Golden Owl
Back to Research

Ceuta 2026: Anatomy of an Information War Beyond the Border

CeutaOSINTSpainSOCMINTMorocco
August 31, 2026
128 MIN READ
Ceuta 2026: Anatomy of an Information War Beyond the Border
An intelligence-grade OSINT assessment of the 2026 Ceuta mass crossing: 13,059 multilingual records across 21 countries reveal the narratives, actors, alignments and warning signs behind the crisis.

Scope, Handling and Analytical Standards

This document is an open-source intelligence (OSINT) assessment produced by Golden Owl (goldenowl.ai). It examines the international information environment surrounding the mass crossing of an estimated 60,000–80,000 people from Morocco into the Spanish autonomous city of Ceuta that began on 30 July 2026, and the second mobilisation attempt of 15 August 2026. The assessment is derived exclusively from publicly available information: online news reporting, institutional publications, publicly accessible social-media commentary, dark-web sources, and the published output of extremist and radical movements and of the organisations that monitor them.

The analytical corpus underlying this report contains 13,059 validated records: 12,908 fully analysed press and web records collected across 23 collection environments in 12 languages; 133 dark-web records restricted to genuine dark-web networks; and 18 source-traced records documenting the reactions of extremist, radical and hardline organisations. Every record carries structured analytical metadata — thematic frames, narrative labels, stance measurements, responsibility attributions, entity extractions, credibility and manipulation scoring — produced through a combination of automated semantic classification and analyst-directed validation, as described in the Methodology chapter.

Nothing in this report should be read as an endorsement of any narrative it describes. Where the report reproduces claims made by state media, partisan outlets, conspiracy communities or extremist movements, it does so to document the information environment, not to validate the claims. Casualty figures, arrival totals and other contested quantities are reported as claims circulating in the environment, with their sources and variance explicitly analysed; the true figures may differ from every figure in circulation.

Analytical confidence is expressed throughout using standard estimative language. High confidence indicates conclusions resting on multiple independent, convergent lines of quantitative evidence within the corpus. Moderate confidence indicates conclusions resting on strong but fewer or partially correlated lines of evidence. Low confidence indicates plausible readings of weak or ambiguous signals, flagged as such. Where the data supports more than one hypothesis, competing hypotheses are stated.

Data Availability and Reproducibility

In keeping with Golden Owl's commitment to analytical transparency and verifiable open-source research, the complete analytical corpus underlying this assessment has been released for public review. The dataset — comprising the enriched multilingual press and web collection, the dark-web collection, and the source-traced extremist-reaction records, together with their full structured metadata — is published on the Hugging Face Hub under the Golden Owl OSINT organisation. Researchers, journalists, policy analysts and independent reviewers are invited to download the data, replicate the quantitative findings presented in this report, and subject the underlying evidence to independent scrutiny.

The dataset is available at huggingface.co/datasets/goldenowlosint/ceuta-2026-osint-corpus. Every figure, table and judgement in this report can be traced back to records in this corpus. Users of the dataset are asked to consult the accompanying documentation for field definitions, collection methodology and responsible-use guidance before drawing their own conclusions from the data.

HANDLING

Publication: Golden Owl — Open-Source Intelligence & Research (goldenowl.ai).

Classification: UNCLASSIFIED — derived entirely from publicly available information.

Reporting window: 30 July 2026 – 30 August 2026, in two analytical periods (P1: 30 Jul–15 Aug; P2: 15–28 Aug).

Underlying dataset: publicly released for review and download at https://huggingface.co/datasets/goldenowlosint/ceuta-2026-osint-corpus.

This assessment describes an information environment. It does not attribute physical events to any actor beyond what the evidence supports.

Executive Summary

Between 30 and 31 July 2026, tens of thousands of people — the corpus's most-cited figures cluster at 60,000–80,000, with 72,000 the single most repeated number — crossed by sea and land from the area of Fnideq, Morocco, into Ceuta, a 18.5 km² Spanish autonomous city on the North African shore of the Strait of Gibraltar. It was the largest single irregular border event in modern European history, an order of magnitude beyond the May 2021 Ceuta crisis. Dozens died in the attempt; how many became one of the central information battles of the month that followed.

Golden Owl collected and analytically enriched the global information record of this event as it unfolded, across two defined periods: P1 (30 July–15 August) and P2 (15–28 August), separated by the second, largely thwarted, mass-crossing mobilisation of 15 August. The collection simulated the information environment of readers in 21 countries across Western Europe, the Maghreb, the Arab world, Russia, China, Israel, Turkey and the Americas, in 12 languages, and paired it with a dark-web collection and a dedicated, manually source-traced record of extremist-movement reactions. After relevance screening, deduplication and validation, 13,059 records form the analytical base of this report.

The investigation was designed to answer intelligence questions, not media-monitoring questions: who framed the crisis how, and when did their framing change; who was blamed, where, and with what evolution; which actors gained informational advantage; where mainstream environments moved in the same direction as extremist messaging; whether narratives propagated organically or showed signs of amplification and coordination; and what warning indicators the record contains for the next event of this kind.

The global attention curve has three peaks: the event itself (31 July, 1,137 records in one day), the second mobilisation (15 August, 659 records — attention that materialised despite the crossing itself being largely prevented), and a third peak on 25–27 August (up to 712 records/day) driven not by migration but by Spain's internal political convulsion: the first-ever invocation of the 2015 National Security Law for a migration event, a unified command under a single minister, an attack on a Spanish military vehicle in Ceuta, and the scheduling of a parliamentary reckoning. The third peak is the tell: by late August the Ceuta story had mutated from a border story into a story about the stability of a European state.

Underneath the volume curve, the investigation documents a structured narrative economy. Two mega-narratives — 'Spain overwhelmed' (6,878 records) and 'Morocco weaponizing migration' (5,382) — were global and appear in every node. But the strategically significant movement happened in the second tier. 'Occupied Ceuta', a sovereignty-reversal frame with a direct lineage to jihadist doctrine, nearly doubled its share after 15 August and was carried overwhelmingly by Moroccan Arabic-language media (688 of 955 terminology records), spreading into Gulf and North African environments while remaining nearly absent from Morocco's own French-language output — a two-track structure this report assesses as deliberate audience segmentation. 'Europe is weak' and 'Schengen collapse' saturated Chinese, Hong Kong, Russian, Turkish and Israeli environments at two to four times the Western European rate. And a conspiracy cluster attributing the crisis to Israeli, American or joint orchestration moved from radical networks into mainstream outlets — including a NATO member's state news agency — within 48 hours.

The stance data shows a general deterioration with a pivot at 15 August. Stance toward the Spanish government worsened from P1 to P2 in all 21 nodes; stance toward the EU worsened in 17 of 21. Morocco's government, by contrast, improved its net stance in 13 nodes, including sign-flips from negative to positive in Russia, China and Hong Kong — the only major-power environments to move in tandem toward Rabat. Morocco ended the crisis with its domestic ecosystem praising its security forces, Gulf environments adopting its terminology, and its principal adversary (Spain) consumed by internal blame.

The extremist record is a study in asymmetric harvesting. Designated jihadist organisations issued no located Ceuta communiqué — their doctrinal claim to Ceuta is decades old and requires no update — but their Spanish-language propaganda infrastructure was active through the window, and Spanish services reportedly identified previously expelled jihadism suspects among the arrivals. The loudest contemporaneous exploitation came from legal or semi-tolerated hardline Islamist movements, which converted the tragedy into regime-failure and caliphate narratives while adopting the same 'occupied Ceuta' vocabulary as mainstream Moroccan media — and from Western white-supremacist networks, which used the same event to call for anti-migrant violence, invoke the Great Replacement, and blame Israel. The report's alignment matrix quantifies, node by node, where mainstream coverage moved in the same narrative direction as these movements.

Measured by narrative outcomes rather than intentions: Morocco converted a domestic tragedy into sovereignty leverage and improved great-power stances toward it; Russia and China harvested a ready-made 'European decline' exhibit at near-zero cost; hardline Islamist movements gained a recruitment-grade grievance narrative; European far-right parties gained a mobilising security narrative inside Spain and beyond; and Gulf media systems gained agenda-setting power over the Arabic-language interpretation of a European crisis. The principal losers were the Spanish government (universal stance deterioration, internal fracture), the EU's border-governance credibility (negative stance in 17 nodes, 'Schengen collapse' in 2,829 records), and the migrants themselves, whose humanitarian framing peaked early and was progressively displaced by security and sovereignty frames.

The report closes with a warning framework. The 15 August mobilisation was foreseeable in open sources roughly a week in advance; the corpus documents exactly which signal types carried the warning (recruitment-page reporting, platform-takedown notices, fact-check activity spikes, and cross-node synchronisation of 'second wave' vocabulary). At the end of the window those same signal types remained elevated, three scheduled flashpoints stood in the first ten days of September, and the sovereignty narrative had been normalised at Moroccan state-religious level. The infrastructure that produced 30 July was damaged nowhere and legitimised in places. The next mobilisation, in Ceuta, Melilla or the Canaries corridor, should be treated as a warning-driven expectation rather than a surprise scenario.

All findings in this summary rest on a corpus that Golden Owl has released in full for independent review and download at huggingface.co/datasets/goldenowlosint/ceuta-2026-osint-corpus.

Key Judgements

The following judgements summarise the principal findings of the investigation. Each is developed, evidenced and caveated in the body of the report.

·         KJ-1. The 30 July mass crossing was information-triggered before it was physical. Across the corpus, the most consistent causal account — appearing independently in Spanish, Moroccan, French, Arabic, Chinese and English reporting — is that a viral misreading of a Spanish court decision, amplified by smuggling-linked accounts on short-video and social platforms, generated the mobilisation. The crisis is therefore best understood as the first large-scale European border event whose proximate trigger, second wave and political aftermath were all fought primarily in the information domain.

·         KJ-2. A measurable early-warning window preceded the 15 August second mobilisation. Records explicitly flagging the online call for a second mass crossing appear in the corpus from 3 August and accelerate from 5–7 August — eight to eleven days before the event. Platform-vector reporting (short-video mobilisation content) peaked on 8–12 August. A functioning open-source watch process would have detected the second wave with about a week of actionable lead time. (High confidence.)

·         KJ-3. Morocco's information ecosystem ran a deliberate two-track strategy segmented by language. Moroccan outlets publishing in Arabic used the sovereignty-charged term 'occupied Ceuta' in 59.9% of their output, while the same country's French-language output used it in only 20.0%. The Arabic track intensified after 15 August, culminating in the state religious establishment invoking 'occupied Ceuta' before the King on 24–25 August. This is audience-segmented strategic messaging, not editorial noise. (High confidence.)

·         KJ-4. The biggest single narrative shift of the crisis occurred after 15 August: 'occupied Ceuta' terminology rose from 353 records in P1 to 602 in P2 even as total volume fell — a near-doubling in relative terms — propagating from Moroccan Arabic media into Gulf, Egyptian and Algerian information environments. The sovereignty question, dormant in the first days, became the dominant long-tail narrative of the crisis. (High confidence.)

·         KJ-5. Russia and China were the principal strategic beneficiaries in narrative terms, but by different methods. Russian outlets ran a closed domestic loop (96% of Russian-published records reached only Russian audiences) emphasising European weakness, hostile framing of migrants, and orchestration conspiracies naming the United States, Israel and Moroccan intelligence. Chinese-audience coverage was the most 'Schengen collapse'-saturated of any node (41.4% of records) while keeping Beijing invisible as an actor. Both nodes flipped from Morocco-negative to Morocco-positive after 15 August — the only major nodes to do so in tandem. (High confidence on the patterns; moderate confidence on coordination.)

·         KJ-6. An antisemitic orchestration conspiracy ('Israel/Mossad engineered the crossing') moved from fringe networks into mainstream state-adjacent media within 24–48 hours. The corpus contains 82 records attributing blame to Israel or 'Zionist' actors, peaking on 31 July–1 August; the single largest supplier was Turkey's state news agency, followed by Moroccan and Spanish outlets. Independent monitoring of radical online networks documented the same claim set reaching an estimated audience of ~103 million on one platform within 72 hours. The mainstream and extremist versions of the claim are textually convergent. (High confidence.)

·         KJ-7. Extremist movements did not cause the crisis but harvested it with unusual speed and cross-ideological convergence. No dedicated communiqué from a designated jihadist organisation was located; instead, jihadist ecosystems relied on standing 'reconquest of al-Andalus' doctrine, while the most explicit contemporaneous exploitation came from non-violent hardline Islamist movements (Hizb ut-Tahrir, Al-Adl wal-Ihsan, PJD, IUMS) and Western white-supremacist networks (Active Clubs). Islamist and far-right actors pushed materially identical conspiracy claims, with antisemitism as the connective tissue. (High confidence.)

·         KJ-8. Mainstream information environments in Qatar, Saudi Arabia, Egypt, Israel, China and Hong Kong each exceeded 35% alignment with at least one extremist narrative family measured in this study — most commonly 'occupied Ceuta / sovereignty reversal' in Arab-world nodes and 'Europe is weak / Schengen collapse' in China-linked and Israeli nodes. Alignment does not imply coordination; it maps where extremist messaging can travel furthest with least resistance. (High confidence on measurement; see Chapter 29 for interpretation limits.)

·         KJ-9. A 'numbers war' substituted for a facts war. The corpus contains 25 distinct death tolls (11, 57, 67, 72, 75, 88, 96, 100, 111, 141 and others) and a P1 arrivals median of 50,000 against a P2 median of 11,000. Morocco's official toll (11) and Moroccan NGO counts (141) bracket a 13x discrepancy that no actor closed during the period. Casualty inflation correlates with narrative position: outlets carrying sovereignty or anti-Spain frames cited systematically higher tolls. (High confidence.)

·         KJ-10. Spain lost control of its own story twice: first physically (30 July), then narratively (after 15 August), when its information environment pivoted from external explanation to internal recrimination — 'Spain government failure' became the top domestic frame (30.6% of P2 records) and stance toward the Spanish government deteriorated in every one of the 21 audience nodes measured. The 24–27 August declaration of a 'situation of national security importance', the first use of the 2015 National Security Law for a migration event, marks the point where the information crisis converted into a constitutional-political one. (High confidence.)

·         KJ-11. The economic lens was present but marginal and asymmetric (5.5% of records overall). It concentrated in Arab-world and Maghreb nodes (Qatar 12.5%, Morocco 8.7%, Algeria 7.5%) around border-economy collapse in Fnideq, remittance and labour narratives, and Ceuta's port and tourism losses; European nodes largely ignored economics in favour of political framing. The absence of sustained economic analysis in EU-facing coverage is itself a finding: the cost dimension of the crisis was ceded to non-European narrators. (Moderate confidence.)

·         KJ-12. Warning for the next cycle: the same mobilisation infrastructure — recruitment pages, short-video virality, grievance narratives among Moroccan youth, and an unresolved sovereignty narrative now normalised at state-religious level — remained intact at the end of the reporting window. Records from 24–28 August document calls for demonstrations on 2 September, a Spanish parliamentary reckoning on 3 September and an EU meeting on 8 September. The structural conditions for a third mobilisation attempt persist. (Moderate-to-high confidence.)

Chapter 1 — The Investigation and Its Mandate

Most large news events produce a large information record. A small number of events do something different: they are produced by the information environment itself, and then transform it. The July–August 2026 Ceuta crisis belongs to the second category. The physical event — the largest irregular mass crossing in modern European history — was triggered, according to the most consistent multi-source account in this corpus, by content: a viral misreading of a Spanish judicial decision, industrialised by smuggling-linked recruitment accounts and platform recommendation systems. Its second act, the 15 August mobilisation, was called into existence online, detected online, and largely suppressed offline. Its third act was an information war over numbers, blame and sovereignty that outlived the physical emergency and was still escalating when the collection window closed.

Golden Owl's mandate for this investigation was set accordingly. The task was not to summarise coverage of Ceuta. It was to treat the world's coverage of Ceuta as the object of intelligence analysis: to instrument the global information environment at scale, in the languages in which the event was actually discussed, over a defined period bracketing the two mobilisations; to convert every collected record into structured analytical data; and then to interrogate that data the way an all-source analyst interrogates reporting — for positions, shifts, alignments, anomalies, propagation patterns, beneficiaries and warnings.

Five analytical questions structured the work:

·         Q1 — Positioning. For each national or regional information environment ('node'), what was the dominant interpretation of the crisis — its cause, its responsible parties, its meaning — and how did that interpretation differ from its neighbours'?

·         Q2 — Temporal shift. What did each node hold to be true before 15 August, and what did it hold after? Where narratives moved, what moved them?

·         Q3 — Benefit. Which actors gained informational or narrative advantage from the crisis — measured in stance improvements, agenda-setting reach, narrative adoption by others, and the cost imposed on adversaries?

·         Q4 — Alignment. How did extremist and radical movements interpret the event, and where did mainstream national environments move in the same narrative direction — knowingly or not?

·         Q5 — Warning. What does the record reveal about detectability — could the event, or its second wave, have been anticipated from open sources, and what indicator set does the data validate for the next cycle?

A sixth, standing question ran beneath the other five: does the record contain an economic dimension — actors reading the crisis through costs, trade, labour or markets — and if so, who used that lens and who conspicuously did not?

The report is organised as the investigation itself proceeded. Part I reconstructs the event from the data and sets out the method. Part II maps the global information environment: who supplied the world's Ceuta coverage, through which chokepoints, in which frames. Part III profiles each node in turn — its interpretation, its blame model, its emphases and its conclusions. Part IV isolates time: the 15 August fracture and what changed across it. Part V presents the information-warfare findings: the numbers war, the terminology campaign, the conspiracy cluster, disinformation and coordination signals, and platform vectors. Part VI descends into the extremist and dark-web layer and quantifies its contact points with the mainstream. Part VII treats the economic dimension. Part VIII delivers the strategic assessment: beneficiaries, adversary and alignment classifications, warning indicators, and outlook.

READING GUIDANCE

Node = a national or regional information environment as experienced by a reader in that country (collection locale), not a single outlet and not a government.

Publisher country = the country of the outlet that produced a record; nodes consume from many publisher countries.

