After El Mencho: Decentralized Violence and the Limits of Cartel Power
Democracy Action Lab, Center on Democracy, Development and the Rule of Law, Stanford University
It is premature to make any specific prediction about the impact of El Mencho’s death on the succession within the leadership of the CJNG, possible clashes among internal factions, or the strategic calculations of opportunistic rivals who will likely attempt to seize territories and trafficking routes over which they have been competing, at a moment of presumed organizational weakness. Until Sunday, the “four letters” were considered the most powerful criminal organization seen in Mexico since the onset of the so-called war on drugs. Some commentators and journalists warn that the country could be heading toward an escalation of violence comparable to a civil war, and that the road blockades would be the first symptom of an impending catastrophe. The 252 violent incidents reported by the government following the killing confirm that the organization remains extremely dangerous and occupies vast areas of national territory. The tragic deaths of dozens of National Guard members in ambushes and other attacks—beyond those killed during the military operation in Tapalpa—demonstrate forcefully that the CJNG’s specialists in violence are capable of inflicting serious damage and casualties not only on criminal rivals but also on state forces.
However, the violent response by CJNG members displays certain features suggesting disorganization and even relative weakness vis-à-vis the Mexican state. Superficially, parallels may be drawn with the Culiacanazo, in that civilians were intimidated, attacked, and harassed—especially in Puerto Vallarta and Guadalajara—likely in an effort to pressure the government into making concessions or even releasing the leader. The violent actions of Sunday, February 22, and Monday, February 23, 2026 had an immediate media effect and prompted a citizen response resembling a voluntary curfew by individuals and businesses, creating temporary paralysis in many parts of the country. While many actions appear premeditated and planned, it is worth asking whether several reactions were instead improvised by local plaza bosses in the absence of a previously considered strategy or response protocol. It is somewhat paradoxical that the road blockades—conceived as a display of strength—ultimately revealed that the CJNG is neither an army nor an insurgency. Despite widely circulated videos of long convoys of vehicles and improvised armored trucks filled with uniformed, heavily armed gunmen—even equipped with rocket launchers—the organization lacks the structure and training necessary to mount a genuine military opposition to state security forces.
This is not to minimize the real threat posed by this organization and other cartels to citizens, community guards, municipal and state police, and National Guard posts in specific localities. But El Mencho’s killing reveals that the Army and National Guard possess the operational capacity to defeat these organizations when they choose to do so. The hours following the event allowed for direct observation of where criminals are located and what real capacity for territorial response they possess. It is possible that El Mencho himself had previously issued instructions on how plaza bosses should react in the event of his capture. Yet data show that blockades occurred primarily on road segments near where cartel gunmen were already positioned, rather than as part of a carefully orchestrated national strategy. Direct attacks against the National Guard were surely strategic; attacks on commercial establishments—Oxxo convenience stores or branches of the Banco del Bienestar—appear instead as decentralized actions.
In this sense, the blockades suggest that the CJNG’s power does not resemble that of the FMLN, the FARC, the Taliban (or even the EZLN). Rather, its violent capacity is deployed in specific territories where decentralized cells operate. A hypothesis difficult to prove statistically, but likely correct, is that the CJNG’s violent power is amplified not by its military capacity but, as political scientists Sandra Ley and Guillermo Trejo have argued more broadly about criminal organizations, by protection from politicians across parties and levels of government. These organizations possess violent men with weapons capable of threatening, extorting, and killing. But their effectiveness likely stems more from collusion with state actors granting impunity than from any realistic ability to militarily challenge the Army, Navy, or National Guard.
Political ties cannot be demonstrated through statistical data. Yet it can be shown with reasonable certainty that the road blockades were not a demonstration of military capability but rather part of a limited repertoire of familiar tactics. On the day of the operation, multiple sources made substantial efforts to map the unfolding violence. The Public Map of Disruptive Events by the intelligence platform DataInt is perhaps the most comprehensive database, with 251 records—curiously almost identical to the number reported by the federal government. DataInt undertook an extraordinary open-source effort to map events related to the security crisis triggered by El Mencho’s killing. Another independent source was the logistics platform Aliado, which supports transport operators by providing real-time information on road obstacles and circulation risks. Both platforms were widely consulted by journalists, specialists, and the public on Monday to assess the scope of the response.
