On July 30th and 31st, 2026, tens of thousands of people crossed from Fnideq in northern Morocco into the Spanish city of Ceuta, most of them swimming or wading around the Tarajal breakwater. Media reports later put the number at more than 72,000, with at least 96 deaths reported by mid-August and more than a thousand unaccompanied minors among those who crossed. Ceuta's residents and public services absorbed the shock in real time, and a second wave followed on August 15th.
The event had been building in plain sight for weeks, and Vetric traced what was visible online against the moment media and authorities reacted in Below the Caption: The Digital Footprint of the Ceuta Border Crossing. The research draws on 352,891 relevant posts from more than 100,000 accounts and channels across five social media platforms and six languages, content that together drew more than 5.4 billion views.
The second wave's date sat on a video cover for 17 days
The clearest early signal was written on an image. On July 29th, the date August 15th appeared across the cover of a short-form video, five days before the first media report and about two weeks before Morocco's official warning. It was in Moroccan Darija and lived in on-screen text, so keyword and hashtag searches had no way to read it.
The signals added up before the volume did
On July 12th, 18 days before the peak, a Moroccan social media page turned a Spanish Supreme Court ruling into a simple promise to swimmers: they won't send you back. Videos of people who had already made it to Ceuta multiplied, rising from two to six a week in early July to 28 in the week before the crossing. El Faro de Ceuta, a small local newspaper, reported rising pressure three to four weeks before the peak, while national and international media mostly reported after the fact.
Language told its own story. Posts in Arabic outnumbered posts in Spanish on only two days, July 28th and 29th, which were the two days right before the peak, and the Moroccan side of the border saw the event coming one to two days before the Spanish side.
Volume, meanwhile, came last. Until July 25th, relevant posts were a small fraction of the peak, and on August 15th overall volume rose only about 17% even though the date had been public for more than two weeks. A team waiting for a spike would have learned about the crossing while it was already happening.
Recycled videos and a few loud accounts shaped the story
As the crossing unfolded, misattributed footage traveled faster than the corrections. One recycled video ran as a Ceuta crossing in 61 posts with 28 million views, and only two of those posts mentioned that it had been debunked. The "invasion" frame was concentrated in a few hands as well, because 43 commentators and news pages wrote under 3% of the posts using the word but drew 38% of their views. Amplification like this could deepen fear in Ceuta and harden attitudes toward the people who crossed, adding to the harm on every side of the border.
Four places monitoring needs to look
The report identifies four blind spots in the way most teams monitor open sources, and each one held early signals at Ceuta:
- Both languages of a border: the earliest posts were in Arabic and Moroccan Darija, on the side where the crossing began
- Text on images: dates and instructions written across video covers, where caption and hashtag searches can't reach
- Comment threads: the conversations beneath posts, which carried part of the story the posts left out
- Local outlets: newspapers close to the event, which reported weeks ahead of national coverage
Why Vetric published this research
Vetric initiated and funded this research independently. No government, agency, platform, client or partner requested, commissioned, guided or reviewed it, or received its findings before publication. It draws only on publicly available content, enters no closed groups and names no private individuals.
Vetric published it because many kinds of activity build up on social networks long before they happen on the ground, and the teams that protect people need to see those signals early enough to prepare care and reception and to counter rumors before they spread.
The full report is written for threat intelligence, OSINT, risk, and trust and safety teams, as well as researchers, journalists, policymakers and humanitarian responders. It includes the complete timeline and a table of 14 signals with the lead time each one gave at Ceuta, from three to four weeks for local newspaper reporting to two days for a shift in vocabulary toward movement and crossing.
