This series documents that coverage chronologically: what I found, what the media reported, and what consequences I faced as a journalist.

What I Found

On February 22, 2026, while the CJNG executed 252 roadblocks across 20 Mexican states, a parallel operation was unfolding on social media. Using my signal intelligence tool E31 — which processes over 54 million records — I identified three coordinated groups of accounts:

• Accounts directly linked to the CJNG amplifying chaos
• Right-wing opportunist groups exploiting the crisis against the government
• Artificial accounts mixing real images with AI-generated content

Mexico’s Secretary of Security Omar García Harfuch publicly validated my findings on two occasions: February 24 and March 13, 2026.

The International Coverage

In the weeks that followed, over a dozen national and international outlets cited my work. This series documents each of those publications with context, translation, and analysis.

Outlets that covered my findings: AFP · France 24 · OCCRP · El País · Infobae · Milenio · Tribuna Noticias · Pacozea · Brújula News · La Octava Digital · Swiss Info · La Nación

The Consequences

This coverage had a direct cost. I suffered a home break-in, death threats from the CJNG, and a physical assault in which three individuals beat me and stole my laptop. On May 3, 2026, I left Mexico. I am now writing from Spain, in exile.

This series is also a record of what can happen to a journalist who documents the digital infrastructure of organized crime in Mexico.

Context

Two days after the military operation in which Nemesio Oseguera Cervantes, El Mencho, was killed, Grupo Milenio published an analysis of the parallel war that had unfolded online. My work tracking fake accounts and bots was cited as a central reference.

What Milenio Reported About My Findings

The Milenio report documented how, while CJNG armed groups burned vehicles and blocked highways across 20 states, a parallel disinformation front was unfolding on social media. My analysis was cited to explain the propagation mechanism: coordinated accounts mixed real images with AI-generated content to amplify fear.

Milenio highlighted how I traced the origin of false messages and exposed their replication chain — a process I had previously applied to document the “Peñabots” and other coordinated influence operations in Mexico.

Why This Coverage Matters

Milenio was one of the first major national outlets to frame the CJNG disinformation as a structured operation — not spontaneous chaos. This distinction is central to my work: organized crime does not improvise on social media. It operates with troll centers and propaganda strategies comparable to state actors.

→ Read the full report at Milenio (Spanish)

Context

On February 26, AFP distributed a report that would be picked up by dozens of outlets worldwide. The article documented the CJNG’s disinformation operation during the narcobloqueos and cited me as the primary source who had identified the three groups of coordinated accounts.

My Findings as Reported by AFP

AFP identified more than 38,500 shares of false content across various social networks. In the report, I explained that behind this amplification were three distinct groups: the CJNG itself magnifying chaos, right-wing opportunist groups, and artificial accounts mixing real footage with AI-generated content.

France 24 added a detail not included in AFP’s first version: that after publishing my video analysis on X, I received direct threats. It was the first time an international outlet documented the reprisals against me for this work.

The Impact of AFP Distribution

Distributed by AFP, the report appeared in outlets across Spain, Argentina, Costa Rica, Switzerland and other Latin American countries — including Tribuna Noticias, Swiss Info, Pacozea, La Nación (Argentina), and France 24 in both Spanish and English.

This mass distribution increased my exposure — and the pressure on my personal security.

→ Read at France 24 (English)

Context

The OCCRP is one of the world’s leading investigative journalism organizations, specializing in organized crime and corruption. Their feature “Fear is the Message” was one of the most comprehensive international investigations into the CJNG’s digital propaganda machine — and I was cited extensively as the primary Mexican expert on the operation.

My Analysis in the OCCRP Investigation

OCCRP documented how the CJNG used a combination of spectacle and disinformation to amplify fear across Mexico in real time. I explained to their journalists how cartel-linked trolls manipulate the X (Twitter) algorithm to generate critical mass:

“What the Jalisco Cartel trolls do is generate a critical mass. They know how to manipulate Twitter’s algorithm.”