P1 = 30 July–15 August 2026. P2 = 15–28 August 2026. The 15 August second mobilisation is the boundary event.

All percentages are shares of validated records unless stated otherwise. Stance indices run from -1 (uniformly hostile) to +1 (uniformly favourable).

Chapter 2 — Reconstruction: Thirty-One Days, Three Peaks

Before any interpretation, the record itself. The corpus's 12,908 fully analysed press records, positioned on their publication dates, produce the attention curve in Figure 1 — the crisis's cardiogram. Three peaks organise everything that follows.

Phase One: the crossing and the flood (30 July – 7 August)

The corpus contains two records dated before the event — a 27 July item and a 28 July item, both routine borderland reporting — and then detonates: 431 records on 30 July, 1,137 on 31 July, the single largest day of the entire window. The immediate reporting establishes the facts that every subsequent narrative would fight over. Crowds moving from Fnideq toward the Tarajal breakwater and beaches on the night of 29–30 July; crossings by swimming, by inflatable, on foot at low tide; Spanish security forces overwhelmed within hours; the Ceuta local government requesting military support; deaths by drowning reported from the first morning.

Within 72 hours the record already contains, fully formed, the four content battles that would define the month: the causal battle (was this spontaneous, engineered by smugglers' misinformation, or tolerated/directed by Rabat?); the numbers battle (Morocco's interior ministry acknowledging 11 dead while Spain's Ceuta delegation counted 72, with NGOs higher); the political battle (Spanish opposition parties declaring government failure; European capitals demanding Schengen safeguards); and the sovereignty battle (Arabic-language media reviving 'occupied Ceuta'). The speed matters analytically: no narrative in this crisis needed time to develop. The frames were pre-existing, loaded, and fired on contact.

Volume decays through the first week as the physical emergency stabilises — returns of tens of thousands of people to Morocco within 48–72 hours are the dominant P1 policy story — but the decay is interrupted by secondary detonations: the 3–4 August wave of European diplomatic reporting (a leaked request by Madrid that allies refrain from publicly blaming Morocco; a Dutch demand for a European Commission investigation into how over 50,000 people could enter), and the 7–8 August casualty revisions, when Moroccan human-rights organisations began circulating a toll of 141.

Phase Two: the visible approach of the second wave (8–15 August)

The trough between 8 and 14 August (161–224 records/day) is deceptive. Inside it, the corpus records the approach of the second mobilisation in near-real time: fact-checking desks and international broadcasters investigating online calls to repeat the crossing on 15 August; platform companies removing recruitment pages after media notification; Moroccan authorities pre-positioning security forces around Fnideq. Chapter 19 quantifies this early-warning window — the report's most operationally significant finding. The 15 August peak itself (659 records) is an attention event about an anticipated physical event that was largely prevented: Moroccan forces arrested hundreds around Fnideq and dispersed gatherings; the crossing figures of 15–16 August are a fraction of 30 July. In information terms, however, the second wave succeeded: it re-globalised the story, reset the news cycle, and demonstrated that the mobilisation infrastructure had survived the first crackdown.

Phase Three: mutation into a Spanish state crisis (16–28 August)

P2's volume floor is markedly higher than P1's trough — the story never cooled to its pre-15-August level — and the composition changes. Topic analysis of the 24–27 August spike (2,162 records) shows the crisis mutating from a border event into a governance event: 'Spain domestic politics' and 'migration policy debate' dominate; 'unaccompanied minors' becomes a top-ten topic as roughly 3,000–5,000 minors and non-returnable arrivals remain in improvised camps; and a cluster of claims appears that exists nowhere in P1 — Spain's National Security Council declaring a 'situation of national security importance' under the 2015 National Security Law (its first use for a migration event), a unified command under minister Ángel Víctor Torres, tear gas against beach encampments, an attack on a Spanish military vehicle on 27 August, twelve arrests, a parliamentary appearance scheduled for 3 September and a Brussels mission on 8 September.

The three-peak structure is the report's first finding in itself: each peak was produced by a different mechanism — a physical event (30 July), an online mobilisation (15 August), and a political-institutional convulsion (24–27 August). A monitoring architecture tuned only to physical border events would have modelled one peak out of three.

TIMELINE — EVENTS MOST CITED IN THE CORPUS

29–30 Jul — Night gatherings at Fnideq; mass crossing begins toward Tarajal; Ceuta overwhelmed; first drownings reported.

31 Jul — Peak global attention (1,137 records/day). Spain deploys military support. Morocco reports 11 dead; Spain's delegation reports higher tolls (rising to 72).

1–3 Aug — Mass returns to Morocco (~48,000 within 48h per Spanish authorities). EU interior ministers convene. Dutch government demands Commission investigation.

4–5 Aug — Madrid reportedly asks allies not to blame Morocco publicly. Reports identify previously expelled jihadism suspects among arrivals (Interior denies confirmation).

6–8 Aug — Moroccan NGO toll of 141 begins circulating. Court-ruling misinformation dissected by fact-checkers. First reporting on '15 August' online calls.

8–14 Aug — Early-warning window: recruitment pages, takedowns, platform-vector reporting peak 8–12 Aug; Morocco pre-positions forces.

15–16 Aug — Second mobilisation largely thwarted; hundreds arrested around Fnideq (294 and 111 cited in specific operations).

18–22 Aug — OMDH demands independent investigations; minors dispute escalates between Ceuta, Madrid and autonomous communities.

24–25 Aug — Moroccan Islamic-affairs minister invokes 'occupied Ceuta' before the King at Mawlid. Sovereignty narrative peaks.

26–27 Aug — Spain declares national-security situation; unified command; military vehicle attacked; 12 arrests; asylum-law reform advances.

2–8 Sep (scheduled) — Demonstrations called for 2 Sep; Sánchez before Congress 3 Sep; Ceuta president in Brussels 8 Sep.

Chapter 3 — Methodology: Instrumenting a Global Information Environment

This chapter describes how the analytical corpus was built, validated and enriched, in sufficient detail for the reader to audit every quantitative claim in the report. The methodology is described functionally — what was done to the data — rather than commercially; the investigation's conclusions do not depend on any specific tooling, and equivalent pipelines can be assembled from many components.

Collection design

The core design decision was to collect by audience, not by outlet. For each of 21 countries, the collection simulated a reader inside that country's information environment: queries were issued in the country's language(s) and native script, through the country-specific search infrastructure a local reader would use, with interface-language and geography parameters matched to that country. This produces, for each node, the mixture of domestic and foreign content a reader there would plausibly encounter — which is the correct object of study for questions about how environments, rather than editors, interpreted the crisis. Twenty-three locale configurations covered the 21 nodes (Morocco and Algeria were each collected in both Arabic and French, a decision that proved decisive for the two-track finding of Chapter 8).

Query design used simple, deliberately neutral two-term keyword families: the native rendering of 'Ceuta' (Ceuta, سبتة, Сеута, 休达/休達, סאוטה, Sebta) paired with broad, non-leading angles — border, crisis, Spain, Morocco, migrants, minors, arrivals, and locally salient toponyms such as Tarajal and Fnideq. Neutrality was a validity requirement: loaded query terms would have pre-selected the narratives the study was designed to measure. Each keyword was issued separately for the two research windows using strict date-range operators (P1: 30 July–15 August; P2: 15–28 August), across both the general web index and the news vertical, with deep pagination (up to four result pages of 80 results per query). Collection jobs were interleaved across all locales and windows so that partial runs could not bias coverage toward any country.

Three further streams complemented the core collection. First, a dark-web collection restricted to genuine dark-web networks (Tor onion services, I2P, IRC, ZeroNet — explicitly excluding clearnet chat platforms), executed in seven languages under a strict fetch budget, sorted newest-first by crawl date: 1,316 unique items were retrieved and screened, of which 133 passed the Ceuta-relevance gate. Second, a manually compiled, source-traced record of extremist, radical and hardline group reactions — 18 records covering designated jihadist organisations, hardline Islamist movements, Muslim Brotherhood-aligned bodies, far-right violent-extremist networks and radical online clusters, each preserving group category, designation status, verbatim claims in the original language, English renderings, narrative frames and exact source URLs. Third, publisher-resolution enrichment: each record's outlet was resolved to a country of origin and outlet type through a curated map of ~170 known outlets, then top-level-domain heuristics, then model-assisted inference, with the resolution method and confidence stored per record.

The processing funnel

Every collected link passed through a five-stage pipeline: (1) canonical-link deduplication, guaranteeing that no URL enters the corpus twice; (2) full-content retrieval, converting each page into clean machine-readable text (12,711 of 12,948 retained records scraped successfully; 167 returned empty content and 70 failed, and were analysed from their metadata and snippets where possible); (3) machine-assisted content triage and relevance assessment, in which every item was individually evaluated for whether it concerns the 2026 Ceuta crisis, with a continuous relevance score; (4) automated semantic classification, described below; and (5) incremental, crash-safe persistence with full search provenance (locale, keyword, window, vertical, query, result rank) stored on every record.

The relevance gate was strict and its rejects were preserved for audit. Of 17,794 unique candidate records processed from the core collection, 4,846 (27.2%) were rejected as not genuinely about the crisis — homonym noise, tangential mentions, sports and travel content, and pre-2026 material — leaving 12,948 retained records, of which 12,908 (99.7%) completed full analytical enrichment. The dark-web stream was gated harder: 1,183 of 1,316 items (89.9%) were rejected, reflecting the low signal density of dark-web sources. The final analytical dataset therefore comprises 13,059 validated records (12,908 + 133 + 18).

Table 1. The collection and validation funnel.

Stream

Candidates screened

Rejected by relevance gate

Validated records

Fully enriched

Global press/web collection

17,794

4,846 (27.2%)

12,948

12,908

Dark-web collection

1,316

1,183 (89.9%)

133

133

Extremist-group record (manual, source-traced)

—

—

18

18

Total analytical corpus

19,110+

6,029

13,099

13,059

 

Analytical enrichment

Each validated record was individually converted into roughly forty structured analytical fields through automated semantic classification with analyst-defined taxonomies. The enrichment layers were: multilingual semantic normalisation (language detection and cross-lingual normalisation of themes, so that a sovereignty claim in Arabic, a soberanía claim in Spanish, and a 主权 claim in Chinese land in one taxonomy); narrative taxonomy assignment (primary and secondary frames from a fixed frame set, plus free narrative-theme labels); stance measurement toward four reference actors (the Spanish government, the Moroccan government, the EU, and the migrants themselves) on a five-level scale; responsibility attribution (which actors each record blames, and which it praises); contextual entity resolution (people, organisations, locations); quantitative-claim extraction (every migrant-arrival figure and casualty figure cited, enabling the numbers-war analysis of Chapter 22); manipulation assessment (bias, sensationalism and credibility scoring, propaganda-technique tagging, manipulation indicators, and flags for probable disinformation and suspected coordination); terminology tracking (how each record designates Ceuta itself — 'autonomous city', 'Spanish enclave', 'occupied Ceuta', and 30+ observed variants); and analytical metadata enrichment (content type, state-affiliation assessment of the outlet, target-audience characterisation, calls to action, and key verbatim claims).

Classification quality was controlled in four ways. First, taxonomies were fixed before collection, so the classifier could not drift with the news cycle. Second, every record retains its full provenance and its key verbatim claims, so any label can be audited against the underlying text; the analyst team spot-audited labels across languages and both windows during the investigation. Third, all corpus-level findings in this report rest on aggregate distributions over thousands of records, not on individual labels; classification noise at the record level attenuates rather than creates the patterns reported. Fourth, findings were required to survive triangulation: every major judgement is supported by at least two independent measurement routes (for example, the two-track Morocco finding appears independently in terminology shares, stance distributions, frame distributions and the extremist record's documentation of state-religious language).

Analytical processing

The enriched corpus was then analysed as a dataset: temporal aggregation at daily resolution with the 15 August boundary as a structural break; node-level aggregation of frames, narratives, stances, blame, terminology, emotions and propaganda techniques, separately for P1 and P2; supply-chain analysis crossing publisher country against audience node; narrative-propagation analysis tracking each key narrative's first appearance and cumulative country reach over time; anomaly hunting over the quantitative-claim distributions (the casualty and arrivals figures); duplicate-claim detection across publisher countries; alignment scoring of every node against six extremist narrative families derived from the extremist-group record; and systematic sampling of high-signal record clusters (coordination-flagged records, disinformation-flagged records, conspiracy-attribution records, early-warning records) for qualitative reading. All figures in this report are generated directly from the corpus; no external statistics are introduced except where explicitly attributed.

Limits

Four limits bound the findings. (1) The collection observes what search infrastructure surfaces to a reader; heavily suppressed or deplatformed content is under-represented, which means mobilisation-content findings are floors, not ceilings. (2) Node volumes differ by an order of magnitude; the report never compares raw counts across nodes, only shares within nodes, and marks every low-n node. (3) Publication dates are metadata-derived and normalised to UTC; a small number of records carry detector-inferred dates, and 226 records with unresolvable dates are excluded from temporal charts only. (4) Stance, bias and credibility are model-scored editorial constructs, audited by sampling; they support comparative statements (node A is more hostile than node B; node A hardened after 15 August) rather than absolute ones. Within those limits, the corpus is, to Golden Owl's knowledge, the most complete structured record of the global information response to the 2026 Ceuta crisis assembled to date.

Chapter 4 — The Supply Chain of the World's Ceuta Coverage

Before asking what each country believed about Ceuta, the investigation asked a harder question: who manufactured what each country believed? Every record carries both an audience node (whose information environment surfaced it) and a publisher country (whose outlet produced it). Crossing the two produces the information supply chain in Figure 4 — and three structural findings that condition everything in Part III.

Finding one: Spain narrated its own crisis to the world — at first

Spanish publishers are the corpus's largest single source (2,991 records, 23.2%), and their reach is unique: Spanish outlets appear in meaningful volume in every audience node measured, including 322 records surfacing in the Moroccan environment, 27 in Algeria's, and a strong presence across Latin America, where Spanish wire and press content is the backbone of regional coverage. In the first days this gave Madrid a structural narrative advantage: the raw facts reaching most of the world were Spanish-sourced facts — Spanish casualty counts, Spanish arrival estimates, Spanish framing of the emergency response. The investigation's temporal analysis (Part IV) shows how this advantage was squandered: because Spain's own information environment turned inward and adversarial after 15 August, the content Spain exported to the world increasingly carried the 'Spain government failure' frame. A country that supplies the world's coverage of its own crisis also exports its own recriminations.

Finding two: four wire services were the chokepoint — and one of them is Spanish

Wire-service citation analysis (Figure 5) reveals the deeper chokepoint. Four agencies — Reuters (1,457 citing records), EFE (1,232 + 372 Europa Press), AFP (1,182), AP (782 combined) — are cited across every node, and for many nodes they constitute the factual skeleton of the entire story. Latin American coverage is heavily EFE-dependent; Chinese-audience coverage cites Reuters and AFP while adding state-agency layers; Arabic-language coverage mixes AFP with regional agencies. The strategic point is under-appreciated: EFE is a Spanish state-owned agency, and Europa Press is Spanish private. For the Spanish-speaking world — 3,774 records, the corpus's largest language bloc — the 'neutral' factual layer was substantially manufactured in Madrid. This is soft infrastructure power, and it worked: Latin American nodes carry the most Spain-sympathetic humanitarian framing in the corpus. Conversely, nodes with independent agency layers (Russia: TASS/RIA/Interfax; Turkey: Anadolu; China: Xinhua) show the sharpest divergence from the Western factual baseline — most visibly in the casualty figures they chose to foreground (Chapter 22).

Finding three: closed loops and open doors

The flow matrix exposes a taxonomy of environments. Open importers — the UK, US, Germany, Latin America — consume heavily from foreign publishers, above all Spain and the wires. Self-suppliers with export ambitions — Spain, Morocco, France — generate the bulk of their own coverage and export it. And closed loops: Russia's row and column are nearly identical — 339 of 355 Russian-published records (95.5%) surfaced only in the Russian audience environment, and the Russian audience consumed almost nothing foreign that was not first re-processed by Russian outlets. China shows a softer version of the same structure (262 of 312 Chinese-published records domestic; Hong Kong and Taiwan-published Chinese-language content supplying the rest). The analytic consequence is sharp: whatever Russian and Chinese readers learned about Ceuta, they learned it after domestic re-framing. These environments do not import narratives; they import raw material and manufacture their own. That is what makes their measured frames (Chapters 13–14) attributable to editorial systems rather than to the international news flow.

One further supply anomaly deserves record. Taiwanese-published Chinese-language content (210 records) supplied mainly the Hong Kong node (170 records), where it competed directly with mainland framing; and Belgium's modest output (185 records, anchored by EU-affairs outlets) achieved disproportionate cross-node reach into France, the UK, Morocco and Algeria — the Brussels press corps functioning, as it often does, as the EU's de facto wire service. The corpus also registers publishers from 60+ further countries in small volumes, including Vatican media whose consistent humanitarian counter-framing surfaces in six nodes.

Chapter 5 — How the World Framed Ceuta: The Global Narrative Economy

Every record was assigned one primary frame from a fixed taxonomy — the single organising interpretation of the piece — plus free narrative-theme labels normalised across languages. At the global level, the frame distribution looks almost balanced: migration-policy debate 29.0%, humanitarian crisis 28.4%, Spain-government failure 10.4%, security threat/invasion 8.5%, EU weakness/failure 5.7%, geopolitical opportunism 4.3%, sovereignty dispute 3.6%. The balance is an illusion of aggregation. Figure 6 disaggregates by node, and the illusion collapses: no two regions experienced the same crisis.

Four regional signatures stand out. In Latin America (Mexico, Colombia, Argentina, Brazil) the crisis was overwhelmingly a humanitarian story (33–43% humanitarian frame) with strong sympathy for migrants and — the EFE effect — Spanish-supplied facts. In the Arab-world nodes (Egypt, Saudi Arabia, Qatar) the humanitarian frame coexists with the corpus's highest sovereignty-dispute shares (up to 8.3%) and, as Chapter 23 shows, the highest 'occupied Ceuta' terminology rates. In the China-linked and Russian environments the crisis was a policy-failure exhibit: China's 37.9% migration-policy-debate share is the highest in the corpus, and Russia adds the highest security-threat share (16.2%) of any major node. Israel's environment is unique: security-threat/invasion is its number-one frame (29.3%) — the only node where that is true.

