Two weeks ago, on the anniversary, I posted the mechanism of the 1953 Tehran coup: buy the press, hire one mob to riot in the government’s name, hire a second mob to attack the first, and let the resulting chaos prove the government has lost control.

Think about everyone in the street being paid by the same source to whip up attention. The modern-day Ceuta crisis in Spain had been running in the news for twenty days when I posted the history of Iran. And then today I read a Spanish police report.

On 30 July 2026 a crowd that had been mobilised to look spontaneous walked into Ceuta and a government began to fall. Ok, but 19 August 1953 was when a crowd paid to look spontaneous walked through Tehran and a government fell. Every visible actor in Tehran was Iranian. It took sixty years for the authors to admit they were in Washington and London. The Spanish Prime Minister, three days ago, named Russia and Israel within five weeks. He is being destroyed for it by people who have read as far as the uniforms.

Red Hot PDF

The Centro Nacional de Inmigración y Fronteras (CENIF), the intelligence unit of the National Police’s immigration and borders directorate, prepared a 55-page report at the request of Plaza 3 of the Central Instruction Court at the Audiencia Nacional, Judge María Tardón. The data goes until 26 August. Demócrata has published it as a PDF. I have read it. The 61-page technical annex on the digital organisation, the ten dossiers on uniformed officers and the 24 on plainclothes handlers, and the four videos are listed but not released.

Here are the findings, in the order made by the report.

1. The entry was a process, not an event. The report refuses to analyse 30 and 31 July except as a procedure with a before, a during and an after, and states flatly:
   

   No se trata de algo incidental cuya generación pueda asociarse a un factor ocasional o espontáneo.

2. The crowd was not migrating. Of those who entered, no fewer than 90 percent returned to Morocco voluntarily and almost immediately; the report puts migratory intent at five to ten percent. Nearly all were Moroccan nationals. They moved, in the report’s words, with relative calm, no crushes, no bottlenecks, conveying a sense of impunity, as a movement free of any consequence, and that perception was probably reinforced by what the report calls the “almost active” tolerance of the Moroccan security forces. Migration, the conclusions say, operated only as a formal cover.
3. The mobilisation was built. Open platforms first, Facebook, Instagram, TikTok, from 24 July; then closed WhatsApp groups on 29 and 30 July with operational instructions, including the advice that each group communicate by handwritten note rather than online because the internet was monitored. The message count in monitored groups peaked at 1,974 on 30 July, a 3,363 percent increase over the maximum before the 28th. Three distortions gave it credibility: Supreme Court judgment 814/2026 on border rejections, reduced to the viral line “if you enter swimming they can’t return you”; Spain’s closed extraordinary regularisation, reduced to “in Spain you get papers in the end”; and Throne Day. The report reproduces an Arabic poster with Pedro Sánchez’s face on it announcing 30 July 2026 as the last deadline before Spain closes the door on regularisation. The Prime Minister was the bait.
4. Throne Day was the cover. The official ceremonies were held at Rincón/M’Diq, a few kilometres from the border, with the King, the establishment and foreign guests present. The report reads the choice of date two ways: it seeded the message that the security forces were busy with the royal protection detail and the frontier was unguarded, and the King’s proximity carried what the report calls a “tacit consent” that implicitly accompanied the viral campaign. A message circulating in the days before: “There will be attacks from the sea and from El Kriay, through the forest and by Bab Khemis, on the occasion of Throne Day.”
5. The Moroccan cordon stood down. Satellite imagery at 17:07 on 30 July shows police presence confined to the entrance of the official crossing; none on the beach access, the breakwater, or the roads and roundabouts from Castillejos to El Tarajal; taxis parked in order on the left of the Bab Sebta roundabout; the main routes open while a crowd accumulated on the beach and the roads. The report calls the Moroccan police response over 30 and 31 July “at the very least, total permissiveness”: not a single serious attempt to reduce, disperse or move the crowd from the perimeter on the 30th. Interviewed migrants say, almost unanimously, that Moroccan officers were not merely passive but gave directions to enter through the water at the breakwater and not by other routes. Open-source video shows uniformed officers directing people toward predetermined access points and organising heavy vehicles carrying large numbers of people, and non-uniformed individuals managing the flow, in some cases giving instructions to the uniformed officers. That video is titled “Ceuta_Agentes_Dinamizadores” in the annex.
6. The crowd was sequenced. First wave to 11:00: males 15 to 25, high proportion of minors, 95 to 98 percent Moroccan, equipped with wetsuits, fins, floats and waterproof phone cases. Second wave 11:00 to 22:00: adults to 40, whole families, small children at 18 to 25 percent, sub-Saharans at 20 to 25 percent, in sportswear and flip-flops, no equipment. Third wave from 22:00 through the 31st: the first profile again. The report assigns the two phases explicit tactical objectives. First, collapse the border management system at one point in one way, diverting Spanish capacity to sea rescue while saturating the reception yard. Second, once the yard gate was opened, eliminate Spain’s capacity to respond, because a notable presence of families, women and small children “deactivates the possibility of using coercive means or reactive force to re-establish control.” The report considers 75,000 to 85,000 people reaching a single point without road blockages, transport failures or public-order incidents “incompatible with a group of spontaneous origin, with no internal organisation, and no minimum support of directed organisation on the ground.”
7. The mafias couldn’t have done it. CENIF ran the five known maritime smuggling organisations and the four to six Ceuta narco groups through Europol’s SOCTA criteria. One smuggling group operates in Ceuta, with capacity for three to five people a day. Since January 2024: 2,983 operations, 1,822 arrests, and “not a single reference to these organisations encouraging the mobilisation.” They had never had the capacity to summon 75,000 people even at peak strength in 2021 to 2023, and the operation made them no money: the only detectable reaction was opportunistic, about 150 people moved to the mainland by 24 August at a discounted €5,000 a head.
8. The state that could stop it, did. On 15 August a second call went out, more visible and earlier than the first, without the “unique opportunity” framing, directed at the fence rather than the water, and answered by an almost exclusively sub-Saharan crowd. Morocco detained 294, 248 of them sub-Saharan, allowed nothing to reach the fence, and expelled the Spanish press from the area. The report:
   

