Facebook captured, WhatsApp coordinated and the videos did the rest: the network that brought thousands of young people to Ceuta remains active

The mobilization that brought tens of thousands of people to Ceuta on July 30 and 31 began several days earlier on the screens of thousands of young Moroccans. Facebook served as a showcase to find participants and disseminate images of those who had reached Spanish territory. Afterward, the most delicate conversations moved to private groups, direct messages, and WhatsApp channels where schedules, meeting points, routes, and tips to avoid security forces were shared.

An open-source intelligence investigation prepared by Golden Owl has tracked 25 Facebook groups and assets connected with that campaign, disseminated under a common brand that could be translated as "Karyaj assault on Ceuta." Karyaj is a common word in Darija to refer to a metal fence, but within these spaces, it was used as a code to talk about crossing the fence between Fnideq and the Spanish city.

The report, prepared by a private company linked to the Science Park of the University of Alicante, considers with high confidence that a deliberately organized and previously prepared operation existed. Part of its findings has been corroborated by monitoring publications and groups, although the existence of central coordination remains pending an official investigation. The Audiencia Nacional has asked the Police for a report to determine if the massive entry was a concerted action or directed by a criminal organization.

A network without a leader and with three levels

Golden Owl describes a horizontal structure that operates with a private coordination core, a broad public dissemination surface, and dozens of small recruiters. The first layer would have set the brand, dates, and messages. The second transferred them to Facebook groups with large audiences. At the last step, different users formed their own cells and led interested parties to private conversations.

The five direct recruitment spaces analyzed totaled around 308,000 memberships and the complete operational core reached 478,000. The studied surface exceeded one million declared memberships, to which more than 550,000 followers of amplifying pages were added. These figures include repeated accounts across different groups, thus reflecting potential exposure and not one million distinct people.

Some recruiters sought groups with a specific composition and number. The report includes the case of a Moroccan operator located in Istanbul who tried to gather between ten and fifteen people, including two women, to divide them into teams and regroup them in the forests near Fnideq. The date remained hidden in public spaces, and contact was moved to a separate WhatsApp line with a Turkish prefix.

The network also developed simple methods to escape moderation. When a keyword began to be detected, operators switched from "Karyaj" to "the assault" and then to "the winds". They fragmented terms with punctuation marks, used empty profiles, and placed WhatsApp links in the first comment, away from the main body of the posts.

Police pressure and account closures have removed five of the most active groups, which gathered more than 200,000 members. However, recruitment later appeared in less obvious spaces, such as a Tangier job board with 139,100 members, youth groups from Castillejos, or pages offering job contracts in Europe. "The network has been displaced, but not dismantled," warns Golden Owl's latest sweep.

Videos turned rumor into a promise

Posts directly asking for volunteers had limited impact. The real leap occurred with videos of those who managed to reach the beaches of Ceuta, presented as proof that the crossing was possible. A recording of a young woman reaching the city surpassed two million views, while the testimony of another person who had returned to Morocco reached 2.3 million.

These images coexisted with false information claiming that the border would be open because it was a holiday in Spain, that graduates could enter because the country needed workers, or that those who reached Ceuta would be welcomed and transferred to the peninsula. Also, the Supreme Court ruling was distorted, which prevented the immediate rejection of those who arrived by swimming without overcoming the physical elements of the border. The ruling never recognized a right to remain in Spain, obtain papers, or move to the peninsula.

VerificaRTVE has analyzed nearly 6,000 messages shared over two days in three WhatsApp groups, in addition to five Facebook communities with more than 210,000 members and dozens of Instagram and TikTok accounts. The conversations included maps, meeting places, references to Ceuta and Melilla, offers of wetsuits and fins, and tips for hiding or running when detecting police presence.

Some of those participating in these groups presented themselves as minors between 14 and 17 years old. Some asked what would happen if they declared a false age, and others admitted they didn't even know how to swim. Ruth Ferrero, Professor of Political Science at Complutense University, has pointed out that this mobilization finds its audience among young people who use social networks as their main source of information and receive messages that would rarely reach the conventional press.

Alongside recruitment, a market for trafficking and scams also operates. Network and cybersecurity specialist Marcelino Madrigal has located offers promising clandestine accommodation in Ceuta and subsequent passage to the peninsula for between 1,600 and 1,700 euros. Other intermediaries charge for transporting young people from cities in the interior of Morocco to the border and abandon them before arriving. The presence of minors, women, sexual advertisements, and missing persons within the same groups increases the risk of exploitation and trafficking.

Missing persons alerts end up mixing with new calls. Photographs of minors in front of Spanish police stations are used to locate relatives and, at the same time, become advertising for the route. The Moroccan Association for Human Rights has counted more than 140 deaths linked to the crossings in late July, while some of the spaces that encouraged travel to Ceuta later disseminated images of their own victims.

What still remains to be proven

The investigation outlines a network operated mainly by Moroccan citizens and spread across Casablanca, Tangier, Tetouan, Nador, and other cities, with individual connections in Turkey and profiles claiming to operate from Italy. Golden Owl has also detected Algerian markers in several reused digital assets, such as references to Annaba, Algerian migration pages, and an anthem of the Hirak movement. These are circumstantial clues linked to the digital infrastructure and do not prove the participation of Algeria or its authorities.

The analysis has also not found a jihadist presence, institutional funding, parties, registered organizations, or a common political doctrine. The content combines discontent against the Moroccan government, references to "occupied Ceuta," and a fatalistic view of emigration as the only way out. Youth desperation constitutes the ground on which recruiters, intermediaries, and accounts that monetize each new wave of attention operate.

The following call appeared on August 1st in a group of 108,000 members with the message "something is going to happen in Fnideq on the 15th." Following the reinforcement of security in Castillejos, several channels have begun to mention Melilla and the accesses from Nador as an alternative, accompanied by instructions to disobey security forces. Golden Owl considers it more likely that the Moroccan deployment will reduce the call to dispersed attempts, although it maintains a possible shift eastward.

Morocco has arrested several people suspected of promoting these calls and has opened judicial investigations. The European Commission met on August 7th with Meta and TikTok, which have activated crisis protocols and a special cooperation mechanism with verifiers. The change of names, codes, and spaces now requires monitoring the language and publication patterns, because the calls have stopped concentrating in groups created expressly to talk about Ceuta.