In North Africa, tensions between Morocco and Algeria find a particularly active outlet on social media platforms. Smear campaigns, rumor-spreading, and the amplification of emotionally charged content circulate regularly, aiming to influence regional and international perceptions.
Open-source investigations (OSINT) have repeatedly documented coordinated behavior: synchronized spikes in activity, near-identical messages spread across networks of accounts, suspicious geolocations, and astroturfing techniques. These observations alone do not constitute proof of state attribution. They do, however, point to an organization that goes beyond simple spontaneous debate among internet users.
Recurring patterns observed through OSINT
OSINT analysts rely on publicly accessible technical indicators. Among the most common are the mass creation of accounts over short periods, the use of stolen photos and biographies, the spread of identical wording within minutes of one another, and the geographic concentration of connections revealed by certain platform transparency features.
On X, the display of accounts’ country of origin has repeatedly revealed, since 2025, profiles presenting themselves as Moroccan but operated from Algeria. Similar networks have been documented in the opposite direction. These technical revelations do not automatically prove state direction. They do demonstrate a capacity for organization and identity concealment.
The platforms themselves have occasionally acted. Meta has in the past removed networks of accounts, pages, and groups linked to coordinated inauthentic behavior originating from Algeria, notably in the context of internal political debates. These takedowns show that structured operations exist, without necessarily clarifying the level of institutional involvement.
The Ceuta case and migration-related campaigns
The episode of the mass influx toward Ceuta in late July 2026 offers a recent, well-documented example. Several OSINT and SOCMINT analyses reconstructed an unusual surge in online activity in the preceding weeks. Content circulated on TikTok, Facebook, Instagram, and X, offering routes, timings, and encouragement to cross the Tarajal breakwater. WhatsApp groups run from phone numbers with the +213 (Algeria) country code shared logistical information.
A roughly seventy-page report by Spanish analyst José María Gil Garre, based on open sources, estimated that this activity generated several million potential impressions. The same report, however, points out the limits of the exercise: the exact identity of the group administrators was not established, and no formal proof of a state-run hierarchical structure was provided based on open data alone.
Three levels need to be distinguished. An isolated rumor can arise organically. Digital coordination — identical messages, mass-created accounts, temporal synchronization — is a stronger signal. Proof of state interference requires additional elements, often classified, that go beyond the scope of public OSINT. Conflating these levels risks political misinterpretation.
Amplification methods observed
The recurring techniques in these campaigns rely on the specific features of each platform.
- Algorithmic amplification: emotionally charged content (anger, humiliation, migration urgency) is favored by recommendation systems, which boosts its organic reach.
- WhatsApp groups: these semi-closed spaces allow logistical instructions to spread and a sense of belonging to form quickly, while remaining hard to trace from outside.
- Fake accounts and identity theft: profiles presenting themselves as ordinary citizens of the target country spread hostile messages, creating the illusion of internal debate.
- Astroturfing: the artificial creation of a “spontaneous” opinion movement aims to create the impression of popular consensus.
- Viral spread of emotional content: dramatic videos, out-of-context images, edited footage, and increasingly AI-generated content spread faster than fact-checking can keep up.
These methods are not exclusive to one side. Analyses have also documented disinformation campaigns targeting France, the United Arab Emirates, Israel, and others, carried out by networks operating from Algeria.
Algeria’s state press talks about Morocco every single day…
This hostile media coverage is documented and quantifiable. For several years now, Algerian state television has mentioned Morocco daily in its news broadcasts — a pattern so systematic that an X account keeps a daily tally of days without exception, surpassing 220 consecutive days in August 2026.
The state channel AL24 News illustrates this editorial line, increasingly airing programs since late 2025 that describe Morocco as a “Zionist entity” or refer to a “colonialist alliance hostile to Algeria.” The paradox reaches its peak during events Algeria cannot ignore: during the 2025-2026 Africa Cup of Nations hosted in Morocco, several Algerian state media outlets went to great lengths to avoid naming the host country, mentioning only cities like Rabat, Marrakech, or Tangier without ever specifying the organizing nation.
Limits of OSINT and the risk of political misinterpretation
OSINT offers major strengths: accessibility, third-party verifiability, and the ability to map visible networks. It also has structural limitations. Open data cannot always trace an account back to its real origin (VPNs, proxies, spoofed locations). The absence of proof of state attribution does not mean the absence of involvement, but it does mean it cannot be asserted. Conversely, the presence of technical coordination does not automatically prove central political intent.
The main risk lies in the political exploitation of OSINT findings. Partial technical results can be presented as definitive proof of interference, in turn fueling new polarization campaigns. For their part, platforms rarely communicate exhaustively about network takedowns, leaving room for diverging interpretations.
Amid structural tensions between Morocco and Algeria, there is a strong temptation to turn every digital signal into proof of a state-led influence war. A rigorous reading requires staying as close as possible to observable facts: documented coordination, unestablished attribution, and real polarizing effects on public opinion.
Outlook
Platforms have strengthened certain transparency tools (account geolocation, detection of inauthentic behavior). OSINT analysis capabilities have become more professionalized. Yet the production of AI-generated content and increasingly sophisticated concealment techniques continue to complicate identification efforts.
In North Africa’s information space, the line between citizen debate, organized activism, and influence operations remains blurred. Telling these categories apart requires constant methodological discipline. Without it, social media risks becoming not just a mirror of geopolitical rivalries, but an accelerant of their radicalization.
FAQ
What is astroturfing in the context of social media?
It refers to the artificial creation of an opinion movement that presents itself as spontaneous, through the use of fake accounts and coordinated messaging.
Are OSINT investigations enough to prove state interference?
No. They document coordinated behavior and technical patterns. Formally attributing them to a state requires additional evidence, often beyond the scope of open sources.
Why is WhatsApp particularly used in these campaigns?
Because its groups are semi-closed, largely invisible from outside, and allow for the rapid spread of logistical and emotional information.