   Es decir, parece que asistimos a un proceso “manejado” de forma que una segunda convocatoria artificialmente más detectable se convierta en un ejercicio de control que “blanquee” la gestión precedente de la respuesta de las Fuerzas y Cuerpos de Seguridad.

   The report describes the whole as “actions of calculated ambiguity and gradual advance with intermittent activity,” which it identifies as the signature of grey-zone strategy, projected “not on Morocco but on Spain and the international community.”

9. The author is unnamed by design. CENIF describes five levels, from the crossers up through message dynamisers, on-ground organisers and planners to direction, and states that Level 5 could not be individualised by the delivery date, while noting that “the basis of its conception seeks the concealment of authorship.” Eighty-two bodies were recovered in Spanish waters, by telephone note from the Ceuta Instituto de Medicina Legal on 26 August. Morocco acknowledged fourteen.

The Formula

The CIA’s internal history of Iran, obtained under FOIA and published by the National Security Archive in 2013, states:

The military coup that overthrew Mosadeq and his National Front cabinet was carried out under CIA direction as an act of U.S. foreign policy, conceived and approved at the highest levels of government.

The operational record is Donald Wilber’s 1954 after-action report, Overthrow of Premier Mossadeq of Iran, written as an eyes-only handbook for future operations and leaked to the New York Times in 2000. The State Department’s 2017 retrospective FRUS volume supplies the NSC and CIA files around it. Read together they describe a method.

Disinformation is built on a grain of truth, which can be any real grievance.

Iran’s Mossadeq had dissolved the Majlis by referendum; the propaganda campaign Wilber ran through paid Tehran newspapers turned a constitutional dispute into a story about a dictator in league with communists, with some of the articles written in Washington and placed in Tehran. Crowds purchased in advance and released on cue, through people who controlled the protection rackets. A first mob sent out shouting for Mossadeq and for communism, to frighten the middle class and the army. A second mob hired to attack the first. Handlers on the ground coordinating by phone while Kermit Roosevelt ran it from inside the embassy compound. And afterwards, a story of spontaneous national uprising that the authoring state defended for six decades, including a 1989 FRUS volume that historians called a fraud for omitting the operation entirely.

Map it to Tarajal.

Real grievance: a Supreme Court judgment, distorted into a slogan, with the target’s own Prime Minister on the poster. Crowds assembled in advance: 80,000 people arriving in taxis on clear roads. A first mob to produce the crisis: young men with fins to exhaust containment, then children to disarm it. Handlers: 24 dossiers and ten uniformed fiches, and video of the plainclothes men instructing the uniforms. And then the second mob. On 15 August the call went out again, louder, and the same security forces that had stood back on 30 July detained 294 people and closed the border. CENIF calls the second call artificially detectable and its function laundering. Roosevelt would have called it the second crowd: the same source producing the chaos and then producing the order, so that the target government is seen to have lost control and the neighbour is seen to have it.

