Context

On February 26, AFP distributed a report that would be picked up by dozens of outlets worldwide. The article documented the CJNG’s disinformation operation during the narcobloqueos and cited me as the primary source who had identified the three groups of coordinated accounts.

My Findings as Reported by AFP

AFP identified more than 38,500 shares of false content across various social networks. In the report, I explained that behind this amplification were three distinct groups: the CJNG itself magnifying chaos, right-wing opportunist groups, and artificial accounts mixing real footage with AI-generated content.

France 24 added a detail not included in AFP’s first version: that after publishing my video analysis on X, I received direct threats. It was the first time an international outlet documented the reprisals against me for this work.

The Impact of AFP Distribution

Distributed by AFP, the report appeared in outlets across Spain, Argentina, Costa Rica, Switzerland and other Latin American countries — including Tribuna Noticias, Swiss Info, Pacozea, La Nación (Argentina), and France 24 in both Spanish and English.

This mass distribution increased my exposure — and the pressure on my personal security.

→ Read at France 24 (English)

Context

The OCCRP is one of the world’s leading investigative journalism organizations, specializing in organized crime and corruption. Their feature “Fear is the Message” was one of the most comprehensive international investigations into the CJNG’s digital propaganda machine — and I was cited extensively as the primary Mexican expert on the operation.

My Analysis in the OCCRP Investigation

OCCRP documented how the CJNG used a combination of spectacle and disinformation to amplify fear across Mexico in real time. I explained to their journalists how cartel-linked trolls manipulate the X (Twitter) algorithm to generate critical mass:

“What the Jalisco Cartel trolls do is generate a critical mass. They know how to manipulate Twitter’s algorithm.”

— Alberto Escorcia, cited by OCCRP

I also explained how the CJNG’s response to El Mencho’s death resembled a national-scale “Culiacanazo” — referencing the 2019 Sinaloa Cartel operation — but with unprecedented digital coordination across 20 states simultaneously.

Why OCCRP Coverage Matters

The OCCRP investigation placed my findings in a global context of cartel disinformation. It demonstrated that the CJNG’s digital operation was not improvised — it was a deliberate strategy combining physical violence with algorithmic amplification to maximize fear and confusion.

Also cited in Infobae’s coverage of the OCCRP report: La lucha tras la muerte de El Mencho también se libra con algoritmos

→ Read the full OCCRP investigation

This series documents that coverage chronologically: what I found, what the media reported, and what consequences I faced as a journalist.

What I Found

On February 22, 2026, while the CJNG executed 252 roadblocks across 20 Mexican states, a parallel operation was unfolding on social media. Using my signal intelligence tool E31 — which processes over 54 million records — I identified three coordinated groups of accounts:

• Accounts directly linked to the CJNG amplifying chaos
• Right-wing opportunist groups exploiting the crisis against the government
• Artificial accounts mixing real images with AI-generated content

Mexico’s Secretary of Security Omar García Harfuch publicly validated my findings on two occasions: February 24 and March 13, 2026.

The International Coverage

In the weeks that followed, over a dozen national and international outlets cited my work. This series documents each of those publications with context, translation, and analysis.

Outlets that covered my findings: AFP · France 24 · OCCRP · El País · Infobae · Milenio · Tribuna Noticias · Pacozea · Brújula News · La Octava Digital · Swiss Info · La Nación

The Consequences

This coverage had a direct cost. I suffered a home break-in, death threats from the CJNG, and a physical assault in which three individuals beat me and stole my laptop. On May 3, 2026, I left Mexico. I am now writing from Spain, in exile.

This series is also a record of what can happen to a journalist who documents the digital infrastructure of organized crime in Mexico.

Context

Two days after the military operation in which Nemesio Oseguera Cervantes, El Mencho, was killed, Grupo Milenio published an analysis of the parallel war that had unfolded online. My work tracking fake accounts and bots was cited as a central reference.

What Milenio Reported About My Findings

The Milenio report documented how, while CJNG armed groups burned vehicles and blocked highways across 20 states, a parallel disinformation front was unfolding on social media. My analysis was cited to explain the propagation mechanism: coordinated accounts mixed real images with AI-generated content to amplify fear.

Milenio highlighted how I traced the origin of false messages and exposed their replication chain — a process I had previously applied to document the “Peñabots” and other coordinated influence operations in Mexico.

Why This Coverage Matters

Milenio was one of the first major national outlets to frame the CJNG disinformation as a structured operation — not spontaneous chaos. This distinction is central to my work: organized crime does not improvise on social media. It operates with troll centers and propaganda strategies comparable to state actors.

→ Read the full report at Milenio (Spanish)