A human tsunami arrived on July 30 at El Tarajal beach, in Ceuta, and left behind thousands of articles of clothing, flip-flops and personal belongings, but also a gigantic political crisis, which is eating away at Pedro Sánchez's government, and a question that for now no one has answered: where and how does the wave start?
Exactly one month earlier, a ruling from the Supreme Court (TS) established that an immigrant detained after irregularly crossing the border can only be returned immediately if he has proactively evaded the physical barriers, but not if he arrives by swimming; In this case, a procedure must be opened with a lawyer, interpreter and legal guarantees.
The resolution, dated June 29, was not made public until July 8 when the Supreme Court explained it in a press release, which was soon echoed by the newspaper El Faro de Ceuta: “The Supreme Court confirms it: the law does not allow immediate returns of immigrants at sea.”
It's 1:01 p.m. The Facebook version of El Faro has 149 reactions, 106 comments and is shared 21 times. At 7:15 p.m., the Moroccan newspaper TelQuel replicates the information. It receives 11,297 “likes.” Readers' comments encourage you to go to Spain. Some propose doing so during Spain's next World Cup match, on July 10, against Belgium, to take advantage of a possible relaxation of border forces.
The message is becoming simpler: if you enter by sea you are in. The earth has begun to shake. And the sea. Three weeks later, some 72,000 people will swim into Ceuta. At least 141 drown in the attempt.
Although the majority of those who cross the border will voluntarily return to Morocco in the following hours, several thousand remain there, becoming a huge problem and tweet fodder for the international ultra and a mystery: has it been Morocco itself that has stimulated the avalanche to visualize the Moroccanness of the square? Have Russia or Israel excited her, as Pedro Sánchez or his Foreign Minister, José Manuel Albares, or even his Ukrainian counterpart, Andri Sibiga, have suggested? Or have they only taken advantage of it after the fact, in favor of the anti-immigration discourse of the extreme right?
On July 31, the owner of Donald Trump will also take the opportunity to attack Spain.
Five analyzes – police and network experts – agree in highlighting how the illegal immigration business, always active in this part of the Maghreb, receives extra fuel starting July 8. Facebook, Instagram, TikTok, Telegram and WhatsApp nodes carry the message of “open doors”, or “open beach”, to hundreds of thousands of people.
The report prepared for the investigation opened in the National Court by the National Center for Immigration and Borders (Cenif) of the Police is categorical: the networks have been "an element of extraordinary relevance" and show "clearly the significance of the actions of certain profiles and telephone numbers that intervene decisively in the massive dissemination of key messages."
The Spanish police, infiltrated in some groups, detected between July 24 and 28 a “sudden increase” in messages urging people to approach Castillejos (Fnideq in Arabic) to jump to Ceuta. The agency alerts Madrid of movements in the area on the 27th.
Between August 29 and August 1, messages grow by 3,363%. The massive entry is on the 30th, but the same networks are inviting another jump on August 15.
The conversation starts in open groups on Facebook, Instagram and TikTok with messages of encouragement, exchange of data and calls to go to Ceuta. When interest grows, activity migrates to closed WhatsApp groups where more precise operating instructions appear. Among other things, they know they are being watched.
Police investigators identify administrators and users present in various groups, acting as dissemination nodes. More than 90% of the phone numbers analyzed are Moroccan. The rest is a rosary from 28 different countries.
For Cenif, the mobilization of between 75,000 and 85,000 people cannot be explained solely by chance or by the spontaneous spread of rumors.
The report speaks of a “viralization design process” aimed at reducing dependence on random factors, and emphasizes that moving such a number of people without roadblocks or public order incidents is “incompatible” with a spontaneous movement.
The consulting company Golden Owl, a specialist in digital traffic analysis, agrees with this diagnosis: the massive entry into Ceuta “was not a spontaneous event” but “a coordinated, pre-constructed and publicized operation” that pursued a purpose.
For this there was “a closed coordination core” that connected with diffusion groups on Facebook with more than 1.5 million members. The campaign was organized “horizontally, not hierarchically” and used one brand and one market, with codified vocabulary, visual identity and shared slogans. Thanks to these factors “it reached the scale it did” and also because of this it was resilient to arrests and eventual content removals.
