Suspected Facebook Account Operated by CJNG in Guanajuato

The missing account has been found, providing further evidence of utilization of social media by CJNG in Guanajuato

Suspected Facebook Account Operated by CJNG in Guanajuato
Share article on LinkedIn Share article on Facebook Share article on Twitter

Leer en español

A Facebook page I've suspected associated with Jalisco New Generation Cartel (CJNG) added two new posts on Sunday. The page, first created in October had posted last on November 10. It has made less than a dozen posts, all of which related to CJNG in Guanajuato. In an article I wrote towards the beginning of December about the targeted killing of El Wualo, I put forth my thinking on evidence observed that showed social media playing a role in the dissemination of the narco-message left alongside the body. There were still unknowns which left me feeling the analysis incomplete. But it was beneficial in that it allowed us a foundation to build upon when future events happen. With the two new messages posted Sunday, we now have more information that fills in those unknowns. The Facebook page is the one I couldn't find when I wrote the article in December. This is the most definitive instance of the organized crime group using social media in Guanajuato that I've observed so far.

It should be said that when speaking about CJNG in this article I am talking about them specifically in Guanajuato and nowhere else.

What's known so far

Before we talk about the other account and what was posted Sunday, I want to summarize and add some clarity to my analysis from before. The hypothesis described in the last article is that CJNG is using Facebook accounts to spread images of their crimes but more importantly the narco-messages left. Mentioned were reasons they might partake directly in the dissemination. One being that if those who traditionally leak images of such things to the press stopped doing so. Those people being first responders: paramedics, crime scene technicians, investigators or law enforcement. That could provide motivation for the group themselves to create and use their own social media accounts to spread. Part of the unknown was that the original account I had discovered in November, I could no longer find. There were also differences in how some of the photos were marked. They all featured cursive lettering but in different forms. The account I could find, that was posting photos with cursive lettering wasn't solely making posts like that. Making it less clear what level of association the account might have to the group. With less a likelihood of being an actual member of the group, I classified the account as being an intermediary. In that, when the organized crime group committed crimes, it had someone with an established social media presence distribute it for them. These intermediaries are less often well-known social media accounts who share such material. But accounts with a very regional focus and that presumably those in the group are familiar with personally. The assumption here is that they're not co-opting random people on the Internet as intermediaries but those they know personally.

Social media distribution possibilities

To speak in more direct terms, the intermediary is not a member of the organized crime group. In a general sense, they're certainly associated. But the point I want to get across is that it's not a full-time job, or even close. The intermediary doesn't run their social media account solely for the distribution of content sent to them by the organized crime group. These accounts rarely have massive followings but they have enough. The posts will also get shared to public and private groups where most of the circulation occurs. An account can choose which posts to share to groups, and because they shared of their posts, doesn't mean all of their posts are open to anyone in the group. The account also might not be the one that shared the post to the group, others can share another account's posts into a group. Think of sharing a post to a group on Facebook like how a quote tweet is on Twitter. In that the quote tweet will get lots of likes and retweets but the original tweet won't.

I explain all of this to show how the intermediary account doesn't need a large following in order for its posts to still find significant distribution. Also, to make specific what kind of account I am describing. These are not accounts that we all know and follow, that typically are known to distribute such content. They are smaller, regionally focused, that exist only on Facebook. They tend to be either random identities or fake press outlets. But they aren't focused solely on red notes. They will post and share a variety of news topics.

Being that the association with the group in an intermediary relationship is less defined. It's difficult to conclude if it was the intermediary who was marking the photos with the cursive lettering or someone else.

El Guanajuatense returns

One significant piece of missing information from the prior analysis was that I wasn't able to find the account I had originally observed posting pictures marked with cursive lettering. Well, Sunday I found it, it coming across my radar on Facebook because it made two new postings that were shared in groups I'm apart of. The first was what they have traditionally posted in the past, that is photographs of narco-messages left. The other is something they have never posted before. A disturbing video that shows two men with another man standing in between them. The man in between has a white blindfold across his eyes with the four letters written, CJNG. Stamped along the bottom of the video are two skull emojis along with the words Grupo Elite.