The two-tier narrative economy

Narrative-theme analysis across 12,908 records reveals a two-tier economy. Tier one is universal: 'Spain overwhelmed' (6,878 records; 53–65% of records in most nodes) and 'Morocco weaponizing migration' (5,382) plus 'migrants as victims' (5,269). These are the load-bearing narratives that every environment shared; they carried the factual story. Tier two is strategic and selective: 'Schengen collapse' (2,829 records; 41% of the Chinese node, 37% Hong Kong, 33% Russia — versus 3% in Spain itself); 'Sanchez incompetence' (2,277; concentrated in Spain, Latin America and Italy); 'occupied Ceuta' (1,876; Arab-world and Maghreb); 'Europe is weak' (764; China 14%, Israel 13.8%, Turkey 12%); 'invasion/replacement' (841; Israel 22.4%, triple any other node); 'migrants as threat' (408; Russia 9.2%, first place). Tier-two narratives do not describe the event — they use it. Their distribution is the crisis's strategic map, and nearly every judgement in Part VIII rests on it.

Quality of the information space

Manipulation scoring places every node on a bias/credibility plane (Figure 8). Three observations. First, the crisis was not, in the aggregate, a disinformation event: mean credibility (0.58) and the 1.9% likely-disinformation rate indicate a mostly conventional — if emotive — news environment. Second, the exceptions cluster exactly where the strategic narratives cluster: Israel's node has the corpus's worst bias (0.486) and near-worst credibility, Russia and China follow, and outlet-level analysis (Chapter 25) shows opposition and state-aligned outlets carrying disinformation rates five to ten times the independent-outlet baseline. Third, emotional-tone analysis shows 'alarm' as the crisis's master emotion in every node — but the secondary emotion differentiates: 'pity' in Latin America and the UK, 'suspicion' in Algeria, Israel and Russia, 'anger' in Spain and Morocco. Alarm plus pity produces humanitarian coverage; alarm plus suspicion produces conspiracy uptake. The secondary-emotion map predicts, with striking accuracy, which nodes later carried the orchestration conspiracies of Chapter 19.

Political exploitation — a record using the crisis to advance an agenda beyond the event — was flagged in 48.3% of all records, an extraordinary global rate that quantifies how instantly Ceuta became a vehicle. The node ranking (Israel 75.0%, Qatar 62.5%, Italy 60.9%, Algeria 54.1%) and its interpretation are developed in Part III; the global point is simpler: for half the world's coverage, Ceuta was never only about Ceuta.

Chapter 6 — Who Spoke: The Human Agenda of a Global Story

Before turning to the node-by-node profiles, the investigation asks a deceptively simple question that contextual entity resolution makes answerable at scale: when 21 information environments wrote about Ceuta, whose names did they write? Every validated record carries extracted person and organisation entities. Aggregated across 13,059 records, these entities form a map of the crisis's human agenda — who the world treated as protagonist, who as antagonist, and, most revealingly, who it did not mention at all. The result is one of the clearest structural findings of the investigation: a crisis that began in Morocco was narrated, globally, as a story populated almost exclusively by Spanish and European faces.

A Spanish cast for a Moroccan-origin event

6.1 The three most-mentioned people in the global corpus are all Spanish domestic political figures. Prime Minister Pedro Sánchez appears in roughly 4,600 records once spelling variants are consolidated — more than a third of the entire validated corpus. Ceuta's regional president Juan Jesús Vivas appears in about 2,780, and Interior Minister Fernando Grande-Marlaska in 2,249. No other individual on earth comes within a factor of three of this trio. The global information environment, in other words, did not merely cover a border emergency: it cast a Spanish political drama, with Sánchez as its lead.

The consequence is a structural accountability asymmetry. A reader in any of the 21 nodes encountered Spanish officials being questioned, blamed, defended and investigated — by name, repeatedly. The Moroccan state, by contrast, appears as an almost faceless abstraction. King Mohammed VI registers roughly 245 mentions across both spelling variants — around five percent of Sánchez's total — and a large share of those occur in Arabic-language religious or ceremonial contexts, including the Mawlid address examined in Chapter 9. Justice Minister Abdellatif Ouahbi (243) and government spokesman Rachid El Khalfi (70) round out an official Moroccan presence that, in aggregate, is smaller than the mention count of Spain's migration minister alone. Whether by media inaccessibility, deliberate reticence or editorial habit, Morocco fought the information war without exposing a single face to it — and the blame data of Part IV shows the pay-off: personalised blame requires a person, and the corpus supplied only Spanish ones.

Table 2. Most-mentioned individuals in the validated corpus (person-entity resolution, spelling variants consolidated).

Rank

Person

Role

Mentions

Reading

1

Pedro Sánchez

Prime Minister, Spain

~4,616

Global protagonist; blame magnet in P2

2

Juan Jesús Vivas

President of Ceuta

~2,781

Voice of the overwhelmed enclave

3

F. Grande-Marlaska

Interior Minister, Spain

2,249

Operational accountability figure

4

Giorgia Meloni

Prime Minister, Italy

765

Loudest non-Spanish European voice

5

Ursula von der Leyen

President, European Commission

516

Institutional EU face

6

Ángel Víctor Torres

Minister, Spain

462

Territorial-policy dimension

7

Margarita Robles

Defence Minister, Spain

417

Military deployment

8

Elma Saiz

Migration Minister, Spain

398

Reception and transfer policy

9

Magnus Brunner

EU Home Affairs Commissioner

358

Schengen and border response

10

Donald Trump

President, United States

348

Comparative-politics reference point

11

José Manuel Albares

Foreign Minister, Spain

~389

Madrid–Rabat channel

12

Alberto Núñez Feijóo

Opposition leader (PP), Spain

290

Third-peak escalation driver

13

Sira Rego

Youth & Childhood Minister, Spain

283

Unaccompanied-minors dispute

14

Abdellatif Ouahbi

Justice Minister, Morocco

243

Highest-ranked named Moroccan official

15

Mohammed VI

King of Morocco

~245

Near-absent; ceremonial contexts dominate

 

Meloni's outsized shadow and the depersonalised Union

6.2 Among non-Spanish European leaders, the distribution is lopsided in a way that maps directly onto behaviour. Giorgia Meloni's 765 mentions dwarf Emmanuel Macron's 132 and Friedrich Merz's 128 combined — a direct dividend of Italy's unilateral Schengen suspension in the first days of August, the single most consequential act by any EU government other than Spain's. Denmark's Mette Frederiksen (132) earned her presence through the returns-policy push examined in Chapter 12. The pattern confirms a rule visible throughout this investigation: in a border crisis, the information environment rewards governments that act unilaterally with narrative presence, and renders invisible those that coordinate quietly.

The European Union itself, meanwhile, appears overwhelmingly as institutions rather than people. Frontex (2,212 mentions) and the European Commission (2,092) each outrank every non-Spanish individual on the planet; the Schengen system itself registers 1,084. Ursula von der Leyen's 516 and Magnus Brunner's 358 are respectable but subordinate to their own institutions. This depersonalisation matters for influence analysis: narratives attacking 'Brussels' or 'Frontex' faced no human counter-figure to absorb or answer them, which is precisely the condition under which the EU-weakness meta-narrative of Chapter 5 propagated most efficiently.

The revealing margins: a court, a spy agency, a ghost from 2021

6.3 Three lower-frequency entities carry analytical weight far beyond their counts. The Spanish Supreme Court (329 mentions) is the institutional protagonist of the crisis's origin story — the misread ruling dissected in Chapter 21. Spain's National Intelligence Centre, the CNI (181 mentions), anchors the third-peak accountability fight over what Madrid knew and when (Chapter 20). And Brahim Ghali, the Polisario Front leader whose hospitalisation in Spain triggered the 2021 Ceuta crisis, resurfaces in 77 records — almost entirely in Spanish and Algerian publications — as the historical template through which those two environments read Moroccan intent. The Ghali citations are a measurable fingerprint of institutional memory: the nodes that had lived through 2021's weaponised-migration episode reached for it immediately, while nodes without that memory (the Americas, East Asia) never mentioned him at all.

Finally, the organisational margins document the crisis's dual infrastructure. On the humanitarian side, the Red Cross (202) and Save the Children (193) cluster around the unaccompanied-minors story alongside minister Sira Rego. On the informational side, a video-sharing platform widely identified in reporting as the recruitment vector appears as a named organisational actor in 230 records — a rare case of a distribution channel becoming a character in the story it distributed. The corpus, in effect, wrote its own methodological footnote: the platforms that moved the mobilisation content became part of the mobilisation narrative.

CHAPTER 6 — KEY FINDINGS

The global cast was Spanish: Sánchez (~4,600 mentions), Vivas (~2,780) and Grande-Marlaska (2,249) dominate every other individual worldwide by a factor of three or more.

Morocco fought faceless: the King, the justice minister and the government spokesman combined appear less often than Spain's migration minister alone — an accountability asymmetry that consistently diverted personalised blame toward Madrid.

Unilateralism buys visibility: Meloni (765) outranks Macron and Merz combined on the strength of Italy's Schengen suspension.

The EU appeared as institutions, not people — Frontex and the Commission each outrank every non-Spanish individual — leaving anti-EU narratives without a human counter-figure.

Low-frequency entities (Supreme Court, CNI, Brahim Ghali) mark the corpus's three deepest storylines: the trigger, the warning failure, and the 2021 institutional memory.

Chapter 7 — Reading the Nodes: Stance and Blame at a Glance

Part III profiles each information environment in turn. Two reference charts anchor all of them. Figure 10 gives every node's net stance toward the four reference actors — the Spanish government, the Moroccan government, the EU, and the migrants — on a scale from -1 (uniformly hostile) to +1 (uniformly favourable). Figure 11 gives every node's blame model: the share of records attributing responsibility to each candidate actor. Together they are the crisis's diplomatic weather map.

Three global patterns frame the individual profiles. First, nobody defended Spain: the Spanish government's stance index is negative in all 21 nodes, and 'Spain' is the single most-blamed actor globally (6,296 records) — partly a mechanical effect of Spain being the theatre, but the P1→P2 dynamics of Part IV show it is much more than that. Second, Morocco polarised: its stance index spans from +0.216 (Egypt) to -0.30 (Qatar, low-n) — the widest spread of any actor — making Morocco the crisis's true attitudinal fault line. Third, the migrants were everywhere viewed more favourably than any government: the 'migrants' row is positive in every node except Israel (0.00) — global coverage was, in stance terms, a story about failing states and suffering people. The exceptions and reversals to these patterns are precisely where the intelligence value lies, and the profiles that follow work through them node by node — each closing with the node's position before and after 15 August and its dominant collective conclusion.

Chapter 8 — Spain: The Theatre That Turned On Itself

8.1 Volume and structure. Spain is the corpus's largest node (1,633 records) and the most domestically supplied (76% of its records from Spanish publishers). Its terminology is institutional — 'autonomous city' in 75.8% of records, by far the highest rate anywhere, with 'occupied Ceuta' near-absent (1.0%). This is a node that never doubted whose city Ceuta is; its war was over whose fault the crisis was.

8.2 Interpretation and blame. Spain's frame mix is unique in combining the three P1 stories in near-equal measure: migration-policy debate (28.1%), Spain-government failure (24.7%) and humanitarian crisis (23.0%). Its blame model is the most self-directed in the corpus: 21.8% of records blame Spain itself and a further 9.8% blame local authorities and 13.2% carry the 'Sanchez incompetence' theme — while blame of Morocco (10.9%) runs below the global average and collapses over time. The node praised no one consistently: the most-praised actors (Ceuta president Juan Jesús Vivas, the Guardia Civil, the Red Cross) each appear in under 4% of praise mentions.

8.3 The 15 August pivot. P1 Spain and P2 Spain are different countries, informationally. In P1, migration-policy debate led (28.1%) with government failure third (19.3%), and 13.0% of records blamed Morocco. In P2, Spain-government failure became the number-one frame (30.6%), blame of Spain rose to 23.6% and blame of Morocco halved to 8.4%; the stance toward the national government deteriorated from -0.176 to -0.243. Morocco effectively disappeared as Spain's villain — displaced by Madrid, the Interior Ministry, the intelligence services (the CNI is blamed in 43 records for failing to anticipate the crossing), and the party system. The corpus records the endpoint: national-security declaration, unified command, a scheduled parliamentary reckoning (3 September) and a two-front political war with both Vox (214 blame records) and the PP (143).

8.4 Assessment. Spain's information environment executed, in thirty days, the full arc that hostile narrators (Chapters 13–14) merely asserted: from emergency solidarity to institutional recrimination to a first-ever national-security invocation. The node's collective conclusion by 28 August: the crisis was a state failure — of anticipation (CNI), of border command, of minors policy, and of political cohesion. For adversarial information systems, Spain's own media manufactured the 'Europe cannot govern its borders' exhibit; Russian and Chinese outlets needed only to quote it.

NODE VERDICT — SPAIN

Before 15 Aug: emergency management story; blame spread across Morocco, smugglers, and the government; Morocco actively blamed (13.0%).

After 15 Aug: government-failure story; self-blame 23.6%; Morocco largely dropped as villain (8.4%); stance toward own government worst in corpus trajectory.

Collective conclusion: a Spanish state failure — anticipation, command, minors policy, political cohesion.

Chief beneficiaries of the node's framing: Spanish opposition parties; external 'Europe is failing' narrators quoting Spanish media.

Chapter 9 — Morocco: One Country, Two Scripts

9.1 Volume and structure. Morocco is the second node (1,354 records) and the second publisher country (1,515 records) — and the only node the investigation collected in two languages, which produced its most consequential single finding. The node's overall posture looks moderate: humanitarian crisis is the top frame (30.3%), migrants are viewed sympathetically (+0.404, among the highest), blame concentrates on Spain (18.6%) and smugglers (17.4%), and the Moroccan government enjoys the corpus's second-best stance toward itself (+0.209) — improving from +0.167 in P1 to +0.262 in P2, even as every other government's stance collapsed. Moroccan security forces are the node's most-praised actor. Blame of Morocco's own government exists (10.7%) but, critically, publisher-level analysis found only 2 records from Moroccan outlets blaming the Moroccan government as an institution — domestic self-criticism was operationally absent.

9.2 The two-track finding. Splitting Moroccan publishers by output language breaks the moderate image in half. Moroccan outlets writing in Arabic (931 records) used 'occupied Ceuta' in 59.9% of their coverage, carried a sovereignty-dispute frame in 12.0%, and blamed Spain at nearly double the rate of their French output. Moroccan outlets writing in French (441 records) — the language of Rabat's European interlocutors and of its diplomatic press — used the term in 20.0%, foregrounded humanitarian and policy frames, and carried the 'Morocco pressure tool' accusation frequently enough to look balanced. Same country, same weeks, same events: a sovereignty narrative for the domestic and Arab-world audience, a responsible-partner narrative for the European one. The gap (39.9 points) is too large, too stable across both windows (Arabic: 58.2% P1 → 60.6% P2) and too aligned with known Moroccan strategic communication practice to be editorial coincidence. The investigation assesses with high confidence that this is deliberate audience segmentation.

9.3 The escalation ladder. The Arabic track did not merely persist; it climbed an identifiable ladder. Step one (30 July–5 August): legacy usage by sovereignty-minded outlets (Hespress alone accounts for 123 'occupied' records). Step two (post-15 August): normalisation — the term's corpus-wide volume nearly doubles in P2 (353→602) while total volume falls, and it spreads from opinion into straight news furniture. Step three (24–25 August): state adoption — the Minister of Endowments and Islamic Affairs invokes 'occupied Ceuta' and the 'liberation of occupied cities' in an address before the King at the Mawlid ceremony, an act Moroccan media itself read as a sovereignty signal, captured in both the mainstream corpus and the extremist-group record (Chapter 27). A vocabulary that in early July belonged to Islamists and irredentist commentators ended August in the mouth of a minister in the royal presence.

9.4 What the node avoided. Equally diagnostic is what Moroccan coverage did not say. It did not report the '15 August' mobilisation as a domestic security embarrassment (coverage foregrounds successful interdiction and arrests — 294 and 111 in cited operations); it did not sustain the casualty controversy (Morocco's official 11 coexists in the node with Spain's 72 mostly without adjudication); and it did not engage the 'Morocco weaponizing migration' accusation directly — the theme appears in 16.7% of node records but overwhelmingly via foreign-sourced content, while domestic outlets counter-programmed with humanitarian and sovereignty frames. The government's improving stance while 70,000+ citizens fled through its border is, in information terms, the crisis's single most successful defensive operation.

NODE VERDICT — MOROCCO

Before 15 Aug: humanitarian tragedy + quiet sovereignty track in Arabic (58% occupied-Ceuta in Arabic output); government shielded from blame.

After 15 Aug: sovereignty track amplified (61% Arabic; state-religious adoption 24–25 Aug); government stance improved further (+0.262); interdiction success story.

Collective conclusion (Arabic track): the deep cause is the unresolved colonial question of the occupied enclaves. (French track): a managed humanitarian emergency in partnership with Spain.

Assessment: deliberate two-track strategic messaging; the crisis was converted into sovereignty leverage at near-zero diplomatic cost.

Chapter 10 — Algeria: The Adversary's Adversary Watches

10.1 Algeria (1,050 records, collected in Arabic and French) watched its regional rival's crisis with what the data renders as disciplined ambivalence. The node's stance toward Morocco's government is a near-perfect zero (-0.007) — remarkable for the Maghreb's principal antagonist relationship — because two opposing currents cancel: French-language Algerian coverage relays the 'Morocco weaponizing migration' accusation enthusiastically (the theme runs at 17.8%, among the highest), while Arabic-language coverage participates in the pan-Arab sovereignty narrative ('occupied Ceuta' terminology: 16.3% of the node, 171 records — the highest node rate outside Morocco and the Gulf). Algiers's information environment thus managed to have it both ways: Morocco the cynical weaponiser of migrants, and Ceuta the occupied Arab city.

