Hacking the Border: FOMO, Facebook Groups and the Algorithmic Snowball That Overwhelmed Ceuta

Methodological note — This analysis draws on publicly available information, academic research and professional field experience spanning migration, rights, communication and digital dynamics. It does not represent the position of any organisation, nor does it attribute the events to any state in the absence of verifiable evidence.

A border does not necessarily have to be "hacked" with a computer.

It can also be overwhelmed by a rumour, a Facebook group, a stream of videos, favourable weather and thousands of individual decisions taken at almost the same moment.

This is arguably one of the central lessons of the Ceuta crisis of July 2026.

Published estimates shifted considerably. Initial reports referred to nearly 50,000 crossings on 30 July, while broader assessments later approached 72,000 entries or attempted entries across the wider episode. By 3 August, more than 860 unaccompanied children remained in Ceuta amid an overstretched reception system. These discrepancies call for caution when using the figures, but they do not alter the central finding: within a matter of hours, a territory of fewer than 90,000 residents faced a volume of arrivals that its ordinary procedures could not absorb.

The most seductive explanation would be geopolitical: an organised operation, a diplomatic signal, a response to Pedro Sanchez's visit to Algeria, or another instance of the instrumentalisation of migration.

But chronology is not evidence.

At this stage, no public investigation has established that a state planned or directed the mobilisation. Available reporting has not identified a centrally coordinated disinformation campaign. Instead, it documents a mixture of rumours, migration-focused accounts, community conversations, opportunistic intermediaries and videos of successful crossings.

The reality may be less politically spectacular, but it is far more significant from a systems perspective: the border was overwhelmed like an infrastructure subjected to a sudden surge in demand.

1. The starting point: when a legal signal becomes a promise

On 29 June 2026, Spain's Supreme Court ruled that the special "rejection at the border" regime applicable at the fences of Ceuta and Melilla could not automatically be extended to people intercepted at sea while attempting to enter by swimming.

The Court did not declare the borders open.

It did not grant an automatic right to remain.

It held that people intercepted at sea should be processed under the ordinary return procedure, with the corresponding administrative safeguards, rather than being immediately handed back without a procedure.

That legal nuance disappeared as the ruling circulated online.

The complex message - that a specific procedure could not be applied to certain maritime interceptions - was gradually reduced to a much simpler claim:

"People who enter by sea can no longer be sent back."

It then became an implicit call to action:

"The border is open. Now is the time to leave."

Spain's extraordinary regularisation process also fed the confusion. Yet the measure did not apply to newly arrived people. It was intended for those already present in Spain before a specified date and able to demonstrate a minimum period of residence.

This is where the real phenomenon begins: the distortion of a legal signal until it becomes a perceived window of collective opportunity.

2. Hacking a border is not the same as hacking a computer

The hacking metaphor must be used with precision.

The people who crossed were not, of course, bots. They were individuals with histories, motivations, vulnerabilities and agency.

The analogy concerns the border system, not the people.

A modern border is made up of a set of finite capacities:

• surveillance and detection;
• land and maritime intervention;
• search, rescue and medical care;
• administrative identification;
• distinguishing adults from children;
• assessing protection needs;
• accommodation;
• transport and institutional coordination.

Each component has a maximum throughput. A finite number of officers can process only a finite number of situations within a given period. A centre can accommodate only a limited number of people. A child-protection system cannot assess several hundred new cases at once.

When thousands of people arrive within the same narrow time window, the system is not necessarily bypassed through a sophisticated technique. It is exceeded by sheer volume.

In computing, a distributed denial-of-service attack, or DDoS, does not always seek to penetrate the core of a system. It generates more requests than the system can process until the service becomes unavailable.

In Ceuta, the comparison is systemic:

The breakdown was caused not by the complexity of each individual action, but by their simultaneity.

