A Spanish report, presented as a security study and later widely circulated in Moroccan and Israeli media, points to what it calls an "Algerian actor" as one of the main nodes behind the mass migration wave toward Ceuta on July 30 and 31. An Algerian author argues that this hypothesis does not withstand close scrutiny.
It would be easy to dismiss this argument as mere self-defense. That is precisely why a simple rule should be followed: do not add any facts that are not contained in the document itself, and do not rely on assumptions or interpretations. Read the report as it is and judge it solely on its own content.
That is more than sufficient, because the report ultimately undermines itself.
A Document with a Security Intelligence Appearance
The report runs to seventy pages and was prepared by a Spanish security analyst. It carries a closing date of August 2 and bears a title referring to a digital mobilization campaign linked to what it describes as the "attack and violation of Spain's territorial sovereignty" in Ceuta.
In form, it resembles an intelligence document: a reference number, a "restricted use" label, actor profiles, relationship maps, and a methodology based on Open Source Intelligence (OSINT) and Social Media Intelligence (SOCMINT). Ironically, this supposedly restricted document was publicly published through the author's LinkedIn account.
Not everything in the report is problematic. Parts of it appear serious and coherent. The overall chronology of events is convincing, and the analysis of how different digital platforms played different roles seems reasonable: TikTok for attracting attention, Facebook for community building, and WhatsApp for operational coordination. The comparison with the Fnideq events of September 2024 is among the strongest sections of the report.
The problems begin in Chapters Eight and Nine.
Two entire chapters are devoted to what is labeled "Operational Actor No. 01," complete with an Algerian flag and a full relationship diagram. Yet the entire construction rests on only two WhatsApp groups managed by phone numbers beginning with the international dialing code +213.
Nothing more.
The Central Piece of Evidence Is Missing
The report presents what it calls "documented evidence" regarding the two WhatsApp groups. However, these are not original screenshots. Instead, they have been recreated and reformatted according to the report's own design template, with standardized fonts, frames, and fields.
In other words, these are not raw pieces of evidence that can be independently verified. They are representations produced by the analyst.
No invitation links are provided for verification. In fact, the author himself acknowledges that the links are not verifiable. There is no independent archive, no digital hash, and no external means of validation. Most importantly, the phone number on which the entire conclusion rests has been concealed: "+213 6XX XXX XXX."
This is the core problem.
All of the accusations are based on an alleged Algerian phone number, yet the number itself is hidden. The very element required for verification is the one element withheld from the reader.
The audience is therefore being asked to accept the claim solely on the analyst's authority.
This constitutes a serious methodological weakness.
The "Djezzy" Contradiction
The profile card provides two adjacent pieces of information: the number begins with +213 6XX, and the operator is identified as Djezzy.
Yet Algerian mobile number allocation is well known. Numbers beginning with 06 or +2136 are generally associated with Mobilis, while Djezzy numbers are usually linked to 07 or +2137, and Ooredoo generally uses 05 or +2135.
A number starting with +2136 therefore does not match its designation as a Djezzy number.
This leaves only two possibilities:
- Either the operator identification is incorrect, meaning the analyst failed to perform basic technical verification before building two entire chapters on that foundation.
- Or the number shown in the report is not the actual number and has been reconstructed for presentation purposes.
In both cases, the credibility of the conclusion is weakened.
A simple question follows: if the author possessed sufficient information to identify the operator, why conceal the number? And if he did not possess that information, how was he able to identify the operator in the first place?
What Does a Telephone Prefix Actually Prove?
At the heart of the issue lies a clear logical fallacy: because the number begins with +213, the user must be Algerian, and therefore there must be an Algerian role in the operation.
Technically, this conclusion does not hold.
An international dialing code merely indicates the country in which the SIM card was originally issued. It does not establish the nationality of the person currently using it. SIM cards can be bought, sold, transferred, and reused, particularly in environments connected to irregular migration.
Nor does the prefix establish the user's physical location. A WhatsApp account remains linked to its original phone number regardless of whether the user is in Algeria, France, or anywhere else in the world.