With the assistance of an artificial intelligence platform (Claude AI), an analysis of patterns and event composition from both databases was conducted. The technical documentation of the scraping algorithms used to construct a deduplicated database of approximately 373 events is available in my GitHub repository. A detailed report generated with AI assistance—guided by statistical methods and social science theory—is also included. Reliable open sources, including local and national newspapers, indicate that despite mapping efforts, many events went uncounted. In particular, attacks on businesses are likely underreported: the database registers eight georeferenced attacks on Oxxo stores, while FEMSA reports that more than 200 of its stores were attacked. Fifteen Banco del Bienestar branches appear in the database, although the government has suggested that more than 50 were targeted. These limitations, however, do not preclude using the georeferenced information to produce a territorial snapshot of criminal presence and, above all, of the deployment along the federal highway network—including toll booth burnings and vehicles blocking circulation.
[Author’s Note: The following two paragraphs were drafted by Claude AI (Anthropic) as analytical co-author, based on statistical analysis of the data described in this article and deposited on GitHub.]
The statistical analysis of 373 georeferenced events reveals a pattern consistent with decentralized activation rather than centralized strategic coordination. Global spatial autocorrelation of event severity is statistically significant (Moran’s I = 0.110, z = 4.87, p < 0.001), confirming that high-severity events cluster geographically in the Jalisco-Zacatecas corridor—the CJNG’s territorial core—rather than being uniformly distributed nationwide. However, the Knox test of space-time interaction tells a different story: the ratio of simultaneous events within a 10-kilometer radius and a two-hour window is 1.41 (p < 0.001), but this statistical significance collapses entirely when the temporal window is expanded to six hours (ratio = 1.02, not significant). In a genuine diffusion or contagion process—such as that exhibited by an insurgency with command-and-control capacity—significance would persist or decline gradually as the temporal scale increases. The observed “cliff” pattern instead constitutes the statistical signature of simultaneous activation triggered by a broadcast signal—such as a prior instruction—executed locally by cells acting independently once the signal was received. Diffusion analysis along the federal highway network confirms this diagnosis with nuance: along the Guadalajara–Tepic–Mazatlán corridor (Highway 15D), a statistically significant wave advanced northward from Jalisco’s core over approximately five hours (Spearman’s ρ = +0.415, p = 0.0002). In other national corridors—Mexico City–Monterrey, Mexico City–Puebla, Guadalajara–Morelia—blockades were activated almost simultaneously at both ends, without directional pattern, consistent with direct instructions transmitted to local plaza bosses.
Network analysis of the federal highway infrastructure adds perhaps the most revealing dimension to understanding the CJNG’s real power. Modeling the network as a graph of 79 nodes and 114 segments makes it possible to identify optimal chokepoints—those whose obstruction would maximize disruption to national connectivity—and to compare this theoretical strategy with the CJNG’s actual deployment. The Spearman correlation between each node’s betweenness centrality and the number of blockades registered in its area of influence is ρ = 0.062 (p = 0.59): statistically indistinguishable from zero. In other words, the CJNG did not block the highways most critical to national logistics, but rather those where its cells were already present. Nevertheless, with 194 blockade events, the organization managed to degrade approximately 50.6% of national travel capacity—equivalent to 69.9% of the maximum theoretical disruption achievable with the same number of blockades under an optimal strategy. The gap between actual and optimal performance is explained almost entirely by a single structural factor: the three most central nodes the CJNG did not block—Culiacán, Los Mochis, and Navojoa, along the Pacific spine of Highway 15—lie in Sinaloa Cartel territory. It was not a lack of strategic sophistication that prevented optimal disruption, but territorial boundaries with its principal rival. Paradoxically, this is evidence of both strength and clear limits: the CJNG can simultaneously activate dozens of cells across 25 states, yet its violent power operates within a geography defined by inter-cartel equilibria, not by the presence of the state. As Ley and Trejo argue, political impunity granted by state actors is likely the most important force multiplier of these organizations; but the February 22 mobilization data suggest that even with that multiplier, the CJNG functions as a decentralized federation of cells with heterogeneous territorial reach—not as an actor capable of projecting uniform coercive power across the national territory.
[End of AI-drafted paragraphs]
Although this analysis is preliminary, it suggests that some actions were planned in advance—especially in the CJNG’s operational core in Jalisco—while in other regions local commanders acted opportunistically within a limited repertoire of visible but operationally unsophisticated tactics. A fundamental question remains whether the objective was ever truly to challenge the Mexican state, or rather to raise what political science calls “audience costs” if the government continues to strike them. Citizens understandably feel fear in the face of unleashed violence amplified through social media. Yet the Mexican government’s agency is evident. It is possible that the incidents were primarily intended to generate fear and signal to criminal rivals, local and state governments that cooperate or refuse to cooperate, and to citizens at large, that when we awoke, the organization was still there.