Spain had set Ceuta's ordinary administrative reception capacity at just 29 unaccompanied children. A few days after the mobilisation, more than 860 children were still in the city. The figure of 29 does not represent the total physical number of emergency beds that could be mobilised; it is a statutory benchmark for ordinary capacity. Even so, the gap illustrates the scale of the mismatch between the system that had been planned and the shock it received.

3. From rumour to action: the six stages of the snowball effect

Digital media do not create the desire to leave on their own. Economic frustration, aspirations for autonomy, territorial inequality and idealised representations of Europe all predate Facebook.

Platforms can, however, convert a diffuse aspiration into synchronised collective behaviour.

The dynamic observed in Ceuta can be broken down into six stages.

1. An ambiguous signal appears

A complex judicial decision is published.

2. The signal is simplified

Legal nuance gives way to a more emotionally compelling assertion: "they can no longer send us back".

3. Groups lend the message an appearance of credibility

The information is no longer received from a single unknown individual. It is repeated by members of the same community, specialist accounts and, at times, people presented as having first-hand knowledge of the border.

4. Images provide social proof

A person who reaches Ceuta, records the arrival and celebrates the crossing produces a form of evidence more persuasive than an official statement.

Yet the image establishes only one fact: one person reached a particular place at a particular moment. It does not prove that the person will be allowed to remain, avoid return, or reach mainland Spain.

5. FOMO shortens the time available for reflection

Fear of Missing Out refers to the anxiety that others may benefit from an experience or opportunity from which one is excluded. Foundational research on FOMO links it to more intensive social-media use. Among adolescents, it is also associated with the need to belong, peer comparison and the perceived need to remain continuously informed about what others are doing.

In the Ceuta context, the message was no longer simply: "some people made it".

It became:

"They are making it now. The window may close. Those who wait will be left behind."

6. Action generates new content that restarts the cycle

Every filmed crossing reinforces the original belief. Every crowd video strengthens the perception that the movement has become irreversible. Every livestream draws in new viewers, some of whom may become participants themselves.

Research on online diffusion shows that information can spread in "cascades", combining simple and complex contagion. Under complex contagion, a person does not necessarily change behaviour after seeing a single message. The tipping point comes after receiving multiple confirmations from different people across the network.

4. Facebook: not the proven origin, but an infrastructure for coordination

It would be inaccurate to claim that Facebook organised the events.

It would be equally inaccurate to treat the platform as a neutral noticeboard.

A Facebook group can perform several functions at once:

• bring together people who do not know one another;
• provide access to an already established community;
• resurface older content;
• recommend related groups;
• send notifications;
• turn reactions and comments into signals of popularity;
• sustain a conversation over days or weeks.

On 4 August, El Pais documented discussions involving thousands of users around a possible new mobilisation on 15 August. The exchanges combined calls to participate, logistical questions, rumours, warnings, accounts of danger and suspicions of manipulation. That mixture matters: a migration-focused group is not automatically a criminal network or a space of incitement. It can, however, become an infrastructure for coordination when a date, a location and a shared perception of opportunity begin to converge.

Facebook provides network persistence. Instagram and TikTok supply visual proof. WhatsApp facilitates private and interpersonal circulation. Livestreams compress the delay between observation and action.

What once required weeks of physical contact can now be accelerated through a sequence of posts, recommendations and notifications.

The decisive change is not simply the volume of information available.

It is the compression of time between the signal and the move to action.

5. Collective saturation predates the algorithms

Collective strategies for crossing the borders of Ceuta and Melilla did not begin in 2026.

Among communities of people on the move from sub-Saharan Africa, the term "boza" generally refers to successfully reaching Europe. Depending on the context, it can also denote a collective process, a period of waiting and a shared projection towards the crossing.

Ethnographic research on informal encampments near Ceuta and Melilla describes spaces often organised by nationality or community. People may wait there for extended periods, observe the terrain, share resources and prepare several attempts. The notion of a "convoy" highlights the collective and organised dimension of some operations, sometimes preceded by months or even years of waiting and learning.