The report’s own comparison table shows the method being refined.

	May 2021	Aug–Sep 2024	Jul 2026
Moroccan presence before	Reduced	Increased	Reduced
Response during	Permissive	Containment	Permissive
Entries	~10,000	1,000–2,000	75,000–85,000
Follow-up call	None	15 Sep, 3,795 arrests	15 Aug, 294 arrests
Second-call outcome	—	Absolute control	Absolute control

Wilber wrote his history as a handbook. This one has been through three editions.

The crowd of 30 July and the cordon of 15 August answered to the same direction. That is the finding.

And the lesson of 1953 is what the finding does not settle. Nobody in the streets of Tehran was American. The Iranian police turned, the Iranian mobs marched, the Iranian papers printed. Reading the uniforms tells you who executed. It never tells you who authored, and it never will, because the method is designed so that it won’t. The report says so about Ceuta in its own words: the basis of its conception seeks the concealment of authorship.

The Call

On 31 August Pedro Sánchez told Cadena Ser that after 30 and 31 July, disinformation had spread on networks tied to Russia, Israel and an international far right that uses migration to attack Spain and Europe, and that Morocco had neither conceived nor executed the entry. The second half of that is where he is vulnerable, and I come to it below. The first half is the correct reading of a hybrid operation, and it is the reading his critics refuse to make.

Start with the category. When Belarus moved people to the Polish and Lithuanian borders in 2021 and Russia moved them to Finland’s in 2023, the Council and Commission named the method: instrumentalisation of migration, a third state moving bodies to an EU frontier while Russian channels amplify the collapse. The signature of that method is not a Russian in the street. It is state-attributable amplification at hour zero. EUvsDisinfo exists because of it. Sánchez was invoking a category the European Union had already defined against Moscow.

Then the finding. The EEAS confirmed Russian attempts to exploit the crisis online. The Commission had said on 6 August that the actors were Russian state media, diplomatic channels and government-sponsored outlets, amplifying across multiple platforms from 30 July. Diplomatic channels means embassy and ministry accounts. That is the Russian state acting under its own flag during the crisis, not a proxy. Brussels added that it saw no Russian activity before the 30th, and the Spanish right ran that caveat as an acquittal. It is the opposite. In an instrumentalisation campaign, arriving at hour zero with prepared assets is the participation.

Then the escalation. Three weeks into the crisis a pro-Russian group, NoName057, whose named leaker is a teacher wanted by the Audiencia Nacional, living in Russia under Kremlin protection and on Europol’s most-wanted list, published a 500-page file of names, photographs and phone numbers of around a thousand Spanish police, Guardia Civil and military personnel. Spanish intelligence attributes it; JUCIL has it before the Audiencia Nacional. In the same window an anonymous account calling itself The Political Room announced a mysterious 120-page CNI report whose only takeaway was that the CNI had monitored Moroccan networks and must have warned. Nobody has produced it; Demócrata could not verify it exists. CENIF’s final conclusion calls the resulting assault on the CNI a textbook offensive counterintelligence action. Doxxing the responding forces and discrediting the intelligence service are not commentary on a border incident. They are the second mob.

Then Israel. Its UN ambassador, on day two, asked why Spain still maintains colonial enclaves in Africa. Its foreign minister called the Spanish Prime Minister a liar. Its defence industry built the eyes over the border: Barak MX in 2022, Heron drones, a billion-dollar IAI reconnaissance satellite in 2024, Elbit artillery in 2025, a joint military committee with Rabat that met in Tel Aviv in January. The EEAS found only isolated accounts on the Israeli side, and that is fair as a finding about bots. It is not a finding about a state whose officials joined the operation in their own names.

Then alignment. Moscow signed its Deepened Strategic Partnership with the King in 2016 and, last October, a new joint committee with Bourita, the same week Lavrov signalled acceptance of Morocco’s autonomy plan, and Russia then abstained rather than block Resolution 2797. Washington drafted 2797, recognised Moroccan Sahara in 2020 as the price of Israel’s normalisation, and reaffirmed it on Throne Day, the day the crossing began. Delhi opened India’s first overseas defence plant outside Casablanca last September. Starlink signed Royal Air Maroc on 4 August. Rabat ran this in the knowledge that every state with leverage over it had already taken its side of the Sahara question, and two of them would join in.