10.2 The node's blame model leads with Spain (19.8%, rising to 22.4% in P2) and its stance toward the EU deteriorates sharply after 15 August (-0.170 → -0.228), consistent with a broader anti-Brussels current in Algerian commentary that predates the crisis. The 'suspicion' emotional tone is the node's second-strongest — Algerian coverage entertained orchestration hypotheses (including Israel/US variants, 10 records) at above-average rates. Notably, the node's stance toward Morocco improves marginally in P2 (+0.015): when Europe began blaming Rabat in earnest, Algerian coverage — structurally unwilling to align with European criticism of a Maghreb state — softened. Regional identity beat bilateral rivalry.

NODE VERDICT — ALGERIA

Before 15 Aug: dual-track schadenfreude — Morocco blamed in French, sovereignty narrative in Arabic; EU viewed with suspicion.

After 15 Aug: blame consolidates on Spain (22.4%); EU stance worsens; Morocco stance softens as European criticism of Rabat grows.

Collective conclusion: the crisis proves both rivals' weakness — Morocco's governance failure and Spain/Europe's border failure — with the sovereignty question as an approved subtext.

Chapter 11 — The Gulf and Egypt: Adopting the Sovereignty Frame

11.1 The three Arab-world nodes east of the Maghreb — Egypt (306 records), Saudi Arabia (410) and Qatar (24; low-n, flagged) — form the crisis's clearest case of narrative import. None has a stake in Ceuta; all three ended August carrying Morocco's Arabic-track vocabulary at rates second only to Morocco itself: 'occupied Ceuta' terminology in 32.4% of Egyptian, 36.8% of Saudi and 45.8% of Qatari records. Pan-Arab wire content and Moroccan Arabic media exports are the visible transmission channels (Egypt's node, for instance, is supplied more by Algerian, Moroccan and Saudi publishers than by Egyptian ones).

11.2 Egypt and Saudi Arabia pair the sovereignty vocabulary with the corpus's most favourable stances toward Morocco's government (+0.216 and +0.212) — and in both, that stance improves in P2 (Egypt +0.163→+0.295) while stance toward Spain deteriorates (Saudi: -0.123→-0.215). The Gulf's collective conclusion, visible in frame and blame data, is a two-part formula: humanitarian sympathy for the migrants (stance +0.34 to +0.45) plus civilisational-historical framing of the territory. Notably absent: any sustained 'Morocco weaponizing migration' current — the accusation that organised European coverage barely penetrated Gulf Arabic environments, and where it appears it is usually attributed, skeptically, to European sources.

11.3 Qatar's tiny sample behaves differently enough to note: it carries the corpus's highest rates of 'fortress Europe cruelty' (17.4%) and 'Western hypocrisy' (8.7%) theming, the highest political-exploitation share after Israel (62.5%), and — uniquely among Arab nodes — its stance toward Morocco's government collapses in P2 (0.0 → -0.429), driven by pan-Arab outlet criticism of Rabat's crackdown on the 15 August mobilisation and its handling of casualties. The pattern is consistent with the editorial line of Qatar's flagship international media: pro-migrant, anti-European-border-regime, and unsparing of Arab governments' security responses. Given n=24 this is reported as an indicative, not established, finding.

NODE VERDICT — GULF & EGYPT

Before 15 Aug: humanitarian sympathy + rapid adoption of 'occupied Ceuta' vocabulary; Morocco viewed favourably.

After 15 Aug: sovereignty framing intensifies with the Moroccan Arabic track; Egypt/Saudi warm further toward Rabat; Qatar (low-n) turns on Rabat over the crackdown.

Collective conclusion: a European colonial anachronism produced a humanitarian tragedy; the deeper issue is the enclaves' status, not Spanish border management.

Assessment: the Gulf became the amplification chamber that internationalised Morocco's domestic sovereignty narrative.

Chapter 12 — Western Europe: Five Neighbours, Five Different Alarms

12.1 France (446 records) heard the crisis as a Schengen story. 'Schengen collapse' theming runs at 12.1% — the highest in Western Europe — and the EU-weakness frame at 10.5%; French coverage led European reporting on internal border controls, on the Interior Ministry's reinforcements at the Spanish frontier, and on the Digital Services Act dimension of the misinformation trigger (French records account for a plurality of the corpus's platform-accountability calls to action). France's investigative desks also produced the corpus's best forensic work on the mobilisation itself — coordination-flagged records from French international broadcasters dissecting the 15 August online campaign. Stance shifts P1→P2: Spain -0.120→-0.244 (the sharpest Western European deterioration), EU -0.185→-0.204. The French collective conclusion: Ceuta is a European border-governance failure with a hybrid-threat dimension, and France is next in the blast radius.

12.2 Germany (388 records) ran the corpus's cleanest information space: the lowest likely-disinformation share of any node (0.3%), heavy public-broadcaster fact-checking (German records anchor the court-ruling misinformation forensics), and a P2 pivot into humanitarian coverage (41.8%, the node's P2 top frame) centred on the minors question. Germany's EU stance nonetheless deteriorates (-0.164→-0.222) as its coverage engages the solidarity-mechanism fight. The German conclusion: an EU responsibility-sharing failure with a disinformation trigger — notably not a Spain failure (its Spain stance is the mildest of the large European nodes).

12.3 Italy (414 records) politicised hardest. Political exploitation is flagged in 60.9% of Italian records — the highest of any European node and third globally — as the crisis was conscripted into Italy's own migration wars: Meloni-government positioning (Giorgia Meloni is the fourth-most-cited person in the entire corpus at 765 mentions), comparisons with the Albania scheme, and 333 records in which Italian actors blame Italy's own opponents. Italy is also the European node most receptive to invasion framing (10.8% invasion/replacement theming). Its stances harden across the board in P2 (EU -0.112→-0.284; Morocco -0.087→-0.159). The Italian conclusion: Ceuta vindicates whichever Italian migration position the speaker already held — externalisation for the right, its bankruptcy for the left.

12.4 Portugal (366 records) is the control group: the lowest political-exploitation rate in Europe (34.2%), minimal disinformation (0.5%), a balanced humanitarian/policy frame mix, and blame patterns tracking the European mean. Its P2 shift mirrors the continent's (Spain stance -0.051→-0.119) without any distinctive strategic current — evidence of what neighbouring coverage looks like when a national information environment has no dog in the fight.

12.5 The United Kingdom (1,004 records) produced the corpus's most humanitarian large-node coverage (34.3% humanitarian frame; 'migrants as victims' 16.5%; migrant stance +0.380) — and simultaneously used Ceuta relentlessly as a Channel-politics mirror: UK records map the crisis onto small-boats discourse, with 'EU weakness' theming (7.5%) deployed both by Brexit-vindication commentary and by rejoin-adjacent commentary about shared challenges. UK investigative desks (with French peers) led the pre-15-August early-warning reporting. Stance shifts: Spain -0.041→-0.152; EU -0.131→-0.203. The UK conclusion: a humanitarian catastrophe proving that every border regime — EU or post-Brexit — is one viral rumour from being overwhelmed.

NODE VERDICT — WESTERN EUROPE

Shared P1 position: solidarity-with-alarm; blame on smugglers/misinformation with growing Morocco suspicion.

Shared P2 shift: every node's stance toward both Spain and the EU deteriorated; attention pivoted to minors, institutional failure and 'who is next'.

Divergent conclusions: FR = Schengen/hybrid-threat failure; DE = EU solidarity failure; IT = ammunition for domestic migration wars; PT = tragedy, no agenda; UK = universal border fragility.

Chapter 13 — Russia: The Closed Loop That Harvested the Crisis

13.1 Structure first, because it explains everything else: Russia's information environment (764 audience records; 355 Russian-published records) is the corpus's most closed system — 95.5% of Russian-published content circulated only domestically, and the Russian audience's foreign inputs passed through domestic re-processing. Within that loop, Russian outlets built a distinctive product. Frames: migration-policy debate 32.6%, but with the corpus's highest major-node security-threat share (16.2%) and an EU-weakness share (10.2%) rivalled only by China's. Narratives: 'Schengen collapse' in 32.5% of node records, 'Europe is weak' 8.8%, and — uniquely — the corpus's highest 'migrants as threat' rate (9.2%) paired with its coldest stance toward migrants (+0.056, against a global mean near +0.30). Russian coverage is the only major environment that managed to be simultaneously anti-EU, anti-Spain, unsympathetic to the migrants, and increasingly warm toward Morocco (stance flip -0.050 → +0.063 across 15 August).

13.2 The manufacturing method is visible in the propaganda-technique distribution of Russian-published records: loaded language (285 of 355 records), cherry-picking (143), fearmongering (98), whataboutism (30 — Europe's treatment of migrants set against its lectures to Russia), and appeal to authority (32 — heavy quotation of Spanish opposition figures and European far-right voices as 'European opinion'). Russia's is also the largest single national contribution to the likely-disinformation subset (25 records, 7.0% of its output — six times the independent-outlet baseline). The flagged items are not crude fabrications; they are orchestration narratives: a major business daily arguing the crossing was diplomatic pressure involving Morocco, the US and Israel 'though direct proof is lacking'; tabloid and legacy outlets asserting Moroccan-intelligence organisation as established fact; a late-August item claiming the EU exploited the crisis to expand federal power. Each launders a conspiracy through hedged, deniable phrasing.

13.3 What Russia did not do is equally diagnostic: no significant 'occupied Ceuta' uptake (1.3% — sovereignty reversal of European territory is not a precedent Moscow wants), no humanitarian investment, and near-zero engagement with the misinformation-trigger story that dominated Western forensics (acknowledging the trigger would undercut the 'organised weakness' thesis). The Russian collective conclusion, stable across both windows and hardening after 15 August (EU stance -0.317→-0.444, the corpus's worst): Europe cannot control its borders, its institutions blame each other, and the Ceuta precedent proves the fragility of the entire Schengen construction. The crisis cost Russia nothing and supplied a month of self-evidencing decline content — the purest narrative harvest in this study.

NODE VERDICT — RUSSIA

Before 15 Aug: 'Europe overwhelmed' security framing; orchestration hypotheses (Morocco/US/Israel) seeded; migrants framed coldly.

After 15 Aug: EU stance falls to corpus-worst (-0.444); Morocco stance flips positive; 'migrants as threat' intensifies; EU-power-grab narrative added.

Collective conclusion: Ceuta is systemic proof of European decline and Schengen fragility.

Assessment: principal opportunistic beneficiary; method = closed-loop re-framing + deniable orchestration narratives, not fabrication.

Chapter 14 — China and Hong Kong: The Governance Lesson

14.1 Chinese-audience coverage (517 records; plus Hong Kong's 433, supplied by a three-way mix of mainland, Hong Kong and Taiwanese publishers) built a different product from Russia's with overlapping raw material. The mainland node runs the corpus's highest migration-policy-debate share (37.9%) and its highest 'Schengen collapse' saturation (41.4% of records carry the theme — against 3% in Spain itself), plus 'EU solidarity failure' at 30.6%. But it is measurably less conspiratorial than the Russian product: state-owned outlets in the corpus overall score higher credibility (0.656) and lower disinformation (0.97%) than the global mean, and mainland coverage largely relays Western wire facts — then frames them. The framing is the point: Europe's crisis is presented as a governance failure of liberal systems — chaotic, quarrelsome, unable to execute — with no Chinese equity mentioned. Beijing appears nowhere in its own coverage: no Chinese official statements, no China-angle, nothing to defend. It is pure lesson-extraction.

14.2 Two temporal signals deserve intelligence attention. First, the Morocco flip: mainland stance toward Rabat swings from -0.151 (P1) to +0.105 (P2), and Hong Kong's from -0.139 to +0.022 — the same direction and timing as Russia's flip. Three strategic-media systems independently (or not) stopped criticising Morocco in the second half of August, coinciding with Morocco's interdiction success and with European criticism of Rabat becoming a Western consensus position. Second, the P2 blame migration: mainland coverage's blame of 'migrants' rises from 8% to 13.9% (Hong Kong: to 11.2%), converging with Russia's cold framing. The 'Europe is weak' theme runs at 14.0% (mainland) — the highest of any node. Hong Kong's environment, where Taiwanese-published content competes, shows the same architecture with softer edges and the corpus's second-highest EU-negativity (stance -0.272, deteriorating to -0.400 in P2).

14.3 The Chinese collective conclusion is managerial rather than triumphalist: Europe's model failed a stress test that competent governance would have passed — border control lost to a rumour, member states fighting within days, a casualty count nobody could fix. For an audience primed with 'Western chaos versus Chinese order' comparisons, Ceuta required no editorialising at all; the wire copy sufficed. Assessment: China was the crisis's most efficient beneficiary — maximal narrative yield, zero visible investment, zero attribution risk.

NODE VERDICT — CHINA & HONG KONG

Before 15 Aug: Schengen-collapse saturation; policy-failure framing; Morocco mildly criticised.

After 15 Aug: Morocco stance flips positive (with Russia, in tandem); blame shifts toward migrants; EU stance worsens further.

Collective conclusion: a governance stress-test failure by liberal systems; no Chinese equities engaged.

Assessment: most efficient beneficiary — the 'weak Europe' exhibit at zero cost.

Chapter 15 — Israel: The Most Securitised Node — and a Target of the Story

15.1 Israel's environment (116 records; low-mid n, dominated by domestic outlets — Ynet, Maariv, Israel Hayom, N12, i24) is an outlier on nearly every axis the investigation measured. It is the only node whose number-one frame is security threat/invasion (29.3%); it carries 'invasion/replacement' theming at 22.4% — triple any other node; its political-exploitation rate (75.0%) and bias score (0.486) are the corpus's highest; and it is the only node whose net stance toward the migrants is not positive (0.00). Every reference actor — Spain (-0.294), Morocco (-0.262), the EU (-0.441) — is viewed negatively. Israeli coverage read Ceuta almost entirely through its own security ontology: border breach as existential category, European hesitancy as weakness, migration as demographic threat vector.

15.2 But Israel was not only an observer; within 24 hours it became part of the story. The corpus documents (Chapter 24 in full) an orchestration conspiracy — Israel/Mossad engineered the crossing to punish the Sánchez government for its pro-Palestinian positions — surfacing on 30–31 July and peaking immediately (13 records on 31 July). Israeli outlets covered the conspiracy defensively from day one, and Israeli-audience records include reporting on antisemitic incidents in Spain linked to the discourse. This dual position — most securitised interpreter, and named villain of a transnational conspiracy — explains the node's exceptional exploitation and bias scores: nearly everything published served an argument. The Israeli collective conclusion: Ceuta demonstrates what borderless idealism yields, and the conspiracy demonstrates what Israel's information adversaries do with any European crisis. Both halves are, from the node's perspective, vindications.

NODE VERDICT — ISRAEL

Before 15 Aug: invasion-frame securitisation + immediate defensive coverage of the Mossad-orchestration conspiracy.

After 15 Aug: securitisation persists (34.8% security frame in P2); Morocco stance normalises as interdiction succeeds.

Collective conclusion: European border weakness is systemic; the conspiracy wave confirms structural antisemitism in crisis discourse.

Assessment: informationally a net loser — dragged into a hostile narrative it did not choose, in an environment already primed for threat framing.

Chapter 16 — Turkey: The Instrumental Node

16.1 Turkey's audience node (250 records) looks unremarkable at first: policy-debate framing (39.6%), average stances, modest volume. Its publisher role is the finding. Turkish outlets produced 320 records with the corpus's widest export footprint relative to size — reaching Moroccan, UK, US, Algerian, Russian, French, Egyptian and Saudi environments — anchored by the state news agency (128 records, 40% of national output). Two content signatures distinguish that output. First, Europe-critique: 'fortress Europe cruelty' (32 records), 'Western hypocrisy on refugees' and 'EU weakness' run well above wire-service norms, consistent with Ankara's long-standing positioning as Europe's migration creditor and moral critic — Turkey hosts more refugees than the EU, and its state media never lets the EU forget it. Second, and more serious: Turkish publishers are the single largest national source of Israel-blame content in the corpus (12 of 82 records) — state-agency items relaying, with attribution-laundering neutrality ('Spanish political figures claim...'), the allegation that Israel exploited or engineered the crisis. The technique — report the conspiracy as someone else's claim, export it in multiple languages — gave the orchestration narrative mainstream, wire-formatted carriage it could not have achieved through fringe channels alone.

16.2 Turkey's stance data shows the same instrumental pattern over time: its EU stance deteriorates sharply in P2 (-0.134→-0.333) while its Morocco stance normalises to zero — tracking Ankara's interest in the EU-weakness lesson rather than any Maghreb equity. The Turkish collective conclusion: Ceuta proves Europe's border regime is hypocritical and brittle, and validates Turkey's transactional migration leverage. Assessment: a secondary but real beneficiary — and the crisis's most effective state-media conduit for moving fringe orchestration claims into the international mainstream.

NODE VERDICT — TURKEY

Before 15 Aug: EU-hypocrisy framing; state agency relays Israel-orchestration claims with attribution laundering (largest national source).

After 15 Aug: EU stance hardens sharply; Morocco criticism dropped; leverage lesson consolidated.

Collective conclusion: Europe's migration regime is weak and hypocritical; leverage works.

Assessment: secondary beneficiary; primary mainstream conduit for the conspiracy cluster.

Chapter 17 — The Americas: The Humanitarian Mirror and the EFE Effect

17.1 The United States (933 records) covered Ceuta as a humanitarian story (32.0% humanitarian frame) with a strong domestic-mirror current: records mapping Tarajal onto the southern border, 'invasion' vocabulary imported into US immigration debates (9.2% invasion/replacement theming — high for a non-European node), and Donald Trump the seventh-most-cited person in the corpus (348 mentions) despite the US having no formal role in the crisis. The US node also consumed the second-largest volume of likely-disinformation content (25 records) — largely conspiracy-adjacent commentary circulating in English — and its P2 pivot follows the global pattern (Spain-failure frame rises to 19.2%; Spain stance -0.091→-0.203). The US collective conclusion is bifocal: a European tragedy, and a warning transferable to any border.