Collective mobilisation follows a practical logic: when a control system can stop a small group, simultaneity increases the likelihood that some people will get through.

The events of July 2026 nevertheless introduced a major difference.

Traditional collective "bozas" relied heavily on:

• physical proximity;
• relationships of trust;
• encampments;
• gradual preparation;
• locally shared knowledge.

Digital mobilisation allows for far more diffuse coordination. Participants may come from different cities, have no connection to the same original network and join the movement at a late stage simply because they perceive a window of opportunity.

Digital media did not invent the strategy of saturation.

They accelerated it, expanded it and made it visible in real time.

6. Timing the movement: an operational window, not necessarily a central command

Does a mobilisation of this scale require a single command structure?

Not necessarily.

Distributed systems can generate coordination without a central leader when participants share the same information and respond to the same signals.

Several factors may have converged in Ceuta.

More favourable sea conditions

Marine forecasts issued by Spain's meteorological agency indicated calmer conditions in the Algeciras-Ceuta area between 29 and 30 July, with no conditions warranting a maritime warning. A calmer sea does not make the crossing safe, but it temporarily reduces one of the main obstacles to swimming or using improvised flotation devices.

A symbolic public holiday in Morocco

The peak coincided with Throne Day. Several media investigations noted that the calendar may have slowed the administrative response or contributed to less consistent vigilance.

The publicly available sources do not, however, provide a precise hour-by-hour breakdown of Moroccan personnel deployed at the border. To claim that the area was deliberately left understaffed would therefore go beyond the verifiable evidence. The appropriate question is operational: were duty systems adequately designed to detect and contain a sudden digitally driven mobilisation during a public holiday?

An established perception of success

Crossings had already been documented before the main peak. Once the first arrivals shared their images, information about the real-time state of the control system travelled faster among participants than through institutional chains.

A connected crowd can therefore identify a local weakness and move into it, even when no central organisation has designed the operation as a whole.

7. Why geopolitics is not a sufficient explanation

Pedro Sanchez's visit to Algeria, relations between Rabat and Madrid, the Moroccan Sahara and the status of Ceuta are all part of the genuine political context.

They do not, on their own, establish causation.

Dismissing the possibility of instrumentalisation without an investigation would be as imprudent as presenting it as established fact. Yet the evidence publicly available on 6 August did not demonstrate state orchestration. Narratives involving the United States, Israel or a Moroccan retaliatory operation remained largely speculative.

Geopolitical explanations are media-friendly. They offer a mastermind, an intention and a culprit.

The systems explanation is more unsettling: no single actor necessarily controls the phenomenon as a whole.

A rumour can emerge without a centre. Opportunistic actors can exploit it without coordinating with one another. Young people can act for different reasons. A platform can amplify the entire process without anyone at Meta ever deciding to encourage movement towards Ceuta.

The possible absence of a conductor does not remove responsibility.

It relocates it.

Attention must then turn to platform design, detection capacity, the circulation of official information and the preparedness of border systems for synchronised collective behaviour.

8. Meta's responsibility: three distinct questions

Meta's responsibility should be neither overstated nor dismissed.

It should be examined at three levels.

1. Did Meta create the rumour?

There is no public evidence that it did.

The precise origin of the belief that the border was "open" remains difficult to trace. It circulated across public accounts, groups, videos and private channels. On 4 August, Le Monde reported that it had found no coordinated campaign and that Meta had not responded to requests for comment by the time of publication.

2. Did Meta's systems amplify the rumour and the calls to act?

That is plausible, but it cannot be demonstrated without access to internal data.

The following information would be required:

• the organic and recommended reach of the posts;
• the number of views generated by algorithmic suggestions;
• changes in group membership;
• the proportion of exposed users who were children;
• content recommended to people who did not initially follow any migration-related account;
• the role played by notifications;
• the velocity of videos after the first arrivals;
• interactions between Facebook and Instagram.

