The CENIF attributes the massive entry of migrants in Ceuta to a planned campaign on social networks

The report delivered last Monday to the National Court by the National Center for Immigration and Borders (CENIF) maintains that the massive entry of migrants into Ceuta on July 30 and 31 was planned long before tens of thousands of people crossed through the Tarajal breakwater on those days. It was on social networks, where several days before a dissemination campaign began that gained intensity until it skyrocketed in the hours immediately before the migration crisis.

The CENIF points out in its report that the viralization of the call to reach the Moroccan town of Castillejos and swim across to Spanish territory was not something spontaneous, but rather responded to a previously designed methodology and that, due to its complexity, required "a predetermined intention, the use of automation tools of a certain complexity and the intervention of content experts" to achieve massive dissemination of the call to cross.

"We are not facing a spontaneous or accidental event," the report points out in its conclusions, which sees in the massive dissemination of the call on social networks a strategy planned in several phases of preparation, activation, execution and subsequent "whitewashing." To achieve this, "a very high technical and planning level" and the intervention of different structures with a high degree of coordination, a shared objective and a "single organizational reference" were necessary. "A high level of specialization that is not within the reach of any criminal structure known to the Police in that area," the document highlights.

For the CENIF, the evolution of the diffusion and the pattern of viralization rule out that it is a disorderly succession of messages, but rather that it follows "a pre-established pattern" compatible with the SPREAD model, a method of designing viral content that implies that high level of specialization that the Police aims for, and that would have played a key role in the concentration of more than 70,000 people at the Tarajal breakwater on July 30 and 31.

The SPREAD model to generate viral messages

The SPREAD model, developed by Associate Professor of Marketing at INSEAD, David Dubois, and published by Harvard Business Review in May 2025, is a framework that designs content on social networks to analyze and multiply the chances of it going viral. It is not an automatic model: SPREAD consists of designing content that is likely to be disseminated massively and spontaneously by the users themselves.

Its acronym identifies six traits: "Socially useful and sensitive; Provocative; Replicable (susceptible to being shared); Emotional; Ambiguous; Distributive (designed to be compatible with all types of networks, formats and audiences)." In his thesis, Professor Dubois conceived the model as a series of patterns so that content has certain characteristics that exponentially increase the probability of it being forwarded.

The CENIF reflects in its report that the messages of the call change as the process progresses: first they generate interest in open networks; later more specific messages appear in closed groups; During entry, urgent calls related to the situation at the border are broadcast and, once the crossing has occurred, instructions are circulated aimed at those who are already in Ceuta. In these characteristics, the Police identify "requirements and principles established in the SPREAD framework."

A "hardly" spontaneous campaign

"The improvised, automatic and/or involuntary emergence of a media campaign of this scope is something that is difficult to accept due to the accumulation of concurrent coincidences that would be necessary for it to be successful. That is why, once comparatively analyzed, such a precise adjustment to a pre-established method draws a lot of attention," maintains the report, which emphasizes that "the design of a campaign of these characteristics" requires "predetermined intention, automation tools of a certain complexity and the intervention of experts" in media dissemination. contents.

Likewise, the report points out "concurrent push factors" on which the media campaign was built. Factors that, "without being essential or the cause of the mobilization, contribute to it by giving strength to the multiplier effect of the message", presenting and encouraging the perception that there was "a unique opportunity" to cross the border.

For the CENIF, these factors are the ruling of the Supreme Court on the swimming entries (whose manipulation and distortion are used to "reinforce" the message), the coincidence in time with the Throne Day Festival (which adds the idea of ​​an unprotected border to integrate the security device of Mohamed VI in Tetouan) and the "incidence of the extraordinary regularization process" (whose distortion contributes to the viral call to enter Ceuta).

From the viral call to "operational coordination"

Thus, the CENIF reconstructs a campaign that gained intensity as July 30 approached. In the first phase, the call circulated through open networks such as Facebook, Instagram or TikTok with direct messages that encouraged participation, asked about possible entry routes or called to share the appeals.

The dynamic changed on the 29th and 30th, when much of the conversation moved to closed WhatsApp groups. There, "operational coordination" messages appeared, with indications about movements, advances in small groups or channels that should be avoided because they were monitored. Once the entry began, the messages multiplied again on different platforms with real-time information about the situation at the border and calls to take advantage of any opportunity to cross. Later, advice was also circulated for those who had already reached Ceuta and wanted to avoid a return.

The evolution of digital traffic is one of CENIF's main arguments to suspect a campaign planned on a professional scale. After a first activation phase between July 24 and 28, activity skyrocketed in the days immediately preceding the entry: 344 messages were recorded on the 28th, 1,341 on the 29th and 1,974 on July 30, 3,363.1% more than the daily maximum prior to the 28th. On the 31st there were another 1,527 messages and on August 1, 1,403. before the conversation quickly descended.

The report also identifies phones present in various groups and profiles that acted as "message drivers" or "speakers" between different conversations. 90.8% of the numbers analyzed had a Moroccan prefix, although the Police warn that they could not identify the majority of their owners as they were foreign lines.

Possible "laundering" with the frustrated assault on August 15

A few days after the crisis, the Spanish authorities warned of a new online campaign to cross into Ceuta on August 15. Based on the actions of that day, the CENIF report contrasts them with those of July 30 and 31 to reinforce its suspicions about Morocco's actions during the mass entry. In those days, the CENIF appreciated a "scant presence" of the Moroccan security forces and went so far as to attribute to them "active guidance" of the masses towards the crossing points. It also identifies alleged plainclothes agents with "control, leadership and direction" functions and even giving instructions to uniformed personnel.

Two weeks later, faced with the new call on August 15, the response was radically different: the call on social networks was much more detectable and the Moroccan authorities deployed a device that prevented the crossing. The CENIF considers that this second viral call could have been "artificially more detectable" and goes so far as to suggest that the subsequent operation would have served to "'whitewash' the previous management" of the Moroccan Forces.

That is to say, the Police contrast in the document the effectiveness shown by the Moroccan Security Forces then with what it considers passivity due to the "scant presence" of troops - and even describes the "active guidance" of migrants towards places of passage - that it sees in the events of July 30 and 31.

A strategy designed to "hide authorship"

All the ingredients lead CENIF to reflect in its conclusions that the massive viralization campaign "is neither spontaneous nor accidental", is designed to "hide authorship", "requires a very high level of technical and planning" and needs "the intervention of different structures with a high level of coordination."

All of these ingredients, the report maintains, require "a high capacity for influence on social networks, between people linked to the Moroccan security forces and between individuals or institutions with the necessary capacity and experience to be part of the planning level of the process."