Nor does it demonstrate any political or organizational role. The presence of Algerian nationals within migration-related networks is statistically unsurprising, given the extent of Algerian participation in Western Mediterranean migration routes.
Most significantly, the report does not seriously examine any of these alternative explanations, despite its own methodological appendix emphasizing concepts such as minimum attribution and cross-validation.
From a Phone Number to an "Algerian Actor"
The most significant departure from analytical rigor appears in the language used by the report.
The primary profile card does not describe a "WhatsApp group" or a "digital coordination node." Instead, it immediately labels the entity as an "Algerian Actor (+213)."
This is where the critical leap occurs.
Once that label is assigned, the report attributes operational capabilities to this supposed actor, including coordination, mobilization, adaptation, and continuity.
Yet the existence of this actor was never independently established. It was inferred solely from a telephone prefix.
Had the report used a neutral designation such as "WhatsApp Coordination Node No. 1," the technical analysis would remain unchanged while the geopolitical implications would disappear.
This suggests that the report's most consequential choice was not an intelligence finding but a linguistic one.
A Clear Imbalance in Scale
The report's own figures create another difficulty.
The Facebook groups monitored contained more than 250,000 members. Some central TikTok accounts had over 317,000 followers and generated millions of views.
By contrast, the two WhatsApp groups used to support the hypothesis of an Algerian role contained only 3,780 members combined.
That represents roughly 1.5% of the digital ecosystem documented by the report.
Yet these groups received two dedicated chapters, the report's only actor profile, and its principal relationship diagram.
Meanwhile, the Moroccan networks that the report itself describes as the primary engines of mobilization receive no comparable treatment.
This appears less like an analytical decision than a narrative choice.
Multiple Internal Contradictions
The report contains several chronological and factual inconsistencies.
The first group is said in one section to have been discovered on July 28, while its profile indicates it was created on July 15. Elsewhere, its origins are placed in the first week of July, while another related document bears the date July 30.
The second group is presented as evidence of adaptation to increased controls around Ceuta. Yet the report's own data indicates that it had already been documented ten days before those measures were implemented.
Additional discrepancies concern follower counts on certain accounts and whether particular groups are described as open or closed.
These are not minor details. They affect the foundations of the analysis itself.
The Absence of Digital Attribution Testing
Perhaps most troubling, the report appears to have conducted virtually none of the standard digital attribution tests.
There is no reverse-image search of profile pictures, no comparison of aliases across platforms, no account-history analysis, no metadata examination of shared files, and no temporal analysis of posting activity.
Meanwhile, the report documents facts that point toward a different and arguably more plausible explanation: the sale of diving suits, fins, and flotation devices; group purchases of kayaks; and inquiries about crossing routes and security checkpoints.
These elements are more consistent with the activities of smuggling and irregular migration facilitation networks.
Yet this hypothesis is barely discussed, despite fitting the available evidence more closely.
From Report to Media Narrative
After publication, several media outlets picked up the report, notably the Spanish platform Atalayar.
As the report entered the media sphere, its conclusions became even more amplified.
Viewership figures grew, attention shifted away from the report's own finding that the center of activity was largely located in Morocco, and increased emphasis was placed on accounts linked to Algeria, Tunisia, and France. Additional claims appeared regarding official sponsors of the study, despite the absence of clear evidence in the original document.
In this way, a fragile hypothesis evolved into an almost complete political narrative.
Conclusion
Ultimately, the accusation directed at Algeria rests primarily on a single telephone prefix belonging to a concealed and unverifiable number. The number's supposed operator contradicts the report's own classification, it relates to no more than 1.5% of the digital environment studied, and it was never subjected to standard digital attribution procedures.
Such a basis cannot reasonably support the attribution of political or national responsibility to an entire state.
What remains is less an analytical demonstration than a narrative construction: a flag, an identity card, a network diagram, and terminology carrying political implications far beyond what the available evidence can sustain.
The problem is that reports of this kind rarely remain confined to their original pages. Months later, they are cited as references. Eventually, they become accepted as "facts," even though their foundation was nothing more than a hypothesis that was never scientifically or methodologically demonstrated.
Comments
Post a Comment