Without these data, the public effects can be observed, but the precise role of recommendation systems cannot be measured.

3. Did Meta adequately assess and mitigate the risk?

This is where the issue becomes regulatory.

Facebook and Instagram are designated as very large online platforms under the European Union's Digital Services Act. Articles 34 and 35 of the DSA require them to assess systemic risks arising from their services and to adopt reasonable, proportionate and effective mitigation measures.

Those assessments must consider, among other issues:

• fundamental rights;
• the protection of children;
• public security;
• the effects of recommender systems;
• content-moderation processes;
• regional and linguistic specificities.

The final point is crucial.

A detection system that performs well in English or French may fail when confronted with Moroccan Darija written in Arabic script, Latin characters, numerals or local variants. An apparently ordinary expression can acquire an operational meaning within a particular community.

In April 2026, the European Commission provisionally found that Meta had not done enough to prevent children under the age of 13 from accessing Facebook and Instagram. In July, it also provisionally concluded that certain features - including infinite scroll, autoplay, notifications and highly personalised recommendations - posed risks that were not being adequately managed, particularly for children. These proceedings are separate from Ceuta and do not establish any wrongdoing by Meta in this crisis. They nevertheless show that age assurance, recommender systems and the protection of young users already sit at the centre of European regulatory scrutiny.

9. What an independent audit should ask of Meta

This is not a call for the general surveillance of private conversations.

It is a call to determine whether public recommendation and moderation systems responded proportionately to a clear risk affecting, in particular, children.

A serious audit should request:

1. Immediate preservation of relevant data

   Recommendation logs, changes in reach, group growth and a timeline of moderation actions.

2. An analysis of children's exposure

   The estimated number of users under 18 who encountered the principal content, and the proportion of that exposure generated through recommendations.

3. A linguistic assessment

   Resources allocated to Moroccan Arabic, transliterated Darija and expressions specific to communities of people on the move.

4. Detection timelines

   The point at which Meta's systems identified an abnormal increase in publications, groups or interactions related to Ceuta.

5. Handling of reports

   The number of notices received, the categories used, response times and decisions taken.

6. Measures to reduce amplification

   Any limitation of recommendations, addition of contextual information or redirection towards reliable sources.

7. Child-protection measures

   Specific steps applied to accounts known or presumed to belong to children when content presented an immediate risk of physical harm.

The question is not whether Facebook should have removed every discussion about migration.

False information is not automatically unlawful. A discussion about Ceuta may fall within freedom of expression, journalism, mutual support or humanitarian warning.

Responsibility lies in distinguishing between:

• reporting on a situation;
• debating a decision;
• documenting a crossing;
• circulating a false legal guarantee;
• recruiting or exploiting people;
• encouraging children to undertake an action involving immediate danger.

10. The remedies available to states

Public authorities are not limited to informal requests asking platforms to "do something".

Orders addressing specific illegal content

Article 9 of the DSA allows a competent judicial or administrative authority to order action against specific content when it is illegal under the applicable law.

The order must be reasoned and include the information needed to identify the content precisely, including one or more exact addresses. It cannot be used to demand the blanket removal of all discussions relating to Ceuta.

Trusted flaggers

Organisations established in the European Union and possessing particular expertise may be designated as "trusted flaggers". Platforms must give priority to their notices of potentially illegal content. This mechanism could involve bodies specialising in child protection, trafficking, exploitation and the rights of migrants.

Complaints to the CNMC and the European Commission

Spain's National Commission on Markets and Competition (CNMC) is the country's Digital Services Coordinator. Users established or located in Spain may submit complaints when they believe a provider has failed to comply with its obligations under the DSA.

The CNMC does not itself decide whether a particular item of content should be removed. It supervises compliance with due-diligence obligations and cooperates with other regulators.

For systemic risks associated with very large platforms such as Facebook and Instagram, the European Commission has the leading supervisory role. It may request information, obtain access to data, carry out inspections and open formal proceedings.

