Was the mass arrival in Ceuta really a spontaneous migration movement? A Spanish police intelligence report has cast serious doubt on that explanation. Investigators describe what they believe was a professionally prepared campaign involving automation, carefully engineered social-media messaging and operational coordination. Most significantly, several of the leads examined point towards Morocco.
Spain Expat Press Editorial Team
What unfolded on 30 and 31 July at the border of the Spanish enclave of Ceuta initially appeared to be a sudden and extraordinary migration crisis: tens of thousands of people gathered on the Moroccan side, with many attempting to reach Spanish territory.
But an investigation by Spain’s National Centre for Immigration and Borders (CENIF) presents a considerably more complex picture.
According to the report, the mobilisation did not begin at the border. Investigators believe it had been developing for days through a carefully orchestrated campaign on social media.
The report refers to a “predetermined intention”, the use of relatively sophisticated automation tools and the involvement of content specialists capable of achieving mass distribution of the calls to cross.
Its assessment is unusually stark. Investigators say they are not dealing with a spontaneous or accidental event, but with something requiring a “very high level of technical expertise and planning”.
The report goes further, arguing that the degree of specialisation involved was beyond that of any criminal organisation known to police in the area.
📛CEUTA AGENTES DE MARRUECOS DETECTADOS
En esta secuencia de vídeo se observa a tres presuntos agentes de los servicios de inteligencia marroquíes en territorio español.
Uno parece estar realizando comunicaciones, mientras los otros dos desempeñan posibles tareas de vigilancia… pic.twitter.com/i56OZONze2
— Estrategias Militares (@EstrateMilitar) September 3, 2026
A campaign built to go viral
One of the more striking elements of the investigation is its reference to the SPREAD model, a framework developed by David Dubois, an associate professor of marketing at INSEAD, and published by the Harvard Business Review in 2025.
The model examines the characteristics that make online content particularly likely to spread: social relevance, provocation, replicability, emotional impact, ambiguity and the ability to be distributed across different platforms, formats and audiences.
CENIF investigators believe the campaign preceding the events in Ceuta displayed many of these characteristics.
More importantly, the messages themselves changed as the mobilisation progressed.
Initially, relatively general calls appeared on open social networks. More specific information then began circulating in closed groups. As the attempted crossings began, urgent updates about conditions at the border were shared. Afterwards, instructions were circulated among some of those who had already reached Ceuta.
For investigators, that progression is significant: what began as online mobilisation appears to have developed into something resembling operational coordination.
From TikTok and Instagram to closed WhatsApp groups
Between 24 and 28 July, calls to travel towards Ceuta circulated principally on Facebook, Instagram and TikTok.
By 29 and 30 July, however, the pattern had changed.
Much of the conversation moved into closed WhatsApp groups. There, according to the report, investigators found what they describe as messages of “operational coordination” – including directions about movements, advice to advance in smaller groups and warnings about channels that might be under surveillance.
At the same time, the volume of digital traffic surged.
Investigators recorded 344 messages on 28 July. The figure rose to 1,341 the following day and reached 1,974 on 30 July – an increase of 3,363.1% compared with the previous daily peak before 28 July.
Another figure is particularly relevant to the investigation’s focus on Morocco.
Of the telephone numbers analysed, 90.8% had Moroccan country codes.
That does not in itself constitute evidence of Moroccan state involvement. Police acknowledge that they were unable to identify most of the people behind the numbers because they were foreign telephone lines.
Why investigators are looking towards Morocco
The most politically sensitive part of the report concerns not what happened online, but what investigators believe occurred on the ground.
CENIF compares the behaviour of Moroccan security forces during the events of 30 and 31 July with their response to another attempted mobilisation just over two weeks later.
During the July crisis, the report describes a “limited presence” of Moroccan security forces.
More seriously, investigators refer to what they describe as the “active guidance” of migrants towards crossing points.
The report also identifies people believed to be plainclothes officers who, investigators say, appeared to perform functions involving control, leadership and direction – including, according to the dossier, giving instructions to uniformed personnel.
This raises an uncomfortable question.
Was the movement towards Ceuta simply not prevented – or was it, at least in some instances, actively facilitated?
The report does not provide a definitive answer.
But what happened two weeks later appears to have deepened investigators’ suspicions.
On 15 August, Morocco stopped the crossings
After the July crisis, another social-media campaign emerged calling for people to attempt to enter Ceuta on 15 August.
This time, Morocco’s response was markedly different.
Moroccan authorities deployed security forces and prevented the crossing.
For Spanish investigators, the contrast is significant. Morocco demonstrated that it was capable of controlling the border effectively, whereas on 30 and 31 July the report describes a limited security presence and alleged instances of migrants being actively directed towards crossing points.
CENIF raises an even more striking possibility.
Investigators suggest that the second mobilisation may have been made “artificially more detectable”, and consider whether the subsequent Moroccan operation could have served to “whitewash” the management of the earlier crisis.
In effect, the report asks why Moroccan security forces were able to prevent one mass crossing when, just two weeks earlier, their response had appeared so markedly different.
Too sophisticated to be dismissed as coincidence
Taken together, the findings lead CENIF to conclude that the mass viral campaign was “neither spontaneous nor accidental”.
Investigators believe it was designed in a way that made identifying those behind it difficult. It would have required considerable technical expertise, sophisticated planning and coordination between different structures.
The report refers to a “high capacity for influence on social networks”, as well as individuals linked to Moroccan security forces and people or institutions possessing the experience and capabilities required to participate at the planning level.
Yet there is an important distinction between suspicion and proof.
CENIF does not identify the Moroccan government as the organiser of the operation, nor does the report establish who ultimately ordered or directed it.
Investigators explicitly acknowledge that they have been unable to identify the individuals who may have occupied the highest level of responsibility.
What they do describe is the profile of whoever may have been behind the operation: an actor with substantial resources, technical expertise, considerable influence on social media and the ability to coordinate different structures.
That leaves a question with potentially serious political implications.
If the events in Ceuta required professional planning; if online mobilisation developed into operational coordination; if investigators detected links to people associated with Moroccan security forces; and if the level of organisation was, in the police’s assessment, beyond the capabilities of known criminal groups in the area – who had the resources to organise it?
Spanish police do not yet have a definitive answer.
But the CENIF report makes clear why investigators’ suspicions are increasingly focused on Morocco.
