All summer long, the Grand Continent will stay in motion. Each day, wherever you are, we will bring you ideas you will not find anywhere else (but which will be everywhere by the start of the term), texts that are hard to find or refreshing with our Sundays. To receive them directly in your inbox and support this momentum, consider subscribing to the journal
Between July 30 and 31, 2026, between 50,000 and 60,000 people crossed the border between Morocco and the Spanish enclave of Ceuta in a matter of hours. More than seventy people died. This is not just another migration incident. It is the first large-scale hybrid, algorithmic attack aimed at an external border of the Union. In a word, it is the demonstration that targeted disinformation can now, in under twenty-four hours, generate a human and political shock comparable to that of a forceful operation.
We were familiar with the “war of migrants” as Minsk and Moscow have conducted it since 2021 at the borders of Poland, Lithuania, and Finland. Today we are witnessing its version 2.0: faster, more viral, more multiplied, and less attributable. It is our collective responsibility to draw, with utmost urgency, the true lessons from this.
What we know, what we must know
The established facts sketch a now-classic mechanism. A deliberately distorted interpretation of a ruling by the Spanish Supreme Court (suggesting that swimming could guarantee non-removal, or even regularization) circulated, coupled with a timestamped rumor: the border would be “open at 10 p.m.” on Wednesday evening. By July 27, a Facebook group, “Hraga Ceuta,” with more than 20,000 members, shared Google Maps cards showing the distance of swims around Tarajal’s breakwater, equipment, routes, and fundraising pages. TikTok, WhatsApp, and Instagram did the rest.
What we do not know, and which is nonetheless essential, is far more important: we know nothing about the metrics of traffic for these contents.
How many views? What is their geolocated reach? What does the propagation curve look like? Which accounts acted as triggers? What share came from algorithmic amplification, bots, or authentic, desperate virality?
No platform has published data. No formal data-access request has been made public.
Ceuta is the first large-scale hybrid algorithmic attack waged against the Union’s external border.
Thierry Breton
In September 2024, a similar “TikTok surge” had been preceded by a video watched more than 500,000 times, liked 8,500 times, and shared 1,200 times, which mobilized a few thousand applicants to cross. Twenty-two months later, with unknown metrics, ten times as many people presented themselves at the border. That gap must be explained. It cannot not be explained.
That is why an in-depth, independent, and public investigation now seems indispensable.
It must answer five questions: who started the rumor? who amplified it? According to what algorithmic logics? With which proxies, possibly state-sponsored? Why did the recommendation systems of the very large platforms, if at all, prioritize these contents over mitigating them?
Without these answers, we navigate in the dark in the face of a threat that learns fast.
A “thought experiment”: would Ceuta’s algorithmic rush have been possible in a space fully regulated by the DSA?
Let us pose the question frankly, for it is educational. If this mechanism had unfolded in an informational space where European devices, like the DSA, had been fully applied, would we have lived through the same thing?
My conviction is clear: no. Not because the DSA would have censored these contents. It cannot, nor does it want to, and that is precisely its value. We did not intend to build either the great Chinese firewall, nor Roskomnadzor in Russia, nor the logic of total platform immunity that has prevailed in the United States since Section 230, nor the grey zones that most other states outside the Union tolerate for lack of a framework. We aimed for a third, European model: one of binding transparency and ex ante accountability for the very large platforms.
Concretely, three DSA provisions would have been implemented.
Article 34 obliges very large platforms to assess the systemic risks their services pose to civic discourse, public safety, and the integrity of democratic processes. A border-pushing rush triggered by a viral rumor clearly falls into this category.
Article 35 requires them to take proportionate mitigation measures, such as adjusting recommendation systems, reducing the algorithmic reach of clearly misleading content, or employing virulence-slowing mechanisms.
European sovereignty begins with mastery of its informational frontier.
Thierry Breton
Article 36 enables the Commission to trigger a crisis-response mechanism, obliging platforms to document and correct their moderation choices in real time.
Add to this Article 40, which opens access to data for approved researchers, and Article 15, which requires transparency reports.
None of these would have prevented Moroccans in Fnideq from hoping to cross into Europe. But all of them would have made manipulation traceable, contestable, and costly for its initiators. It is this difference, between an information space that is structurally opaque and one that is structurally accountable, that defines today the European digital democratic sovereignty.
We hold the tools of our power in our hands
It is a crucial lesson, not abstract, and one that falls to the Commission and European authorities to make visible to all citizens who want to understand and master what is at stake at our borders.
This demand for clarity began to take shape in actions on December 11, 2024, when the Commission adopted, as its first act in the College of its second term, a communication on countering the instrumentalization of migration as a hybrid threat and on strengthening external borders. Ursula von der Leyen rightly recalled this at the start of her mandate.
That communication came in response to pressure from Belarus at the Poland and Finland borders. It must now be updated to incorporate the algorithmic dimension of the threat.
The enemy is no longer only the one physically driving migrants toward a fence; it is also the one driving information flows toward vulnerable populations.