The European crisis-response mechanism

Article 36 of the DSA provides that, in a crisis constituting a serious threat, the Commission may require a very large platform to assess how its service contributes to that threat, take specific measures and report on its actions.

The mechanism is not automatic. It must be formally activated, limited in time and implemented with respect for fundamental rights. The regulation also provides for voluntary crisis protocols designed to respond rapidly to the large-scale spread of disinformation or to support the circulation of reliable information.

What about Morocco?

Morocco is not a member state of the European Union and cannot, acting alone, activate the DSA's full institutional architecture.

It can, however:

• document specific content that presents a risk;
• initiate procedures available under national law;
• cooperate with the Spanish authorities;
• use the platforms' institutional channels;
• share early-warning signals with child-protection services;
• participate in a bilateral information-integrity mechanism.

The cross-border nature of the issue requires operational cooperation. A rumour may originate in Morocco, be amplified by a company established elsewhere, produce effects in Spain and affect people subject to several different legal frameworks.

11. Responding to algorithmic mobilisation without criminalising young people

The wrong response would be indiscriminate surveillance of every conversation about migration.

Such an approach would be disproportionate, legally fragile and probably ineffective.

An effective response must combine technology, communication, protection and operational preparedness.

1. A Moroccan-Spanish information-integrity cell

It would bring together the relevant authorities, child-protection services, researchers, field-based civil-society organisations and platform specialists.

Its purpose would not be to determine which opinions are acceptable. It would identify factually false information capable of creating an immediate danger.

2. A multilingual response within hours

When a judicial decision is distorted, a clarification should be issued rapidly in Darija, Arabic, Spanish and French.

It should answer practical questions:

• What does the decision actually say?
• Who may be returned?
• Who can seek international protection?
• Does the regularisation process apply to new arrivals?
• What are the physical risks?
• What safeguards are available for children?

A four-page legal communiqué cannot compete with a twenty-second video. Public information must be accurate, but it must also be understandable and designed for circulation.

3. Work with group administrators and content creators

Communities often place greater trust in particular individuals than in institutions.

Identifying group administrators, local journalists, educators, people with lived migration experience and creators able to correct false information may be more effective than relying solely on top-down communication.

4. A child-specific protocol

When a viral call appears to be reaching adolescents, platforms should be able to activate graduated measures:

• disable automated recommendations;
• display safety information;
• redirect users towards protection resources;
• limit notifications;
• provide rapid human review by moderators who understand the language and context.

5. Stress-testing border systems

Border-management exercises are still often designed around a gradual physical flow.

They must now include scenarios in which:

• a rumour goes viral;
• several thousand people mobilise within hours;
• content is broadcast live;
• a significant proportion of participants are children;
• rescue and reception capacities reach saturation before security controls can respond.

Conclusion: the border has also become a news feed

The Ceuta crisis cannot be reduced to a Facebook rumour.

Nor can it be explained solely through poverty, unemployment, Spanish migration policy, weather conditions or relations between states.

It most likely emerged from the convergence of several systems:

• a misunderstood legal decision;
• pre-existing aspirations to migrate;
• community networks;
• platforms optimised for engagement;
• videos generating social proof;
• a particularly powerful form of FOMO among young people;
• a favourable meteorological and operational window;
• limited border-management and humanitarian capacities.

Meta did not create the desire to leave.

Its platforms can, however, turn that desire into visibility, visibility into urgency, and urgency into thousands of simultaneous actions.

That is precisely why Meta cannot retreat behind its status as a hosting provider. The issue is not to blame the company for the crisis. It is to require Meta to demonstrate what its systems detected, recommended and did to reduce a foreseeable risk, particularly to children.

The border of the future will not be protected by fences, cameras and patrols alone.

It must also be understood as an information system.

Because before a mobilisation reaches a beach, a breakwater or a border post, it now often begins somewhere else:

in a group, a recommendation, a notification and the sudden certainty that everyone else has already left.