A Spanish open-source intelligence report concluded that an Algeria-based network played a central role in organizing the late-July rush of tens of thousands of people into the Spanish enclave of Ceuta, turning what was initially presented as spontaneous desperation into a coordinated digital and physical operation.
Security analyst José María Gil Garre’s investigation found that the campaign relied on a structured online infrastructure, with a key command node administered from telephone lines registered under Algeria’s +213 country code.
That operator ran WhatsApp groups that issued tactical instructions for the assaults on Ceuta, known as Sebta in Arabic, and, when that route was blocked, rapidly redirected pressure toward Melilla.
The Algerian-linked administrator managed the WhatsApp channel “Hijma Kiraj Sebta” (Attack for the Crossing to Sebta), first detected on July 28.
After Moroccan and Spanish forces sealed access to Ceuta, the same actor opened a second group, “Hijma,” on July 31 to shift the focus to Melilla.
Instructions included splitting crowds into small cells to bypass checkpoints, timing attacks immediately after the final evening prayer, ordering phones switched off overnight to avoid tracking, and maintaining psychological pressure for mass saturation of security lines.
Gil Garre outlines five phases of the operation. Between July 8 and 15, organizers distorted a Spanish Supreme Court ruling on maritime pushbacks into a viral false claim that the border was legally open.
From July 15 to 25, the campaign shifted to mass amplification on TikTok and Facebook, flooding the platforms with detailed swimming routes from Belyounech and Fnideq along with equipment guidance.
Between July 28 and 30, the +213 WhatsApp command node was activated and orders were issued for a mass gathering in Fnideq on the night of July 30-31. That night saw the physical assault.
From July 31 to Aug. 2, the network pivoted rapidly to Melilla via a new WhatsApp group after Ceuta was locked down. WhatsApp functioned as the real-time command and logistics hub under the Algerian number. TikTok served as the primary recruitment and psychological tool, with accounts linked to Algerian numbers, including @haragaa_ceuta1and @haragama00, generating nearly 7 million views through motivational videos.
Facebook hosted at least five groups totaling more than 250,000 members that exchanged swimsuits and patrol information. Instagram provided visual proof of successful crossings.
Gil Garre assigns high confidence to the existence of planned tactical coordination, the specialized roles of the platforms, the Algerian administration of key channels, and the network’s ability to redirect the assault from Ceuta to Melilla within 24 hours. The report frames the events as a distributed hybrid operation that used Algerian telecommunications infrastructure to guide physical pressure on Spanish and Moroccan borders.