— Alberto Escorcia, cited by OCCRP

I also explained how the CJNG’s response to El Mencho’s death resembled a national-scale “Culiacanazo” — referencing the 2019 Sinaloa Cartel operation — but with unprecedented digital coordination across 20 states simultaneously.

Why OCCRP Coverage Matters

The OCCRP investigation placed my findings in a global context of cartel disinformation. It demonstrated that the CJNG’s digital operation was not improvised — it was a deliberate strategy combining physical violence with algorithmic amplification to maximize fear and confusion.

Also cited in Infobae’s coverage of the OCCRP report: La lucha tras la muerte de El Mencho también se libra con algoritmos

→ Read the full OCCRP investigation

Context

El País — one of the most widely read Spanish-language newspapers in the world — published an investigation into the use of AI and bots during the disinformation wave following El Mencho’s death. I was cited as a “journalist and researcher specializing in disinformation” and my identification of 500 bot accounts that amplified false profiles and generated panic — including a fabricated stampede at Guadalajara airport — was featured prominently.

Key Findings Reported

El País documented how AI-generated images were mixed with real footage to create a narrative of chaos far beyond what was actually happening on the ground. My technical analysis of the bot network provided the investigative backbone for their report.

This was the first major European outlet to cover my work on the CJNG disinformation operation — a significant milestone for international visibility of the issue.

→ Read the full report at El País (English)

The CJNG as a Criminal Enterprise

In an extensive interview with Infobae México, I explained in detail the CJNG’s digital structure. My central thesis: the cartel is not merely a criminal organization — it is a corporation with singers, agencies, various business structures, and — crucially — troll centers dedicated to propaganda.

“Jalisco is not a cartel, it is a criminal enterprise. It has singers, agencies, various businesses.”

— Alberto Escorcia, Infobae México, March 4, 2026

Signal Intelligence Before the Operation

In a second Infobae interview on March 6, I revealed a key finding from my E31 tool: the day before the operation against El Mencho, there was unusual activity on Reddit — a pattern similar to what was detected before the arrest of Ryan Wedding, linked to the Sinaloa Cartel.

This type of pre-event signal — coordinated platform activity before physical events — is one of E31’s core capabilities and one of the most relevant contributions of my work to intelligence journalism in Mexico.

→ First Infobae interview (March 4)
→ Second Infobae interview (March 6)

The Salinas Pliego Attack

On March 12, 2026, Ricardo Salinas Pliego — one of Mexico’s wealthiest men — directly mentioned me on X demanding an apology for my bot report. The following day, March 13, La Octava Digital reported the incident.

Also on March 13, Security Secretary García Harfuch cited journalistic reports on the CJNG at the presidential press conference as referents for opening criminal investigations. My public exposure had reached its peak.

The March 14 Death Threats

On March 14 — one day after Harfuch cited my work and Salinas Pliego attacked me — I received direct death threats from CJNG-linked accounts on Twitter. The message was explicit: stop talking about El Mencho.

The timeline is clear: greater public exposure → greater retaliation. This pattern would repeat on April 9 with the physical assault.

The Testimony

On May 4, 2026 — one day after leaving Mexico — Brújula News published my video testimony documenting the systematic harassment, physical assaults and death threats I received as a direct consequence of my investigative work on the CJNG disinformation networks.

What I Documented

• February 11: Home break-in — Roberto Gayol 147 Int.5, Mexico City
• March 14: CJNG death threats via Twitter
• April 9: Physical assault by three individuals — beaten, laptop stolen
• April 25: Formal criminal complaint filed (Case: CI-FIGAM/UAT-GAM-6/UI-1 S/D/00375/04-2026)

Brújula News was the first outlet to publish my complete testimony and contextualize the attacks as a direct consequence of my research on disinformation and organized crime.

→ Read at Brújula News (Spanish)