Three immediate avenues to open
Activate without delay Regulation 2024/1359 of the Migration Pact
Implemented in full on June 12, 2026, this regulation, championed by the PPE family of Manfred Weber, Roberta Metsola, and Ursula von der Leyen, and supported by Giorgia Meloni’s ECR as a necessary first step, was specifically designed for situations of this kind.
Its Article 1, paragraph 4, point b, defines instrumentalization as “a situation in which a third country or a hostile non-state actor encourages or facilitates the movement of third-country nationals toward external borders with the aim of destabilizing a Member State and potentially jeopardizing its essential functions.” Ceuta falls squarely within this definition.
The enemy is no longer only the one physically pushing migrants toward a barrier; it is also the one pushing information flows toward vulnerable populations.
Thierry Breton
The legal question thus becomes precise: has Spain formally asked the Commission to assess a situation of instrumentalization, or does it intend to do so? Has the Commission launched the assessment foreseen in Article 2? Has a Council Implementing Decision been proposed to activate the derogatory and solidarity measures?
Simultaneously, Regulation 2024/1351 provides a compulsory solidarity mechanism (relocations, financial contributions, operational support) of which Spain should benefit fully. Frontex, whose mandate has been strengthened, also has its place here.
A European regulation celebrated yet unused at its first serious test is not a regulation; it is a posture. In the coming weeks, the European Council must demand a factual and unwavering report.
Mobilize the DSA to cover what it can and must
We must be precise here, because the DSA is not meant to regulate what happens in the Moroccan information space from Morocco. Its scope, defined in Article 2, concerns intermediary services offered to recipients located in the Union. For example, Meta, TikTok, and X are designated very large platforms with establishments and legal representatives in the Union; Ceuta is a European territory; the crisis directly affected the public order of a Member State and resulted in more than seventy deaths. The incriminated contents were widely accessible from within the Union, including among Moroccan diasporas in Spain, France, Belgium, and the Netherlands.
On that basis, three levers could potentially be activated.
Article 34 requires platforms to incorporate the risk that their recommendation systems might amplify content encouraging massive border-crossings for public safety within the Union, including when the main audience, though not the secondary audience, lies outside Europe.
Relying on Article 40, the Commission should promptly enable approved researchers to access, within the Union, data on the circulation of content related to this event between July 20 and August 2. This is the condition for a serious inquiry.
We pay our partners to police their physical border. We must now require them to police their informational border.
Thierry Breton
Then, Article 36 allows activation of the crisis-response mechanism whenever a crisis gravely endangers public safety within the Union, which is clearly the case here. Silence on these questions is untenable. If the Commission wants to prove its capacity to defend European interests, it must act without delay.
Equip the Union with an explicit doctrine for hybrid, algorithmic retaliation
This doctrine must articulate three levels: technical attribution, a graduated diplomatic response, and the existing economic coercion instruments (cyber sanctions regime, anti-coercion instrument). We know how to do this for cyberattacks since 2017; it is time to do it for information warfare with migratory aims.
What we must demand from our Southern partners
The Union contributes around 500 million euros to Morocco under the migration cooperation framework for 2021-2027, including 152 million signed in 2023. This cooperation is useful and must continue. But it must now come with a clear, assumed, contractual conditionality.
We pay our partners to control their physical border. We must now demand that they control their informational border. Concretely, this involves three obligations to be written into upcoming agreements: the effective dismantling of digital-smuggling networks operating from their territory, with a measurable result; rapid judicial cooperation on identified accounts and infrastructure; and the adoption of a regulatory framework for content inspired by the DSA, with transparency in removals and cooperation with the Commission. It is a take-it-or-leave-it proposition. A border is not guarded by one side alone. The informational border is not either.
Sovereignty or impotence
This crisis did not occur in a vacuum.
The simultaneity of the July 31 rush with several hostile signals directed at Ceuta and Melilla issued by the Trump administration, or the relaunch of the Spanish diplomatic channel with Algiers, compels us to ask whether there was interference.
Rather than speculating about potential responsibility—be it American, Russian, linked to reactionary networks or organized crime—our fellow citizens should understand that they have democratic means to establish the facts, and they can demand that authorities use them as quickly as possible.
Only an investigation can establish them. And establishing them would demonstrate that our democratic principles not only protect better, but are also more effective.
Ceuta is a signal. It tells us three things. First, that the border of the 21st century is both physical and informational, and you cannot pretend to secure one without the other.
It is time to demonstrate that this model works, not in theoretical debates, but at the Union’s borders, where women and men die because an algorithm lied to them.
Thierry Breton
Second, Europe already possesses, with the DSA and the Migration Pact, legal instruments to respond, provided they are applied with the speed that the threat demands.
Finally, it tells us that rejecting the choice between the Chinese surveillance model, the American laissez-faire, and the inability to act is not a tenable stance: it is the very definition of the European project.
The spirit of the DSA, which we have carried, is that of a European informational space that is both free and regulated, open and accountable, protective of freedoms and inexorable toward those who instrumentalize them.
It is time to demonstrate that this model works, not in theoretical debates, but at the Union’s borders, where women and men die because an algorithm lied to them.