17.2 Latin America (Mexico 926, Argentina 715, Colombia 493, Brazil 367 — 2,501 records combined, the corpus's largest regional bloc after Europe) is the clearest demonstration of supply-chain determinism in the study. Fed overwhelmingly by Spanish publishers and EFE wire copy (Chapter 4), the four nodes produced the most homogeneous coverage measured: humanitarian frame first everywhere (33–43%), 'migrants as victims' theming at 16.7–20.9%, the corpus's warmest migrant stances (+0.38 to +0.43), 'autonomous city' terminology at Spanish-domestic rates (59–70%), and negligible sovereignty or conspiracy uptake. Within the homogeneity, national accents: Mexico foregrounds migration-system critique and family-testimony reporting; Argentina and Colombia carry the strongest Sánchez-politics coverage (21.7% and 18.4% 'Sanchez incompetence' theming — Spanish political content re-consumed as quasi-domestic news); Brazil, more distant linguistically, runs the bloc's highest EU-solidarity-failure share (23.2%).

17.3 The bloc's P2 shift is the global pattern in miniature and amplified: Mexico's Spain-government-failure frame nearly triples (8.3%→20.1%), Argentina's grows 2.5x (7.4%→18.9%), and every stance toward Madrid deteriorates. The region's collective conclusion: a humanitarian catastrophe caused by inequality and mismanaged borders, whose lesson is universal — a conclusion that, precisely because it was manufactured from Spanish source material, ended up exporting Spain's self-criticism to 400 million Spanish speakers. The EFE effect cuts both ways.

NODE VERDICT — THE AMERICAS

Before 15 Aug: humanitarian catastrophe framing; migrants as victims; facts supplied from Madrid.

After 15 Aug: Spain-failure frame surges (Mexico x2.4, Argentina x2.5); Spanish domestic recrimination re-exported region-wide.

Collective conclusion: universal border-humanity lesson; Spain judged by its own exported media standards.

Assessment: no regional actor sought or gained advantage; the region functioned as a resonance chamber for Spanish-language framing.

Chapter 18 — The 15 August Fracture: What Changed, Everywhere, At Once

The investigation's period design — P1 (30 July–15 August, 7,201 records) against P2 (15–28 August, 5,747) — was built to answer one question at scale: did the world's information environments change their minds across the second mobilisation? The answer is yes, in a strikingly synchronised way, and the synchrony itself is a finding.

Three synchronised movements

18.1 Movement one: everyone turned on Madrid. Stance toward the Spanish government deteriorated from P1 to P2 in all 21 nodes without exception — the corpus's only unanimous shift. The mechanism differs by node (domestic recrimination in Spain; minors-crisis and camps coverage in Europe; re-exported Spanish self-criticism in Latin America; opportunistic decline-framing in Russia and China) but the direction is universal. In parallel, the 'Spain government failure' frame rose from 9.2% of global P1 records to 13.7% of P2, and blame of Spain rose in 19 of 21 nodes (Figure 14).

18.2 Movement two: the EU lost the middle. Stance toward the EU worsened in 17 of 21 nodes, with the sharpest P2 deterioration in exactly the environments that were already coldest: Russia (-0.444), Hong Kong (-0.400), Turkey (-0.333), Italy (-0.284). Only Spain's own EU stance improved marginally (from -0.114 to -0.092) — as Spanish coverage pivoted to demanding European help, Brussels became Spain's potential rescuer rather than its scold. The EU thus ended the crisis in the worst of both worlds: blamed for weakness by its adversaries and for absence by its member state.

18.3 Movement three: Morocco was quietly rehabilitated where it matters. Rabat's stance improved in 13 nodes, with sign-flips (negative to positive) in Russia, China and Hong Kong and further warming in Egypt (+0.295) and Algeria. The rehabilitation coincides with three P2 realities: Morocco's visible interdiction success on 15–16 August (the only actor that demonstrably 'won' its half of the second wave), the Western pivot of blame toward Madrid, and the Arab-world consolidation around the sovereignty narrative. Only Qatar (low-n) and the Latin American bloc moved against Rabat. The net effect is remarkable: the state most accused of weaponising migration in P1 ended P2 with better global standing than the state that was its victim.

The narrative lifecycle view

18.4 Figure 15 plots the life-cycles of four strategic narratives. They behave differently, and the differences are diagnostic. 'Sanchez incompetence' is event-reactive: it spikes with each Spanish political development and grows across the window (47.3% of its volume in P1, 52.7% in P2) — an opposition narrative with momentum. 'Europe is weak' is front-loaded (73.4% in P1): a shock-exploitation narrative that did its work in week one and decayed — its authors needed the spectacle, not the aftermath. 'Invasion/replacement' is likewise front-loaded (66.9% P1) but with a long extremist-fed tail. 'Occupied Ceuta' is the outlier: it grows against the news cycle (52.7% → 47.3% split but near-doubling in daily share terms as total volume fell), the only strategic narrative whose best days came after the emergency ended — the signature of a campaign, not a reaction. Chapter 23 treats it accordingly.

Chapter 19 — The Early-Warning Window: The Second Wave Was Visible for a Week

The single most operationally consequential finding of this investigation concerns detectability. The 15 August mobilisation — a mass-crossing attempt called into existence on social platforms — was visible in mainstream open sources for eight to eleven days before it happened. The corpus contains 38 pre-15-August records explicitly flagging the online call for a second crossing: the first isolated signals on 3–4 August, a sustained cluster from 5 August, and a peak of 7 records on 7 August — international broadcasters investigating the recruitment campaign, fact-checkers debunking its claims, platform companies confirming takedowns of mobilisation pages, and wire reports of Moroccan pre-positioning around Fnideq.

19.1 The platform-vector series adds resolution. Records discussing short-video mobilisation content (a proxy for the campaign's visible intensity) rise through 8 August (18 records), peak on 11 August (29), and fall as takedowns bite — four days before the event. The two series together describe a textbook warning signature: campaign detection (3–7 August), campaign peak (8–12 August), suppression and execution (13–15 August). Any watch operation consuming these open sources with daily discipline would have issued a high-confidence warning of the 15 August attempt no later than 7 August, with the target date explicit in the reporting itself.

19.2 Three qualifications keep the finding honest. First, hindsight bias is limited here because the records are not retrospectively reinterpreted signals — they name the date and the mechanism in advance ('calls circulating for another mass crossing on 15 August'). Second, warning is not prevention: Moroccan authorities, who visibly acted on the same signals, still faced gatherings requiring hundreds of arrests; Spain reinforced but could not have prevented a determined mass event. Third, the window was partly created by the adversary's own choice of a symbolic, pre-announced date; a mobilisation without a announced date would compress the window. Even so: the crisis's second act was, in open-source terms, the opposite of a surprise — and Chapter 33 converts this window's signal types into a reusable indicator set.

WARNING-WINDOW ANATOMY (VALIDATED BY THE 15 AUGUST CASE)

T-12 to T-8 days: first mainstream reports of recruitment pages and 'second wave' vocabulary; fact-check desks engage the claims.

T-8 to T-4 days: platform-takedown notices; peak short-video-vector reporting; cross-node synchronisation of the target date.

T-4 to T-1 days: security pre-positioning reported around origin areas (Fnideq); recruitment content migrates to smaller channels.

T-0: attention peak regardless of physical outcome — the mobilisation succeeds informationally even when interdicted physically.

Chapter 20 — The Third Peak: When the Border Crisis Became a State Crisis

The 24–27 August spike (2,162 records; single-day peak of 712 on 27 August, approaching the levels of the event week itself) is the window's least intuitive feature: nothing crossed a border. Topic decomposition shows what did: Spain's domestic political system entering institutional crisis mode. The spike's claim-cluster analysis (exact repeated claims across outlets and countries) reconstructs the sequence — the National Security Council meeting chaired by the prime minister; the declaration of a 'situation of national security importance' under the 2015 National Security Law, its first use for a migration event; a unified command under a single minister; port-security reinforcement requests from Ceuta; tear gas against beach encampments; the 27 August attack on a Spanish military vehicle with one soldier lightly injured and twelve arrests; the prime minister's parliamentary appearance scheduled for 3 September; and the Ceuta president's Brussels mission on 8 September.

20.1 The minors question is the spike's emotional core and its longest-fuse issue. 'Unaccompanied minors' and child-protection topics enter the global top ten only in P2; the corpus documents 3,000–5,000 non-returned arrivals including thousands of minors, an inter-regional relocation fight between Ceuta, Madrid and the autonomous communities, claims that many victims among the dead were women and minors, and — flagged repeatedly by rights organisations in the record — investigations into sexual violence against minors inside the emergency system. Every European far-right and far-left current found fuel here: the right in the security and cost framing, the left in the child-protection failures. The minors caseload is the crisis's institutional residue: long after arrivals statistics normalised, it kept the story alive, kept Ceuta's institutions in conflict with Madrid, and kept the emotional temperature high enough for exploitation.

20.2 Analytically, the third peak completes a pattern the report has been building: each successive peak required less physical reality per unit of information effect. Peak one was a physical event with information amplification; peak two an information event with physical suppression; peak three an institutional-political event with no border component at all. The crisis learned to sustain itself on its own consequences — the signature of an event transitioning from incident to condition. Conditions, unlike incidents, do not end; they wait.

Chapter 21 — The Trigger: Forensics of a Misread Ruling

Every chapter in this Part examines a weapon used in the information war that followed the crossings. This one examines the munition that started the physical crisis itself. The most consistent multi-source account in the corpus holds that the July mass movement was set off not by a policy change, a natural disaster or an economic shock, but by content: a viral misreading of a Spanish judicial decision, circulated as proof that the border was legally 'open', then industrialised by smuggling-linked recruitment accounts. The investigation isolated every record engaging with this origin story — judicial-decision references, rumour and hoax vocabulary, misinformation-debunking language — across all collection languages. The resulting thread contains 808 validated records, 6.2% of the corpus, and its structure supports three forensic findings: the rumour was global within 48 hours, its industrialisation was visible in near-real time, and the correction never came in a form that could compete.

Anatomy of the misreading

21.1 The trigger thread is born simultaneously with the crisis itself: 57 records on 30 July, a peak of 121 on 31 July — the same day as peak global coverage — and a sustained plateau of 30–60 records per day through 6 August. This synchrony is itself evidence. The rumour was not an after-the-fact explanation reconstructed by journalists days later; it was reported as the operative cause from the first hours, by outlets on five continents, before any official account existed. A French-published wire piece dated 31 July already carried the definitive framing — 'A rumour, a rush: chaos at Morocco's border with Spain' — and a Chinese-language analysis dated 2 August distilled the mechanism into a single headline: '“You can swim to Europe”: an illegal-migration crisis detonated by a misreading.'

Geographically, the thread's distribution is diagnostic. Its two largest audiences are Morocco (116 records) and Spain (115) — the two societies that needed to understand what had happened to them — but its tail is remarkably deep: 69 records in the United States node, 59 in China, 56 in the United Kingdom, 55 in Mexico, 47 each in Algeria and Russia. A judicial misreading in Madrid became, within days, a global parable about the fragility of borders in the platform era. Notably, the Russian and Chinese engagements with the trigger story consistently subordinated the rumour to their preferred structural frames: where Spanish coverage treated the misreading as the cause, Moscow-published coverage treated it as the spark that exposed an already failed system — a small but consistent editorial choice that separates explanation from exploitation.

Industrialisation: from misreading to mobilisation

21.2 A rumour does not move seventy thousand people on its own. The corpus documents the machinery that scaled it: 383 records — 265 in P1, 118 in P2 — describe smuggler networks, recruitment accounts and paid facilitation riding the rumour wave. Platform-vector reporting follows a strikingly clean temporal curve. References to the principal video-sharing vector run at one or two records per day through 3 August, jump to ten on 4 August, reach 18 on 8 August and peak at 29 on 11 August — then collapse to low single digits after the takedown wave of 12–13 August. Read together with the early-warning analysis of Chapter 19, this curve documents a full life-cycle: organic rumour (30 July–3 August), commercial industrialisation (4–11 August), platform enforcement (12–14 August), and attempted re-ignition for the 15 August mobilisation, where the trigger thread shows a distinct echo of 44 records on the day itself — the rumour vocabulary recycled as mobilisation vocabulary.

The investigation's flagship documentary evidence for this phase is Spanish: on 11 August — at the exact peak of the platform-vector curve — Spain's newspaper of record published a forensic exposé of 'the hoaxes that fostered the migrant avalanche', reconstructing the recruitment content, its pricing claims and its 'the door is open' slogan. That this reconstruction appeared four days before the second mobilisation, and was echoed in the UK, Turkish and Latin American nodes within 48 hours, matters for the warning assessment: the mechanics of the next wave were public knowledge, in print, before the wave arrived.

The correction deficit

21.3 The third finding is the bleakest. Against 808 records engaging with the rumour, the corpus contains exactly two dedicated fact-check records — both published 13–14 August, two weeks after the trigger and one day before the second mobilisation. Corrective information did circulate earlier, but almost exclusively as embedded paragraphs inside general news reports (626 of the thread's records are standard news reporting, 123 analysis pieces), where it competed for attention with dramatic imagery and casualty figures in the same articles. Machine-assisted manipulation assessment flagged 90 of the first week's 4,725 records (1.9%) as likely disinformation — a small fraction in relative terms, but concentrated precisely in the trigger thread's highest-velocity hours, when correction infrastructure had not yet engaged.

The structural lesson generalises beyond Ceuta, and the warning framework of Chapter 33 converts it into an indicator: the ratio of dedicated corrective content to rumour-engaged content — roughly 1:400 in this crisis — is itself a measurable early-warning variable. A information environment in which a mobilising falsehood is being repeated, contextualised and even debunked-in-passing, but never frontally corrected at scale, is an environment in which the falsehood retains operational force. The 15 August echo proves the point: the same vocabulary that moved the first crowd was available, still substantially uncorrected, to move the second.

CHAPTER 21 — KEY FINDINGS

The trigger thread (808 records, 6.2% of corpus) is synchronous with the crisis itself — the misread court ruling was reported as the operative cause from the first hours, on five continents.

Industrialisation was visible in near-real time: smuggler/recruitment records (383) and the platform-vector curve (peak 29 records/day on 11 Aug, collapse after takedowns) trace a complete rumour-to-mobilisation life-cycle.

Spain's own press published the full mechanics of the recruitment operation on 11 August — four days before the second mobilisation.

The correction deficit was extreme: two dedicated fact-checks against 808 rumour-engaged records (~1:400), with corrections otherwise buried inside general reporting.

Hostile-narrator engagement with the trigger story consistently reframed the rumour from cause to symptom of Western systemic failure — explanation versus exploitation.

Chapter 22 — The Numbers War

Every casualty figure and every arrivals figure cited in every record was extracted as structured data — 5,000+ death-toll citations and 13,000+ arrivals citations. The result is a complete map of the crisis's most consequential information battle: the fight over how many died and how many came. Neither number was ever settled, and the investigation's finding is that the unsettledness was not noise. It was the battle.

Anatomy of a 13x discrepancy

22.1 The toll citations cluster at 25 distinct values. Their genealogy, reconstructed from the record: Morocco's interior ministry acknowledged 11 dead and never publicly revised it. Spain's Ceuta delegation counted upward through the first days — 57, 67, then 72, which became the canonical 'Spanish official' figure (663 citing records, the most-cited toll in the corpus), with the Ceuta local government later citing 88. Moroccan human-rights organisations (AMDH/OMDH lineage in the reporting) circulated 141 from 7 August (262 citing records), and round-number escalations (100: 502 records; 130–140 variants) filled the space between. The P1/P2 comparison shows the escalation dynamic: P1's citation mix is led by 72/67/11; P2's by 100/96/141/82 — the median cited toll rose by roughly thirty deaths between periods without any new mass-casualty event, as identification efforts, NGO counts and burial reporting accumulated.

22.2 The by-publisher view exposes the strategic layer. Publisher countries whose coverage carried sovereignty or anti-Spain frames cite systematically higher tolls: the Moroccan distribution is bimodal (its official 11 and the NGO 141 coexisting — domestic outlets citing the government figure in news copy while amplifying NGO figures in accountability coverage); Russian and Turkish medians sit visibly above the wire consensus; and 'fortress Europe' framed records across all countries preferentially cite 100+. Conversely, the tight interquartile ranges of Germany, the UK and Latin America mark environments anchored to wire-service discipline. Death tolls, in short, behaved as narrative payloads: the number a record cited predicts its politics better than its publisher's geography does.

22.3 The arrivals series tells a subtler story. P1's median cited arrivals figure is 50,000 with a dominant mode at 72,000 (2,166 records) — the event-magnitude battle, where bigger numbers served both Spanish emergency framing and 'invasion' framing. P2's median collapses to 11,000: the story stops being how many came and becomes how many remain — the returns-and-residue battle, where small numbers served Madrid ('overwhelming majority returned') and the same small numbers served its critics ('thousands unaccounted for, including minors'). No single figure for 'how many people are currently in Ceuta' ever stabilised in the record; the corpus contains simultaneous late-August citations from 3,000 to 15,000. An information environment that cannot agree on the present tense of a crisis cannot close it — which, the investigation assesses, suited several parties.

FINDING — THE NUMBERS WAR

No actor closed the 11-vs-72-vs-141 gap in 30 days; each figure served a constituency (Rabat: containment; Madrid: managed tragedy; NGOs/critics: massacre).

Cited toll correlates with narrative position — casualty figures functioned as payloads, not measurements.

The P2 shift from arrivals-counting to residue-counting marks the story's conversion from event to condition.

Warning value: sudden convergence of hostile-narrative outlets on a new, higher figure is a leading indicator of a coming accountability offensive (observed 6–8 Aug, preceding the OMDH investigation demands).

Chapter 23 — 'Occupied Ceuta': Reconstruction of a Terminology Campaign

What a text calls Ceuta is the fastest single classifier of its politics, and the investigation tracked the designation in every record: 'autonomous city' (5,477 records — the Spanish-institutional term), 'Spanish enclave' (4,558 — the international-neutral term), neutral/unspecified (1,713), and the sovereignty-reversal family — 'occupied Ceuta' and variants (955 records, 7.4% of the corpus). The last is the campaign this chapter reconstructs.