The report’s phone sample is the evidence the critics wave. Ninety point eight percent Moroccan prefixes among the lines that dynamised the call; of the rest, Algeria under three percent of the whole, and no Russian, Israeli or American lines anywhere in the enumeration. That is proof of who executed. Wilber’s Tehran newspapers were Iranian too. The report’s own after-phase section lists the Moroccan counter-narratives that followed the crossing, the “mafias” story in ABC and the “Algerian prefixes” story in La Razón among them, as products of the operation. Russia and Israel are not in that list because Morocco did not invent them. Europe’s diplomatic service did.

One caution on the report’s own sourcing. Its claim that the campaign followed a pre-established viral design model is footnoted to a marketing-school blog post on the K-factor and attributed loosely to Harvard Business School. The inference that the message pattern was engineered rests on the message-volume curve and the platform sequencing, which the report does document. Thankfully it doesn’t mention my 2012 BSidesLV presentation where I predicted this.

The Phone

On 17 and 18 May 2021 Morocco opened the border and roughly 8,000 people entered Ceuta at El Tarajal. On 18 May Sánchez flew to Ceuta with Marlaska and overflew the frontier by helicopter against security advice. On 19 May, according to The Objective’s reconstruction, Moncloa’s systems detected the extraction of around 2.6 gigabytes from the Prime Minister’s phone by Pegasus. The government sat on it for a year. The judicial inquiry later counted fourteen attacks: five on Sánchez, four on Robles, two on Marlaska, who lost over six gigabytes, and one attempt on Planas. The Defence Ministry reset Robles’s phone before it could be examined. Judge Calama shelved the case.

On 14 March 2022 Sánchez wrote to Mohammed VI accepting the Moroccan autonomy plan for Western Sahara, reversing half a century of Spanish policy without informing his coalition partner or Parliament. Asked in Parliament this May whether Pegasus has ever been raised with Rabat, the government answered that the matter does not form part of bilateral relations.

This summer an Algerian-flagged hacker persona, Jabaroot, published the identities of some 70,000 Moroccan intelligence personnel and asked its Telegram forum who was interested in the original Pegasus data relating to Pedro Sánchez. Attribution of the 2021 intrusions to Morocco is not a Spanish judicial finding. It is the working assumption of everyone outside Moncloa, anchored on the French investigation of the Macron intrusions. What was in the 2.6 gigabytes is unknowable. That is the point of it.

The executor of the 2021 Ceuta operation extracted the Prime Minister’s phone during the 2021 Ceuta operation. The Prime Minister then reversed policy in the executor’s favour. In 2026 the executor ran the same operation at ten times the scale and put the Prime Minister’s face on the recruiting poster. This is the half of Sánchez’s statement that fails: Morocco did conceive and execute the crossing, his own police have it on video, and the reason he cannot say so is sitting in Rabat in a 2.6-gigabyte file. That is a fact about leverage. It does not make the other half wrong. A leader who names the states he can name, and names them correctly, is doing more than a leader who names none.

I was Right About Loch Ness in 2012

The CIA denied Ajax for sixty years, because of course. The 1989 FRUS volume omitted it. The 2013 admission came by FOIA and the 2017 volume came after the nuclear deal made it safe. The whole period, the operation’s authorship was an open question where many knew the answer, and the party that had the strongest interest controlled the archive to delay the reveal.

Ceuta keeps the structure. The report says it cannot individualise the top level. The Interior Minister writes to the police director asking since when he knew. The police director replies that no document attributes planning or execution to a government.

The opposition reads the cover of a book (the uniforms) and declares the story ends on Morocco alone, without reading a page inside. They maintain a state in which 80,000 people crossed a European border under the guidance of a neighbouring state’s security forces, 82 bodies came out of the water, two foreign states worked the aftermath under their own flags, and the only person who named those two states is the one they tell to stop talking.

Germany has weathered the same pattern this year and I’ve repeatedly shown Dobrindt making the mistake: treat the flow as the threat, and the state that weaponised it as a rumour. That is what a hybrid operation is built to produce, as I warned in 2012 about the emerging threat of social media on mobile phones. The correct call is both halves. Rabat moved the people. Moscow moved the story, and Jerusalem signed its name to it. The second half is what turns any old border incident into an internationally reported government crisis, and Sánchez is the one leader in Europe who actually said the second half.

Somebody read the old handbook, and so did Sánchez.