidents is “incompatible” with a spontaneous movement.

The consulting firm Golden Owl, specializing in digital traffic analysis, agrees with this diagnosis: the massive entry to Ceuta “was not a spontaneous event” but “a coordinated, pre-constructed, and publicized operation” that pursued a purpose.

Read more Eurofighters take off

For this, there was “a closed coordination core” that connected with diffusion groups on Facebook with more than 1.5 million members. The campaign was organized “horizontally, not hierarchically” and used a brand and a market, with coded vocabulary, visual identity, and shared slogans. Thanks to these factors, it “reached the scale it reached” and was also resilient to arrests and possible content removals.

This Alicante-based consultancy identified “a small set of administrators and recruiters.” Among them, they point to a native of Casablanca, residing in Istanbul, who offered a Turkish WhatsApp number (revealed by the +90 prefix). Also, an operator of two accounts built entirely around the hashtag “haragaceuta” – referring to the “burning” of documentation so you cannot be returned – which was used those days as a key for the jump. And another from the Tetouan area pushing identical content to three groups of 50,000 members.

Algerian markers are also detected. Golden Owl and Moroccan engineer and data analyst Marouane Lamharzi locate (by the use of a phone with the +213 prefix) that a month before the assault, an Algerian network, under the hashtags korob_haraga and Haraqa Spain, offers a trip to Spain in a boat with an engine of 600 to 900 horsepower, with payment to be made at the destination. According to this analysis, it is a sign of how the migration market is always active but also how the July outbreak takes advantage of its terminology and networks.

Golden Owl discovers nodes in northern Moroccan cities such as Casablanca, Khouribga, Tangier, Tetouan/Azla, Beni Chiker, Nador, and Agadir, but also sees signs of operators in Madrid or Rome.

The massive entry relied on a pre-existing digital infrastructure and not on a network created specifically, concludes a report prepared for La Vanguardia by the consultancy Cibergy, led by Àlex Lozano, digital research professor at the Escola de Prevenció i Seguretat Integral de la UAB. The analysis identifies 23 Facebook groups, which gather 1.7 million members, and which have been used since at least August 2024 to exchange data on migration routes and access to Ceuta.

According to the study, the first unequivocal references to the autonomous city appeared on July 13, 18 days before the events. An evolution is observed from generic messages about migration to content with practical indications for those intending to cross.

Investigators point to two profiles as especially relevant in the previous phase: Al Hajj Mohamed and Simo França, the only ones who acted as a bridge between several groups before July 30.

Both connected exactly the same communities, which points to possible routes of information transmission, although the report emphasizes that there is no evidence of centralized coordination. Simo França is the user who mentions Ceuta the most times in July, with six references before the day of the avalanche, and changes groups just after an intense batch of posts.

Cibergy detected 54 cases of the same text published in different groups, in some cases with just seconds of difference. However, these systematic republications occurred after July 31, so they did not serve to organize the action.

Were bots used to amplify the message? The study identifies 52 accounts linked to the Tetouan Tube channel created in a short period, with similar names or identifiers, little own activity, and an almost exclusive dedication to sharing or amplifying third-party posts related to migration, indicators that they are not real users.

However, the consultancy maintains a cautious position. It talks about possible dynamics of “inauthentic diffusion,” but does not claim these accounts are bots nor attribute their management to a specific organization. It also emphasizes that most of these signs appear after July 31, so they cannot be used alone to prove the existence of an organized campaign before the massive entry.

Network and security expert Marcelino Madrigal has not found signs of prior preparation comparable to what he does detect for the later call on August 15. “On the 15th, they had very clearly indicated that something was going to be prepared. But on the 30th, no,” he summarizes. His reading is that the July 31 crisis was the result of the confluence of several factors: the ruling, the contagion effect, the very volume of people already gathered in the area; more than the outcome of a plan. He compares it to the phenomenon of a false supermarket offer that goes viral and causes a crowd.

Madrigal is documenting hostile narratives to Spanish foreign policy in Russian and Israeli media and considers it plausible that these actors “take advantage of the situation” to destabilize the Spanish Government, given what represents “a very large window of opportunity.” But he is careful to distinguish this from the organization of the assault: for Madrigal, this dimension of state disinformation operates as amplification after the fact, not as its origin.

The main problem, he adds, is that the difficulty in detecting signals on networks prevents anticipating measures that, in this case, would have saved lives: “Disinformation kills. There have been 140 people who reached Castillejos beach and drowned, and that was due to disinformation.”