23.1 Production. 72% of all occupied-family records (688) come from Moroccan publishers, led by mainstream digital outlets: Hespress alone produced 123, with inews.ma (51), thevoice.ma (47), Le360 (35) and al3omk (34) following — not fringe sites but the top of Morocco's Arabic digital ecosystem. Turkish (16), Israeli (15 — largely quoting the usage critically), US (14), Egyptian (13) and French (13) publishers follow at an order of magnitude lower. Distribution: the framing achieved its deepest audience penetration outside Morocco in Qatar (45.8% of node records), Saudi Arabia (36.8%), Egypt (32.4%) and Algeria (16.3%) — and, tellingly, near-zero penetration in Spain (1.0%) and Western Europe (≤2.2%): the campaign never attempted to persuade the adversary, only to consolidate the home front and the civilisational hinterland.

23.2 Tempo. The campaign's temporal signature separates it from every reactive narrative in the corpus (Chapter 18): 353 records in P1, 602 in P2 — absolute growth of 70% against a 20% shrinking total. Its two inflection points align with identifiable events: the post-15-August surge (the mobilisation re-legitimised the grievance frame) and the 24–25 August state-religious adoption, when the Minister of Endowments and Islamic Affairs invoked 'occupied Ceuta' and the 'liberation of the occupied cities' before the King — after which the term's daily volume peaked. The investigation cannot establish from open sources whether the ministerial usage was sanction of the campaign or surfing of it; either reading confirms the term had moved from periphery to state discourse in under four weeks.

23.3 Lineage. The term is not new — it is the standing vocabulary of the jihadist claim to the enclaves (Chapter 27: AQIM's 'liberation of Ceuta and Melilla', the al-Andalus doctrine) and of hardline Islamist movements, whose July–August communiqués (Hizb ut-Tahrir's 'occupied city', Al-Adl wal-Ihsan's 'occupied enclave', the PJD's 'occupied Ceuta') used it as a matter of house style. What August 2026 changed is the term's carrier class: from doctrinal and movement texts into mass-market news furniture and then state-religious address. The report flags this as the crisis's most important long-horizon development: sovereignty-reversal vocabulary was normalised across the Arabic-language mainstream while European attention was consumed by the numbers war and Spain's domestic politics. Narrative normalisation of territorial claims is historically a leading indicator, on a scale of years, of escalated assertion of those claims.

Chapter 24 — The Orchestration Conspiracies: From Fringe to Wire Service in 48 Hours

Within a day of the crossing, a family of orchestration narratives appeared, asserting that the crisis was engineered — by Israel ('Mossad plot to punish Sánchez for his pro-Palestinian positions'), by the United States, by Morocco's intelligence services, or combinations of the three. The corpus permits a quantified reconstruction of this family's mainstream penetration, which independent monitoring of radical networks (captured in the extremist-group record) complements from the fringe side.

24.1 The Israel variant: 82 records across 26 publisher countries attribute blame to Israel or 'Zionist' actors — peaking at 13 records on 31 July and 12 on 1 August, then decaying with a persistent tail. The supplier ranking is the finding: Turkey first (12 records, overwhelmingly its state agency, using attributed-claim laundering — 'Spanish figures allege...'), Morocco second (10), Spain third (9 — including origin reporting: a Spanish left-party deputy's geopolitical reading is among the cluster's seed records), then Israel itself (7, defensive coverage), Russia (5) and Qatar (4). Fringe-side monitoring documented the same claim set — 'engineered by the US, Israel, and Morocco', Morocco as 'Zionist stooge', Kalergi-plan revivals — achieving ~103 million estimated impressions via 119 influencer accounts on a single platform within 72 hours, with radical-Islamist, far-left and far-right accounts posting materially identical content. The mainstream 82 and the fringe 173 posts are textually convergent: the same accusations, the same motive theory, the same vocabulary.

24.2 The US variant ran larger and softer: 1,377 records blame the United States in some register — mostly indirect (US pressure on Morocco over Western Sahara as background cause; 'Trump designs on Ceuta' commentary) rather than operational orchestration. Its top suppliers are Moroccan (178), Spanish (170) and French (147) outlets, marking it as substantially an organic geopolitical-speculation current rather than a directed campaign — though Russian outlets fused it with the Israel variant into a unified 'Western orchestration' product (a major Russian business daily arguing Morocco-US-Israel diplomatic pressure 'though direct proof is lacking'). The Moroccan-intelligence variant, carried mainly by Russian and Spanish-opposition-adjacent outlets, asserted Rabat's services organised or permitted the crossing; a Russian investigative outlet claimed identification of Moroccan intelligence officers among the organisers. The corpus cannot adjudicate the claim; it can establish that the claim's carriers were overwhelmingly outlets with adversarial positioning toward either Rabat or Madrid.

24.3 Assessment. The 48-hour fringe-to-mainstream transit time, the state-agency conduit role, and the textual convergence between extremist networks and mainstream carriage together constitute the crisis's clearest information-warfare signature. The investigation assesses (moderate confidence, given attribution limits of open sources) that the Israel variant began as an organic conspiracy in activist and radical networks, was opportunistically mainstreamed by state-adjacent media in Turkey and Russia, and was sustained by the IUMS episode (Chapter 27) — a senior transnational clerical figure endorsing then retracting the 'Zionist conspiracy' reading — which gave the claim a religious-authority imprimatur precisely as platforms were suppressing its fringe carriers.

Chapter 25 — State Media, Disinformation and Coordination Signals

Outlet-level state-affiliation assessment allows the corpus to be read as a controlled comparison: 8,816 independent-outlet records against 1,239 state-owned, 587 state-aligned and 40 opposition records. Figure 20 shows the result, and it complicates the intuitive picture.

 25.1 Formal state media behaved better than the mean: state-owned outlets (public broadcasters, official agencies across many countries) score the highest credibility (0.656), the lowest disinformation rate (0.97%) and below-average EU-negativity — because the category is dominated by Western public broadcasters and because official agencies avoid deniable content. The action is one ring out: state-aligned outlets (privately owned, editorially tied to governments — the classic deniability layer) run EU-negative stance at 23.7% (2.9x the independent rate), 'Europe is weak' at 12.3% (2.3x) and likely-disinformation at 4.4% (4.1x). Opposition-affiliated outlets are the most extreme per record (bias 0.68, disinformation 10%) but tiny in volume. The pattern generalises a known model: states do not push conspiracies through flagship channels; they let aligned private ecosystems carry the risk. The corpus's likely-disinformation subset (249 records) maps the geography: Spain (36 — largely domestic-political fabrications), Russia (25), Morocco (21), France (16), the UK (13) and Algeria (13) lead production, while the audiences most exposed were Russia (30), the US (25), Algeria (23) and China (23). Disinformation frames skew exactly where expected: geopolitical opportunism and security-threat/invasion jointly account for 126 of 249 flagged records.

25.2 Coordination signals. Seventy-one records were flagged as showing suspected coordinated behaviour. Read qualitatively, they divide into two classes with opposite meanings. Class A (the majority): forensic journalism about coordination — fact-checkers and investigative desks documenting the misinformation campaign that triggered 30 July, the recruitment operation behind 15 August, and a transnational digital campaign that reframed the crisis into anti-Sánchez and anti-European-left narratives (one Arabic-language analysis documents slogan reuse and volume metrics across countries; a fact-checking organisation maps the same campaign's Spanish-language leg). Class B (a minority): records that are themselves probable campaign artefacts — synchronised talking points across ostensibly unrelated outlets, recycled AI-generated or out-of-context footage, and same-day multi-country appearance of identical unsourced claims. The exact-duplicate-claim analysis across publisher countries found the shared factual skeleton ('72 vs 11 dead', '48,000 returned in 48 hours') circulating as expected via wires — and, more interestingly, found near-verbatim non-wire claim clusters in the anti-Sánchez digital campaign, consistent with the Class-A forensic reporting. The investigation's net assessment: the corpus contains strong evidence of two organised information operations (the trigger campaign and the 15 August recruitment campaign, both smuggling-linked in the forensic record) and suggestive evidence of a third (the transnational anti-Sánchez/anti-left reframing campaign), with state-nexus attribution beyond open-source reach.

Chapter 26 — Vectors and Velocity: Platforms and Cross-Border Propagation

26.1 Platform-vector analysis (mentions of platforms as mobilisation or narrative vectors within records) ranks the crisis's infrastructure: short-video first (241 records), then the dominant social network (188), image-sharing (158), messaging (127), and a threads-style network (99) — with the encrypted-channel layer (31) undercounted by design, since mainstream records only reference it when investigations surface it. The short-video series' temporal structure — peaking 8–12 August, collapsing after takedowns — is the early-warning backbone of Chapter 19. The investigation notes a structural asymmetry with policy relevance: the platforms are Western-owned, the moderation regime documented in the corpus (takedowns after media notification, DSA-referenced enforcement calls) is reactive, and the mobilisation content's operational language was Moroccan Arabic dialect — a combination that guarantees detection lag precisely where warning time matters most.

26.2 Cross-border propagation speed, measured as each narrative's cumulative publisher-country reach over time (Figure 23), separates the narratives into physics classes. The mega-narratives ('Morocco weaponizing migration', 'Spain overwhelmed') reach 30+ publisher countries within 72 hours — wire-speed, agenda-neutral transmission. 'Sanchez incompetence' spreads nearly as fast but plateaus lower — a narrative with a natural constituency ceiling. 'Europe is weak' shows a two-step curve: fast initial spread through adversarial and far-right ecosystems, then a second expansion after 15 August when the second wave 'confirmed' it. 'Occupied Ceuta' is again the outlier: slow initial spread (its carriers are language-bounded), but the only curve still rising at window close — and its late adopters are the strategically significant ones (Gulf mainstream, then state-religious discourse). Fast narratives described the crisis; the slow narrative is repositioning territory. Speed, in this corpus, is inversely correlated with strategic patience.

Chapter 27 — How the Extremist Ecosystem Read Ceuta

The extremist-group record — 18 source-traced entries spanning designated jihadist organisations, hardline Islamist movements, Brotherhood-aligned bodies, far-right violent-extremist networks and radical online clusters, each preserving verbatim claims and exact sourcing — supports a structured answer to the question: what did the radical world do with Ceuta? The answer has four tiers, and its most important feature is a silence.

Tier one: the jihadist organisations — doctrinal silence, active infrastructure

27.1 No new dedicated communiqué on the July 2026 crossing was located from ISIS, al-Qaeda/AQIM, JNIM, Hamas, Hezbollah or the Taliban during the window — a finding, not an absence of finding. The investigation assesses the silence as doctrinally rational: the jihadist claim to Ceuta needs no news peg because it is standing doctrine — al-Andalus as Islamic waqf (a Zawahiri formulation deployed on ~18 documented occasions), AQIM's decades-old attacks on the Moroccan monarchy for failing to 'liberate Ceuta and Melilla and cleanse them of the impurity of Spain', bin Laden's 2001 invocation of the loss of al-Andalus. To claim a spontaneous migration would dilute the doctrine (an early ISIS editorial in the window reaffirmed that its fight is religious, not nationalist or liberationist — a frame incompatible with celebrating economic migrants). What the record does establish is active infrastructure: a Spanish-language ISIS propaganda network (multiple named producers including one created in 2025) issuing reconquest material and threats against Spain through H1 2026 — 'Al-Andalus is our ancient land and we will take it back by force' — documented by Spain's terrorism-monitoring bodies during the crisis window itself; and, operationally, Spanish reporting that specialists identified roughly ten previously expelled jihadism suspects among the arrivals via camera and social-media footage (Interior denied confirming it), followed by the reported arrest of two ISIS-linked individuals on 26 August. The jihadist tier, in short, did not exploit the event rhetorically — it may have exploited it physically, and its doctrinal frame was exploited on its behalf by everyone downstream.

Tier two: the hardline Islamist movements — the loudest contemporaneous voice

27.2 The explicit organisational exploitation came from non-violent but hardline Islamist movements, all within the first two weeks. Hizb ut-Tahrir's central media published a full analysis (12 August) framing the crossing as 'the tragedy of a people fleeing a hell created by the Moroccan regime' toward 'that occupied city', folding in US/Trump designs on Ceuta as the Strait's southern gate, and prescribing the caliphate as the only solution. Morocco's largest Islamist movement, Al-Adl wal-Ihsan, issued a communiqué (1 August) holding 'the political system' morally responsible, calling the crossing a 'field referendum' on national blockage, demanding the true casualty toll, and using 'the occupied enclave' throughout. The PJD — Morocco's former governing Islamist party — demanded a royal commission of inquiry in an eight-point communiqué that condemned government 'silence', called the event 'an expression of educational, cultural, political, social and economic bankruptcy', and used 'occupied Ceuta' as standard vocabulary. And the IUMS episode gave the tier its most consequential moment: the union's secretary-general initially framed the crossing as a 'Zionist conspiracy aided by some Islamic states' — retaliation against Sánchez for his pro-Palestinian stance — then retracted under Moroccan backlash (his original wording had implied Spanish sovereignty), reaffirming Ceuta and Melilla as 'Moroccan Islamic lands'. Note what the retraction preserved: the conspiracy was withdrawn; the sovereignty claim was strengthened. The tier-two record thus documents the exact narrative package — occupied city + regime failure + Zionist orchestration — that Chapters 23 and 24 track through the mainstream.

Tier three: the Western far right — mirror-image exploitation

27.3 White-supremacist networks ran the same event through the opposite ideology to identical structural effect. An Active Club-affiliated publication (4 August) demanded 'the law of the fist' against 'violent savages', argued Spain should have used force or armed Ceuta's citizens, invoked the Great Replacement — and blamed Israel for the surge. The movement's co-founder used a 5 August podcast to call North Africans 'the enemies of Christendom and civilisation' and to glorify the Reconquista, praising a Spanish neo-fascist group by name. The far-right tier's Reconquista glorification and the jihadist tier's al-Andalus reconquest doctrine are, structurally, the same territorial-civilisational reading of Ceuta with the polarity reversed — and both tiers converged on the antisemitic orchestration claim, which monitoring of a 119-account influencer cluster found circulating in materially identical form across radical-Islamist, far-left and far-right accounts with ~103 million estimated impressions inside 72 hours. Antisemitism functioned as the interoperability layer of the crisis's extremist information space.

Tier four: the state-adjacent religious layer

27.4 The record's final entry documents the tier that makes the others strategically significant: Morocco's Minister of Endowments and Islamic Affairs invoking 'occupied Ceuta' and 'the memory of liberating the occupied cities' before the King at the Mawlid ceremony (24–25 August) — official religious discourse adopting, in the royal presence, the exact vocabulary of tiers one and two. The investigation does not equate the ministry with extremism; it flags convergence: by late August the sovereignty frame ran unbroken from AQIM doctrine through Islamist communiqués through mass-market Moroccan media into state-religious address. Frames that achieve that span stop being extremist property and become national narrative — the single most important structural shift the crisis produced.

Chapter 28 — The Dark-Web Layer

The dark-web collection (133 validated records from Tor onion services and legacy networks, screened from 1,316 candidates) is small by design — dark-web Ceuta content is sparse — but it adds three things the surface corpus cannot: an unmoderated far-right stratum, a pre-crisis chatter baseline, and a check on whether operational (rather than rhetorical) exploitation was visible.

28.1 Composition and threat profile. 96 of 133 records are news reposts — dark-web mirrors of surface reporting, confirming that even the underground's Ceuta diet was wire-fed. The signal is in the remainder: 21 discussion records, 15 propaganda/ideological-propaganda records, and 1 explicit threat/incitement record; 17 records were scored medium threat, none high. The ideological stratum is dominated by francophone and anglophone neo-Nazi ecosystems (a French 'participatory democracy'-styled site, a long-running Anglophone neo-Nazi outlet with years of archived Ceuta fence coverage) running invasion/replacement and dehumanisation framing; late-window items include a French post celebrating nationalists 'burning camps of invaders' and a forum post invoking 'the invasion of Ceuta' while advocating war mobilisation. Notably absent: any located jihadist operational content about Ceuta, and any migration-logistics marketplace activity — the smuggling economy documented in the surface record ran on mainstream platforms, not hidden services.

28.2 The pre-crisis anomaly. The collection, sorted newest-first without date restriction, surfaced a cluster of records crawled between December 2019 and April 2026 — before the crisis — that contextualise Ceuta in two ways. The expected way: years of far-right fence-storming coverage, establishing that Ceuta was already standing symbolic inventory for the extreme right. The unexpected way: a February–April 2026 cluster discussing the hacking of the Spanish prime minister's phone, which repeatedly ties the investigation's geography and timing to Ceuta and to Moroccan intelligence (one thread names the spyware lineage and links the access to a 2021 Ceuta-Melilla trip during the previous migration crisis; others reference Ceuta as an 'epicenter' of border events in terms that anticipate 2026 vocabulary). The investigation treats crawl-date metadata on legacy networks with caution — re-crawls and page updates can misdate content, and the most anomalous phrasings are consistent with post-hoc page modification — and therefore assesses only (low-to-moderate confidence) that Spanish-sovereign cyber-compromise discourse and Ceuta border-crisis discourse were already fused in adversarial online communities months before 30 July. Under either reading, the fusion is a warning-relevant precursor pattern: communities that discuss a target's intelligence compromises alongside its border vulnerabilities are communities primed to exploit both.

Chapter 29 — The Alignment Matrix: Where the Mainstream Moved With the Extremists

The investigation's final analytical instrument distils the extremist record into six narrative families — occupied-Ceuta/sovereignty reversal; invasion/replacement; Europe-weak/Schengen-collapse; Israel-US orchestration; Morocco-blamed/weaponisation; migrants-as-threat — and scores every mainstream node for the share of its records carrying each family. The result (Figure 25) is the report's most consequential chart: a quantified map of where extremist messaging and mainstream national coverage moved in the same direction.