This consultancy based in Alicante identified “a small group of administrators and recruiters.” Among them, they point out a native of Casablanca, resident in Istanbul, who offered a Turkish WhatsApp number (revealed by the +90 prefix). Also to a two-account operator built entirely on the hashtag “haragaceuta” – which refers to the “burning” of documentation so that they cannot be returned to you – and which was used those days as the key to the jump. And another from the Tetouan area that pushes identical content to three groups of 50,000 members.
Algerian markers are also detected. Golden Owl does it and so does the Moroccan engineer and data analyst Marouane Lamharzi, who locates (through the use of a telephone with the prefix +213) that a month before the assault an Algerian network, under the hashtags korob_haraga and Haraqa Spain, offers a trip to Spain on a boat with a 600 to 900 horsepower engine, with payment to be made at the destination. It is a sign, according to this analysis, of how the migration market is always active but also of how the July outbreak takes advantage of its terminology and its networks.
Golden Owl discovers nodes in cities in northern Morocco such as Casablanca, Khouribga, Tangier, Tetouan/Azla, Beni Chiker, Nador and Agadir, but also sees signs of operators in Madrid or Rome.
The massive entry was based on a pre-existing digital infrastructure and not on a specifically created network, concludes a report prepared for La Vanguardia by the consulting firm Cibergy, directed by Àlex Lozano, professor of digital research at the Escola de Prevenció i Seguretat Integral of the UAB. The analysis identifies 23 Facebook groups, which bring together 1.7 million members, and which have already been used since at least August 2024 to exchange data on migratory routes and access to Ceuta.
According to the study, the first unequivocal references to the autonomous city appeared on July 13, 18 days before the events. An evolution is observed from generic messages about migration to content with practical instructions for those who intended to cross.
The researchers point out two profiles as especially relevant in the previous phase: Al Hajj Mohamed and Simo França, the only ones who acted as a bridge between several groups before July 30.
Both connected exactly the same communities, which points to possible routes of information transmission, although the report emphasizes that there is no evidence of centralized coordination. Simo França is the user who mentions Ceuta the most times in July, with six references before the day of the avalanche, and he changes groups just after an intense round of publications.
Cibergy detected 54 cases of the same text published in different groups, in some cases just seconds apart. However, these systematic republications occurred after July 31, so they did not serve to organize the action.
Were bots used to amplify the message? The study identifies 52 accounts linked to the Tetouan Tube channel created in a short period of time, with similar names or identifiers, little activity of their own, and an almost exclusive dedication to sharing or amplifying third-party publications related to migration, indicators that they are not real users.
However, the consultancy maintains a cautious position. It talks about possible dynamics of “inauthentic diffusion”, but does not affirm that these accounts are bots nor does it attribute their management to a specific organization. Furthermore, it emphasizes that most of these indications appear after July 31, so they cannot be used on their own to demonstrate the existence of an organized campaign before the mass entry.
The network and security expert Marcelino Madrigal has not found signs of prior preparation comparable to what he does detect for the subsequent call on August 15. "On the 15th they had indicated very clearly that something was going to be prepared. But on the 30th, no," he summarizes. His reading is that the crisis of July 31 was the result of the confluence of several factors: the sentence, the contagion effect, the volume of people already gathered in the area; more than the outcome of a plan. He compares it to the phenomenon of a fake offer from a supermarket that goes viral and causes a crowd.
Madrigal is documenting narratives hostile to Spanish foreign policy in Russian and Israeli media and considers it plausible that these actors "take advantage of the situation" to destabilize the Spanish Government, given what represents "a very large window of opportunity." But he is careful to distinguish this from the organization of the assault: for Madrigal, this dimension of state disinformation operates as amplification after the fact, not as its origin.
The main problem, he adds, is that the difficulty in detecting signals on the networks prevents anticipating measures that, in this case, would have saved lives: "Misinformation kills. There have been 140 people who arrived at Castillejos beach and drowned and that was due to misinformation."