 

29.1 Reading the matrix. Three alignment archetypes emerge. The sovereignty bloc — Qatar (56), Saudi Arabia (40), Egypt (39), Morocco (29), Algeria (28) — aligns on the occupied-Ceuta family, the direct vocabulary of the Islamist tiers; these environments carried tier-two framing to mass audiences without carrying its authors. The weakness bloc — China (43), Israel (39), Turkey (39), Hong Kong (39), UK (35), Germany (34), Russia (34), France (33), Italy (33) — aligns on Europe-weak/Schengen-collapse, the family shared by Russian strategic messaging and the Western far right; note that mainstream Western European coverage itself scores 30+, meaning the 'Europe is failing' frame was co-produced by its targets. The threat bloc is small but sharp: Israel (16 threat / 22 invasion — the only node aligning simultaneously on both far-right-signature families), Russia (14 threat) and China (11). Spain and Portugal are the least-aligned European nodes across all families — the theatre itself resisted the extremist frames better than its neighbours.

29.2 Interpretation limits — stated bluntly. Alignment is not endorsement, coordination or sympathy. A UK humanitarian report and a neo-Nazi tract can both register 'Europe weak' theming; an Egyptian cultural feature and a Hizb ut-Tahrir communiqué both register 'occupied Ceuta'. What the matrix measures is narrative permeability: the probability that a reader in each environment encountered framing structurally identical to extremist framing, from mainstream sources, without extremist attribution. Permeability is strategically meaningful in three ways: it lowers the persuasion cost for extremist recruiters (the frame is pre-installed); it launders the frame's origin (a claim met in a mainstream outlet does not trigger source-skepticism); and it constrains governments (a Moroccan or Gulf official contradicting the occupied-Ceuta frame now swims against domestic mainstream current, not just Islamist current). By all three mechanisms, the crisis left the extremist tiers with dramatically improved narrative terrain — achieved almost entirely by mainstream actors pursuing unrelated agendas.

FINDING — ALIGNMENT

Sovereignty bloc (Qatar, Saudi, Egypt, Morocco, Algeria): 28–56% alignment with the Islamist tiers' core territorial frame.

Weakness bloc (China, Israel, Turkey, HK, Russia + Western Europe itself): 33–43% alignment with the Europe-weak family shared by Russian messaging and the far right.

Israel's node uniquely aligns on both far-right-signature families (invasion 22%, threat 16%).

Spain and Portugal resisted extremist frames best; the theatre was less permeable than its audience.

Mechanism: mainstream actors pursuing domestic agendas pre-installed extremist frames for mass audiences — no coordination required, none demonstrated.

Chapter 30 — The Economic Dimension: The Lens Almost Nobody Used

The investigation screened every record's summary, topics and keyword sets for economic content — trade, tourism, remittances, labour markets, border commerce, fiscal cost, investment, and the socioeconomic-drivers register. The headline finding is a negative one with strategic content: only 714 records (5.5% of the corpus) engage the crisis economically at all, and the distribution of that 5.5% is itself a narrative choice map.

Who used the economic lens, and for what

30.1 The lens concentrates in Qatar (12.5% of node records), Morocco (8.7%), Algeria (7.5%), Colombia (7.1%), Saudi Arabia (6.6%) and Egypt (6.5%) — and thins toward the European core (Germany 3.1%, Portugal 3.0%, China 2.7%). Content analysis of the economic subset identifies four registers. First, and dominant in Arab-world usage: the socioeconomic-drivers register — youth unemployment, price levels, the post-smuggling-economy collapse of the Fnideq borderland after the 2019–2023 closure of informal trade, and 'closed horizons' as the crossing's root cause. This register is analytically serious (the corpus's own record supports it: the crowd was overwhelmingly young, male and economically motivated) and politically double-edged — it is the exact register of the Islamist tier's 'regime bankruptcy' communiqués (Chapter 27), which is one reason Moroccan mainstream usage of it stayed carefully depersonalised, blaming 'conditions' rather than the government that produced them.

30.2 Second: the damage register — Ceuta's losses. Records document closed businesses during the emergency, port disruption, a paralysed border economy, collapsed late-summer tourism, and Ceuta's fiscal dependence on Madrid for the response; a small cluster tracks 'economic recovery in Ceuta' from mid-August. Third: the cost-of-response register, mostly European — reception costs, minors-care costs invoked by right-wing commentary, and the fiscal framing of the asylum-reform debate. Fourth, thinnest and most strategic: the leverage register — analyses reading the crisis through the economics of the Spain-Morocco relationship (trade dependency, energy and agriculture ties, fisheries, Western Sahara-linked investment expectations) and concluding, in both directions, that economic interdependence caps escalation. A handful of records extend this register to the EU level: migration-partnership funding as the price of border stability, with 'the next Ceuta' as the implied invoice.

The dog that did not bark

30.3 The near-absence of economic analysis in European coverage (3–4% in most EU nodes, against 29–34% for political-failure frames) is the chapter's finding. The crisis had a massive, quantifiable economic dimension — the emergency response, the returns operation, the minors caseload, Ceuta's business losses, the borderland economy whose destruction fed the crossing — and European information environments almost uniformly chose political framing instead. Two consequences follow. Analytically, the root-cause account (borderland economic collapse) was ceded to non-European narrators, who wrapped it in sovereignty and regime-failure packaging; no significant European current developed the economic-causation story on its own terms. Strategically, the cost question — what does border failure cost, and what would prevention cost — never entered the European mainstream during the window, leaving the post-crisis policy debate to run on security and sovereignty registers where extremist-adjacent frames are strongest. The investigation assesses (moderate confidence) that this asymmetry — economics as the Arab world's explanation and Europe's blind spot — will shape the next cycle's information terrain: actors who own the economic narrative own the only register in which the crisis is preventable rather than merely defensible.

FINDING — ECONOMIC DIMENSION

5.5% of the corpus engages economics; usage concentrates in Qatar, Morocco, Algeria, the Gulf and Colombia.

Four registers: socioeconomic drivers (root cause), Ceuta damage, European response cost, and interdependence-as-escalation-cap.

Perceived economic losers in the record: Ceuta's local economy, Spanish response budgets, the Fnideq borderland, and the migrants' households.

Perceived beneficiaries: none directly; leverage accrues to Rabat (partnership funding) and to smuggling networks whose market the crisis advertised.

European coverage largely declined the economic lens — ceding the root-cause narrative to non-European narrators.

Chapter 31 — Who Won the Information War

Benefit is measured here strictly by observable narrative outcomes in the corpus: stance movements toward the actor, adoption of the actor's preferred frames by others, agenda-setting reach, and cost imposed on the actor's adversaries. Intentions are assessed only where the evidence supports them.

Table 3. Information-war beneficiaries: measured gains, methods and costs.

Actor

Gain (measured)

Method

Cost/Risk incurred

Morocco (state)

Stance improved in 13 nodes incl. RU/CN flips; sovereignty vocabulary internationalised; blame migrated to Madrid; interdiction success story (15 Aug)

Two-track language segmentation; humanitarian counter-programming; visible P2 enforcement; official silence on numbers

Regime-failure narrative seeded domestically by Islamist tier; NGO casualty campaign unresolved

Russia

One-month 'European decline' exhibit; EU stance at corpus-worst in own node; zero attribution cost

Closed-loop re-framing; deniable orchestration narratives via state-aligned layer

None observable in corpus

China

Highest Schengen-collapse saturation of any node; governance-lesson framing; zero equity exposure

Wire-fact relay + frame selection; no fabrication required

None observable in corpus

Turkey

EU-hypocrisy narrative reinforced; leverage precedent validated; agenda reach via state agency

Attribution-laundered conspiracy carriage; migration-creditor positioning

Low; conspiracy carriage traceable (this report does)

Hardline Islamist movements

Occupied-Ceuta frame mainstreamed to state-religious level; regime-failure narrative seeded; recruitment-grade grievance archive

Rapid communiqués; vocabulary supply into mainstream Arabic media

IUMS retraction episode; visibility to monitors

European far right (incl. Vox ecosystem)

Security/invasion frame amplified; Spanish government damaged; mobilisation content produced for future use

Event exploitation; 675 Vox-linked records, stable across windows

Counter-mobilisation; conviction reporting in record

Gulf media systems

Agenda-setting power over Arabic interpretation of a European crisis demonstrated

Sovereignty frame adoption + humanitarian critique

None significant

Smuggling networks

Demonstrated mobilisation capability twice; advertising effect of 30 July

Platform recruitment; misinformation triggers

Takedowns; arrests; forensic exposure

31.1 The losers' side of the ledger is shorter and starker. The Spanish government absorbed the corpus's only unanimous stance deterioration, lost its early narrative-supply advantage to its own recriminations, and ended the window in a first-ever national-security posture with a parliamentary reckoning pending. The EU lost credibility in 17 of 21 nodes while being blamed simultaneously for weakness (by adversaries) and absence (by Spain). Israel was conscripted as villain into a conspiracy with ~103M fringe impressions and mainstream wire carriage. The migrants lost the frame war over their own story: sympathetic framing peaked in week one and was progressively displaced by security, sovereignty and burden framings — by window close, P2 records were measurably colder toward them in Russia, China, and the European policy debate. And Spain-Morocco relations lost the ambiguity that had stabilised them: the sovereignty question is now mainstream Arabic-language news furniture, which constrains Rabat's flexibility as much as it pressures Madrid.

Chapter 32 — Adversaries, Opportunists, Amplifiers, Bystanders

Synthesising Parts III–VI, the investigation classifies each measured environment by its behaviour toward the two principal targets of the crisis's information dimension — Spain/EU border credibility, and factual integrity of the record. The classification describes information behaviour in this crisis only; it is not a general geopolitical taxonomy.

Table 4. Behavioural classification of information environments in the Ceuta crisis.

Class

Environments

Defining behaviour (evidence)

Adversarial narrators

Russia; Turkey (state layer); radical online networks; far-right ecosystems

Sustained hostile framing + demonstrable carriage of orchestration conspiracies or incitement (Ch. 12, 15, 22, 25)

Strategic opportunists

China/Hong Kong; Gulf media systems; Algeria (partial)

No fabrication, but systematic frame selection converting the crisis into standing strategic narratives (Ch. 9, 10, 13)

Interested party running influence ops

Morocco

Two-track segmentation, terminology campaign, blame management — classic strategic communications by a direct stakeholder (Ch. 8, 21)

Damaged principals

Spain; EU institutions

Lost narrative control; self-generated failure framing exported worldwide (Ch. 7, 17)

Aligned-but-independent critics

Qatar's pan-Arab layer; Vatican/humanitarian current; rights NGOs

Hostile to European border regime on consistent principle, not opportunity; also hostile to Rabat's crackdown (Ch. 10)

High-integrity amplifiers

Germany; UK; Portugal; most of Latin America

Wire-disciplined, low-disinformation coverage that nonetheless amplified failure and weakness frames (Ch. 11, 16)

Conscripted target

Israel

Dragged into the conspiracy layer as villain while its own node securitised the event (Ch. 14, 22)

32.1 Two classification notes. First, 'high-integrity amplifier' is not a compliment in effect terms: the weakness bloc of Chapter 29 shows that accurate, wire-disciplined European coverage co-produced the 'Europe is failing' exhibit at 30%+ alignment rates — integrity of sourcing does not immunise against strategic frame capture. Second, Morocco's classification is deliberately distinct from the adversarial class: the corpus documents influence activity by a direct stakeholder defending equities, not third-party exploitation; conflating the two would obscure the crisis's most important asymmetry — the actors who gained most (Russia, China) had no equities at stake at all.

Chapter 33 — Warning Framework: Indicators Validated by This Crisis

The 15 August case (Chapter 18) proves that this crisis class is open-source-detectable with about a week of lead time. This chapter converts the corpus's validated signal types into a monitoring framework for the next cycle, ordered by lead time.

Table 5. Validated early-warning indicators, by lead time.

Indicator

Lead time (validated)

Signal source

Trigger threshold (suggested)

Recruitment/mobilisation pages reported by mainstream or fact-check desks

8–12 days

Fact-check and investigative desks in FR/UK/DE/ES; platform-notification reporting

≥2 independent reports naming a date or window

Short-video mobilisation-content reporting volume

4–8 days

Platform-vector mentions in daily collection

3-day rising trend above baseline ×3

Platform takedown notices for border-mobilisation content

3–7 days

Company statements; media confirmations

Any takedown citing crossing calls

Origin-side security pre-positioning reports

2–5 days

Wire + Moroccan/origin-country outlets

Named deployments around launch areas (e.g. Fnideq)

Casualty-figure convergence by hostile-narrative outlets on a new higher toll

5–10 days (precedes accountability offensives)

Numbers-war tracking (Ch. 20)

≥3 outlets adopting same new figure within 72h

Sovereignty-terminology volume acceleration

Weeks–months (strategic)

Terminology tracking (Ch. 21)

Sustained rise against news-cycle decay; carrier-class upgrade (opinion→news→official)

Fusion of cyber-compromise and border-vulnerability discourse in adversarial communities

Months (contextual)

Dark-web/forum monitoring (Ch. 26)

Recurring co-mention of target's intel incidents + border geography

Symbolic-date proximity (religious/national calendar)

Structural

Calendar overlay

Elevated posture on announced or symbolic dates

33.1 Application to the immediate horizon. At window close (28–30 August), the framework's indicators were not at rest. Mobilisation infrastructure: forensic reporting confirms recruitment ecosystems survived two takedown waves. Scheduled flashpoints: demonstrations called for 2 September; the prime minister's parliamentary appearance on 3 September; the Ceuta president in Brussels on 8 September — three dates on which renewed mobilisation calls would find maximal attention. Narrative posture: the occupied-Ceuta series was at its all-time high and state-legitimised; the minors caseload guaranteed continuing emotional fuel; and the far-right layer had shifted from commentary to street-adjacent content (the 27 August vehicle attack, camp-violence celebration in dark-web records). The investigation therefore assessed, as of the data horizon, an elevated probability of a third mobilisation attempt or a violent domestic incident in the September window, with the Canaries and Melilla corridors as displacement options if Fnideq remained saturated with security forces. This is a warning judgement derived from the indicator framework, offered with moderate confidence and explicit dependence on the framework's continued observation.

Chapter 34 — Conclusions and Outlook

Thirty-one days of global information, instrumented at scale, support a closing synthesis in five statements.

1. Ceuta 2026 was an information event with a physical component, not the reverse. Its trigger was content; its second act was a content operation physically suppressed but informationally successful; its third act was institutional self-damage propagated through the target's own media. Border agencies that model such events as physical phenomena with media consequences have the causality backwards, and will be surprised again.

2. The narrative battle was won by patient actors and lost by reactive ones. Every fast narrative — invasion, Europe-weak, incompetence — spiked and decayed with the news cycle. The one campaign that grew against the cycle, occupied-Ceuta, belonged to the actor with the longest time horizon, and it ended the window institutionalised at state-religious level. Strategic patience, not volume, was the decisive variable.

3. The extremist ecosystem's harvest required no extremists. The crisis's most effective distribution network for extremist-structured frames was the mainstream: Moroccan digital media for the sovereignty frame, European coverage itself for the weakness frame, a NATO state agency for the conspiracy frame. Counter-extremism architectures aimed at extremist channels are aimed at the wrong layer of this system.

4. Warning is an analysis problem, not a collection problem. Everything needed to anticipate 15 August was public, mainstream, and dated in advance. What was missing anywhere the corpus can see was the discipline of treating open information as a warning stream — daily, quantified, thresholded. The framework in Chapter 33 is buildable with the methods this report itself used.

5. The condition persists. The crisis ended in neither resolution nor exhaustion but in schedule: September flashpoints, an unresolved numbers war, an institutionalised sovereignty narrative, thousands of minors as standing grievance inventory, and intact mobilisation infrastructure. The next event in this series should be expected to open where this one closed — with better-prepared narrators on every side except, on current evidence, the defending ones.

Golden Owl assesses overall: the 2026 Ceuta crisis marks the operational maturity of migration-mobilisation as an information-warfare instrument in the western Mediterranean — usable by non-state networks, harvestable by states, and defensible only by actors who instrument the information environment with the same seriousness they instrument the border. This report is offered as a demonstration that such instrumentation is possible.

Annex A — Node Reference Table

Summary reference for all 21 audience nodes: volume, top frame, top strategic narrative, most-blamed actor, net stances (full window), and the node's dominant collective conclusion. Percentages are shares of node records; stances run -1 to +1.

Table 6. All-node reference summary (full window).

Node

n

Top frame

Signature narrative

Most blamed

Stance ES / MA / EU / Mig

Collective conclusion

Spain

1,633

Policy debate 28%

Sanchez incompetence 13%

Spain 22%

-0.21 / -0.14 / -0.11 / +0.25

State failure (anticipation, command, minors, cohesion)

Morocco

1,354

Humanitarian 30%

Occupied Ceuta 8% (AR track 60%)

Spain 19%

-0.14 / +0.21 / -0.14 / +0.40

Colonial question is the deep cause (AR); managed emergency (FR)

Algeria

1,050

Policy debate 30%

Occupied Ceuta 8%

Spain 20%

-0.15 / -0.01 / -0.19 / +0.27

Both rivals weakened; sovereignty subtext approved

UK

1,004

Humanitarian 34%

Schengen collapse 12%

Spain 18%

-0.09 / +0.02 / -0.15 / +0.38

Universal border fragility

United States

933

Humanitarian 32%

Invasion/replacement 9%

Spain 19%

-0.14 / -0.04 / -0.18 / +0.38

European tragedy, transferable warning

Mexico

926

Humanitarian 35%

Victims 19%

Spain 21%

-0.10 / -0.11 / -0.11 / +0.40

Humanitarian catastrophe; universal lesson

Russia

764

Policy debate 33%

Migrants as threat 9% (1st)

Spain 21%

-0.16 / -0.00 / -0.35 / +0.06

Systemic European decline; Schengen fragility

Argentina

715

Humanitarian 33%

Sanchez incompetence 22%

Spain 19%

-0.14 / -0.19 / -0.21 / +0.38

Spanish governance failure (re-consumed domestically)

China

517

Policy debate 38%

Schengen collapse 41% (1st)

Smugglers 19%

-0.08 / -0.08 / -0.40 / +0.15

Liberal governance stress-test failure

Colombia

493

Humanitarian 43%

Victims 21%

Spain 21%

-0.12 / -0.11 / -0.14 / +0.43

Humanitarian catastrophe

France

446

Policy debate 29%

Schengen collapse 12%

Spain 19%

-0.16 / -0.07 / -0.19 / +0.33

Schengen/hybrid-threat failure; France next

Hong Kong

433

Policy debate 39%

EU solidarity failure 38%

Smugglers 20%

-0.06 / -0.09 / -0.27 / +0.20

European coordination failure

Italy

414

Policy debate 37%

Invasion/replacement 11%

Spain 17%

-0.12 / -0.12 / -0.18 / +0.30

Ammunition for domestic migration war

Saudi Arabia

410

Humanitarian 30%

Occupied Ceuta 9% (term 37%)

Spain 21%

-0.17 / +0.21 / -0.27 / +0.35

Colonial anachronism produced tragedy

Germany

388

Humanitarian 35%

Victims 16%

Spain 19%

-0.06 / -0.12 / -0.18 / +0.39

EU solidarity failure with disinfo trigger

Brazil

367

Policy/Humanitarian 35%

EU solidarity failure 23%

Smugglers 18%

-0.06 / -0.06 / -0.07 / +0.43

Humanitarian catastrophe; EU coordination failure

Portugal

366

Humanitarian 32%

Victims 18%

Spain 18%

-0.08 / -0.15 / -0.07 / +0.37

Neighbouring tragedy, no agenda

Egypt

306

Policy debate 36%

Occupied Ceuta 9% (term 32%)

Spain 20%

-0.11 / +0.22 / -0.13 / +0.34

Enclave status is the deeper issue

Turkey

250

Policy debate 40%

Occupied Ceuta 5%

Smugglers 19%

-0.03 / -0.07 / -0.16 / +0.26

European hypocrisy; leverage works

Israel

116

Security/invasion 29%

Invasion/replacement 22% (1st)

Morocco 18%

-0.29 / -0.26 / -0.44 / 0.00

Borderless idealism fails; conspiracy wave confirms antisemitism

Qatar (low-n)

24

Humanitarian 38%

Fortress-Europe cruelty 17%

Spain 18%

-0.22 / -0.30 / -0.20 / +0.45

European cruelty + Arab-government failure

Annex B — Analytical Field Reference

Principal structured fields carried by every fully enriched record, grouped by function. This annex documents the analytical schema referenced throughout the report.

Table 7. The enrichment schema (~40 fields per record).

Group

Fields

Function

Provenance

collection locale, language, target country, keyword, query, window (P1/P2), vertical, result rank

Reproducibility; audience-environment attribution

Source

outlet name, resolved country, outlet type, resolution method + confidence, state-affiliation assessment

Supply-chain and state-media analysis

Temporal

page publication timestamp, detector-inferred date, normalised best date

Daily-resolution timeline analysis

Relevance

crisis-relevance flag, continuous relevance score, content type

Validation gate; corpus integrity

Framing

primary frame (fixed taxonomy), secondary frames, narrative themes (normalised), Ceuta terminology

Narrative economy and terminology-campaign analysis

Stance

stance toward Spanish government / Moroccan government / EU / migrants (5-level)

Diplomatic-weather mapping; shift analysis

Attribution

blame attribution (multi), actors praised

Responsibility-model analysis

Quantitative claims

migrant figures cited, death tolls cited, wire services cited, official-source usage

Numbers-war and dependency analysis

Manipulation

bias, sensationalism, credibility scores; propaganda techniques; manipulation indicators; disinformation flag; coordination flag

Information-quality and IO detection

Semantics

summary, key claims, key quote, entities (people/orgs/locations), topics, keywords, emotional tones, headline tone

Qualitative drill-down; entity and claim clustering

Audience

target-audience characterisation, call to action, political-exploitation flag + target

Exploitation and mobilisation analysis

Annex C — Estimative Language and Confidence Standards

This report uses three confidence bands. High confidence: multiple independent, convergent quantitative lines within the corpus; a reader can reproduce the finding from the data. Moderate confidence: strong but fewer or partially correlated lines; plausible alternative readings noted where material. Low confidence: indicative signals worth recording, flagged inline (e.g., all Qatar-node findings, n=24; the dark-web pre-crisis cluster, where crawl-date metadata is treated as unreliable). Judgements about intent (e.g., 'deliberate audience segmentation') are made only where behavioural evidence is systematic, stable across periods, and consistent with known practice — and are downgraded explicitly where attribution rests on pattern rather than proof. Nothing in this report relies on a single record; every major finding cites its aggregate evidentiary base in the relevant chapter.

Golden Owl — Open-Source Intelligence & Research. goldenowl.ai. This assessment was produced from publicly available information collected between 30 July and 30 August 2026 and reflects the information environment as of the data horizon. It will be superseded by events.

Annex D — Chronological Intelligence Log

This annex provides the day-by-day quantitative record of the collection window. For each day the log reports total validated records, the dominant primary frame, the most frequent narrative theme, the share of records negative toward Spain (the crisis's most sensitive single indicator, per Chapter 18), and the notable events documented in the corpus for that day. The log is designed to serve as a standalone reference: an analyst reconstructing any single day of the crisis can locate its volume, its framing centre of gravity and its documented events in one row.

Table 8. Daily intelligence log, 28 July – 30 August 2026 (validated corpus).

Date

Records

Dominant frame

Top narrative

Neg. to Spain

Documented events

2026-07-28

1

Migration-policy debate

Morocco-Spain tension

0.0%

 

2026-07-30

431

Humanitarian crisis

Spain overwhelmed

10.4%

Mass crossing begins at Tarajal; first drownings; Ceuta requests military support.

2026-07-31

1,138

Migration-policy debate

Spain overwhelmed

9.4%

Peak crossing and peak global coverage day; Spain deploys military; first casualty disputes.

2026-08-01

704

Migration-policy debate

Spain overwhelmed

8.1%

Italy suspends Schengen obligations unilaterally; mass returns to Morocco begin.

2026-08-02

526

Humanitarian crisis

migrants as victims

8.7%

~48,000 returns reported within 48h; EU interior ministers convene.

2026-08-03

679

Humanitarian crisis

Morocco weaponizing migration

9.3%

Dutch government demands Commission investigation.

2026-08-04

796

Migration-policy debate

Morocco weaponizing migration

8.0%

Madrid reportedly asks allies not to blame Morocco publicly; platform recruitment reporting begins climbing.

2026-08-05

388

Humanitarian crisis

Spain overwhelmed

9.5%

Reports of previously expelled jihadism suspects among arrivals (denied by Interior).

2026-08-06

352

Humanitarian crisis

migrants as victims

10.8%

Moroccan NGO casualty toll of 141 begins circulating.

2026-08-07

351

Humanitarian crisis

Spain overwhelmed

8.8%

Court-ruling misinformation dissected in mainstream press.

2026-08-08

216

Migration-policy debate

Spain overwhelmed

13.4%

First reporting on '15 August' online mobilisation calls; platform-vector reporting accelerates.

2026-08-09

161

Migration-policy debate

Spain overwhelmed

21.1%

 

2026-08-10

224

Migration-policy debate

Morocco weaponizing migration

15.6%

 

2026-08-11

172

Migration-policy debate

migrants as victims

8.7%

Peak platform-vector reporting (29 records); Spanish press publishes recruitment-hoax exposé.

2026-08-12

183

Migration-policy debate

Morocco weaponizing migration

16.4%

Takedown wave begins; recruitment-page reporting collapses.

2026-08-13

195

Humanitarian crisis

Spain overwhelmed

16.9%

 

2026-08-14

200

Humanitarian crisis

Morocco weaponizing migration

9.5%

Morocco pre-positions security forces around Fnideq; dedicated fact-checks finally appear.

2026-08-15

661

Migration-policy debate

Spain overwhelmed

11.3%

Second mobilisation largely thwarted; mass arrests around Fnideq; global stance realignment begins.

2026-08-16

368

Humanitarian crisis

Spain overwhelmed

9.0%

Arrest-operation reporting (294 and 111 detained in cited operations).

2026-08-17

348

Humanitarian crisis

Spain overwhelmed

18.4%

 

2026-08-18

333

Humanitarian crisis

migrants as victims

16.2%

OMDH demands independent casualty investigations.

2026-08-19

296

Humanitarian crisis

migrants as victims

16.2%

 

2026-08-20

417

Humanitarian crisis

migrants as victims

9.4%

Unaccompanied-minors dispute escalates between Ceuta, Madrid and autonomous communities.

2026-08-21

395

Humanitarian crisis

migrants as victims

14.4%

 

2026-08-22

269

Humanitarian crisis

migrants as victims

21.2%

 

2026-08-23

170

Humanitarian crisis

Spain overwhelmed

25.9%

 

2026-08-24

342

Migration-policy debate

Spain overwhelmed

13.7%

Moroccan Islamic-affairs minister invokes 'occupied Ceuta' before the King at Mawlid.

2026-08-25

583

Migration-policy debate

Spain overwhelmed

16.3%

Sovereignty narrative peaks across Arabic-language nodes.

2026-08-26

526

Migration-policy debate

Spain overwhelmed

24.5%

Spain declares national-security situation; unified command established.

2026-08-27

713

Humanitarian crisis

Spain overwhelmed

22.3%

Third coverage peak — 'Sánchez incompetence' narrative records its best day of the window; military vehicle attacked; 12 arrests.

2026-08-28

133

Humanitarian crisis

Spain overwhelmed

24.8%

Asylum-law reform advances; collection window closes.

2026-08-29

59

Humanitarian crisis

Spain overwhelmed

10.2%

 

2026-08-30

34

Migration-policy debate

Spain overwhelmed

14.7%

 

Annex E — Narrative Catalogue

The investigation tracked twelve strategic narratives across the full corpus using narrative taxonomy assignment. This annex catalogues each narrative with its definition, total validated volume, temporal profile (share of volume occurring in P1), peak day, and life-cycle classification as developed in Chapter 18. All twelve narratives achieved full cross-border reach, appearing in publications from all fifteen active publisher countries — the measure that separates this crisis from routine migration coverage, where fringe narratives typically remain geographically contained.

Table 9. The twelve tracked strategic narratives (all reached 15 of 15 publisher countries).

Narrative

Definition

Records

P1 share

Peak day

Life-cycle class

Spain overwhelmed

Spanish state capacity exceeded by the crossing

6,646

55.0%

31 Jul (698)

Reactive mega-narrative; event-locked

Morocco weaponizing migration

Rabat used or tolerated the flow as statecraft

5,231

62.6%

31 Jul (529)

Reactive; P1-weighted, persistent

Migrants as victims

Humanitarian framing centred on the crossers

5,102

56.0%

31 Jul (384)

Reactive mega-narrative; durable

Schengen collapse

Free movement system failing under pressure

2,764

79.4%

31 Jul (426)

Front-loaded; policy-event-driven

Sánchez incompetence

Personal failure of the Spanish PM

2,231

47.3%

27 Aug (246)

Escalating; only narrative peaking in P2

EU solidarity failure

Member states abandoning Spain

2,169

73.9%

4 Aug (299)

Front-loaded; summit-driven

Occupied Ceuta

Enclave as occupied Moroccan territory

1,821

52.7%

31 Jul (190)

Campaign signature; sustained, re-peaked 15 & 24 Aug

Fortress Europe cruelty

EU border regime as morally culpable

1,020

52.4%

31 Jul (107)

Reactive; humanitarian-adjacent

Invasion / replacement

Crossers as civilisational threat

821

66.9%

31 Jul (138)

Reactive; far-right carrier

Europe is weak

Structural European decline diagnosis

744

73.4%

31 Jul (92)

Front-loaded; hostile-state carrier

Migrants as threat

Crossers as direct security danger

397

51.9%

31 Jul (58)

Reactive; low-volume, wide reach

Western hypocrisy on refugees

Ukraine-comparison double-standard charge

334

62.0%

31 Jul (30)

Opportunistic; Global-South and hostile carriers

Two structural observations emerge from the catalogue. First, eleven of twelve narratives peaked on 31 July — they were reactions, at global scale, to the same event. The single exception, 'Sánchez incompetence', peaked on 27 August, four weeks later: it is the only narrative in the corpus whose energy came from the information war itself rather than from the physical crisis, and its late peak marks the point at which the story ceased to be about Ceuta and became about Madrid. Second, P1 share separates narratives that burned out with the emergency (Schengen collapse, 79.4% P1) from those built to outlast it — 'occupied Ceuta' at 52.7% and the Sánchez narrative at 47.3% carried the majority or near-majority of their volume after the emergency had physically subsided, the temporal signature of narratives with sponsors rather than merely audiences.

Annex F — Glossary of Analytical Terms

Terms are defined as used operationally in this report. Where a term has a broader meaning in the intelligence literature, the definition below governs.

Table 10. Glossary of operational terms.

Term

Definition as used in this report

Node

A national or territorial audience information environment (e.g. 'the Morocco node'): the set of validated records collected for consumption in that environment, regardless of where they were published.

Publisher country

The country of the outlet that produced a record. Distinct from the node (audience); the divergence between the two defines the information supply chain of Chapter 4.

P1 / P2

The two research periods: P1 from 30 July to 15 August 2026; P2 from 15 August to the close of collection on 28–29 August.

Primary frame

The single dominant interpretive lens assigned to a record by automated semantic classification (e.g. humanitarian crisis, security threat, EU weakness).

Narrative theme

A recurring strategic storyline tracked across records, languages and borders (Annex E); a record may carry several.

Stance

A record's assessed attitude (positive / neutral / negative) toward each of four reference actors: Spain, Morocco, the EU, and the migrants.

Net stance

Share of positive records minus share of negative records toward an actor, in percentage points; the report's standard measure of an environment's lean.

Blame attribution

The actor(s) a record identifies as responsible for the crisis, extracted per record and aggregated per node and period.

State-affiliated outlet

An outlet classified as state-owned or state-aligned on the basis of ownership, funding or documented editorial control.

Wire dependency

The share of a node's records sourced from or crediting international news agencies; a measure of imported versus domestically produced framing.

Coordination signal

A pattern consistent with orchestrated publication — synchronised timing, duplicated claims, shared vocabulary across nominally independent outlets. A signal, not proof.

Trigger thread

The 808-record subset engaging with the misread judicial ruling and its rumour ecosystem (Chapter 21).

Alignment score

The measured overlap between a mainstream node's narrative profile and one of six extremist narrative families (Chapter 29). Measures convergence, not coordination.

Early-warning window

The 8–14 August interval during which the second mobilisation was forecastable from open sources (Chapter 19).

Manipulation assessment

Machine-assisted scoring of bias, sensationalism and credibility per record; 'likely disinformation' flags derive from this layer.

Estimative language

Probability and confidence vocabulary standardised in Annex C; all judgements in this report use it.

Annex G — Collection and Processing Statistics

This annex provides the underlying statistical tables of the validated corpus for reference and reproducibility: the node-by-period volume matrix, the language composition, and the outlet-type and content-type distributions. All figures refer to the final validated analytical dataset after relevance filtering, deduplication and normalization, as described in Chapter 3.

G.1  Records by node and research period

Table 11. Validated records per node and research period. P1: 30 Jul–15 Aug; P2: 15–29 Aug 2026.

Node (audience environment)

P1 records

P2 records

Total

P2 vs P1

Spain

853

780

1,633

-8.6%

Morocco

745

609

1,354

-18.3%

Algeria

527

523

1,050

-0.8%

United Kingdom

585

420

1,005

-28.2%

United States

516

417

933

-19.2%

Mexico

509

418

927

-17.9%

Russia

437

331

768

-24.3%

Argentina

349

372

721

+6.6%

China

371

149

520

-59.8%

Colombia

235

258

493

+9.8%

France

291

155

446

-46.7%

Hong Kong

310

123

433

-60.3%

Italy

205

211

416

+2.9%

Saudi Arabia

182

228

410

+25.3%

Germany

211

197

408

-6.6%

Brazil

198

170

368

-14.1%

Portugal

222

144

366

-35.1%

Egypt

164

143

307

-12.8%

Turkey

188

62

250

-67.0%

Israel

93

23

116

-75.3%

Qatar

10

14

24

+40.0%

The P2-versus-P1 column is an attention-persistence measure. Environments in which coverage decayed steeply after the emergency (strongly negative values) treated Ceuta as an event; environments in which volume held or grew treated it as a story — the distinction developed in Chapter 18.

G.2  Language composition

Table 12. Language composition of the validated corpus (languages with at least 20 records).

Detected language

Records

Share of corpus

es

3,777

29.2%

en

1,941

15.0%

ar

1,889

14.6%

fr

1,693

13.1%

ru

753

5.8%

pt

726

5.6%

zh

646

5.0%

it

420

3.2%

de

389

3.0%

tr

246

1.9%

zh-Hant

205

1.6%

he

116

0.9%

zh-tw

30

0.2%

zh-hant

29

0.2%

zh-TW

21

0.2%

G.3  Outlet-type and content-type distributions

Table 13. Publisher outlet types across the validated corpus.

Outlet type

Records

Share

private_mainstream

8,898

68.7%

public_broadcaster

1,449

11.2%

aggregator

607

4.7%

news_agency

569

4.4%

blog

512

4.0%

state_media

505

3.9%

party_or_movement_media

80

0.6%

tabloid

50

0.4%

other

44

0.3%

state_aligned

20

0.2%

independent

15

0.1%

state_affiliated

2

0.0%

local_or_regional_media

1

0.0%

public_mainstream

1

0.0%

state_affiliation

1

0.0%

Table 14. Content types assigned by context-aware record classification.

Content type

Records

Share

news_report

10,722

82.8%

analysis

1,029

7.9%

opinion

305

2.4%

blog

279

2.2%

other

232

1.8%

live_blog

129

1.0%

interview

115

0.9%

editorial

46

0.4%

official_statement

31

0.2%

video

13

0.1%

fact_check

2

0.0%

video_report

2

0.0%

commentary

1

0.0%

photo_reportage

1

0.0%

video_clip

1

0.0%

 

 
 

 

 

End of Document — Ceuta 2026: Anatomy of an Information War Beyond the Border