There are differences between this account and the one spoken about prior I labeled an intermediary. This account I do not believe is an intermediary. I believe this account is being ran by members of the group directly, for the sole purpose of distributing this kind of material. There are notable differences in how this account operates. Most important being that all of the posts show only incidents related to CJNG. In total there are only nine posts, the first happening on October 6. That post features the heinous picture from the article mentioned prior. I talked about in that article how that level of performative depravity is less prevalent than typically thought. Also it's relevant to mention a distinction in styles of narco-messages. These larger narco-messages are called narcomantas or narco-blankets. They are different from the cards not just in appearance but in messaging. The narco-blankets typically are not addressing a single crime or incident like the neon cardboards are. But instead offer a more general message, often directed at governments and corrupt officials, though sometimes criminal rivals as well. They usually are left in more public places, sometimes hung from bridges, not left at crime scenes. That being so it could be interpreted as taking place at the hands of someone closer associated to CJNG than not. In other words, it was less likely the work of mercenaries. Those narco-blankets of some kind of vinyl, in full color, aren't the cheapest. I would be curious to know what is required to make them. If it is able to be screen printed or if a large professional printer is required. If it is the latter, I'd assume not many printers capable of producing such a thing can exist within a certain radius. Only an established print or sign making shop potentially would own that sort of equipment.

Another post from November 6 contains two photographs, one of a narco-message the other of a male with an presumed fatal gunshot wounds. An interesting thing to note about the picture of the narco-message is that the writing is done in cursive. Which goes with the style of the single cursive letter being added to some of the pictures observed. Suggesting that potentially those writing, leaving, and taking pictures of the messages are all associated.

Screenshot of Facebook post

A post coming a couple days later on November 10 shows the same, a photo of a narco-message and that of a male with presumed fatal gunshot wounds. Coincidentally the photo of the narco-message has a shadow like the one from the El Wualo hit. This one looks more like it was someone with a gun, but maybe not the killer. The reason I say that is because the other picture is very interesting. It has the cursive letter but it also shows a vehicle. Again, using the shadow for judgement, it appears to be a pickup truck, one that's used by law enforcement, identified by what looks like a roll cage. The vehicle looks parked in a way that would make sense for law enforcement. All being true, that would mean that these photos didn't come from the perpetrator, but from law enforcement. I'll speak on that in a moment.

Screenshot of Facebook post

That posting from November 10 is the last one until what was posted Sunday. I thought that there were others, the ones that I had tweeted about around the time, very similar to what was posted yesterday. A bunch of pictures of narco-blankets allegedly in various towns in and around Celaya. What is interesting about these postings, and all of them really, is that they aren't worded in a way someone unassociated would report on them. They are verbatim with some added to what is written in the actual narco-messages. This is notable because it's not how press outlets report on such material or even the anonymous nota rojas.

January 3

Posted Sunday were pictures and a video. The pictures came first and seem be from last week. It's interesting that it took a couple of days for these pictures to be uploaded. It's as if the traditional channels of distribution, like the press or intermediaries, failed. Thus requiring CJNG to use it's own social media account for distribution.

Screenshot of Facebook post
Screenshot of Facebook post

Over the weekend I started to see a couple reports come out of legitimate press outlets in Guanajuato. One of the first from Periodico Correo published on December 31 titled Criminal group attacks the state: leaves several narcomantas and human remains.

At the three points, the human remains were left together with canvases of a criminal group, and so far the number of bodies to which the remains correspond, as well as their gender and identity, is unknown .

Likewise, during this time, several canvases with messages from a criminal group were reported in at least five points in Celaya.

In another article published the same day by Maseaca titled To say goodbye to the year, criminal groups leave human remains and narcomantas in different municipalities. Writing that the contents of the messages were not revealed to the media.

It is also known that the human remains were left along with tarps from a criminal group, who left messages that were not revealed to the media.

Valor Por Tamaulipas (VPT) was the only one with a picture showing one of the narco-blankets. Hilariously, they took a screenshot of the image opened in their direct messages on Twitter, revealing some of their contacts. From my investigating this is the only picture that came out of the narco-blankets until the Facebook posting yesterday.

Zoom in

The message of the Facebook post added alongside the pictures is:


It is almost identical to what you would expect written on a neon cardboard. Except there is no picture of any neon cardboard, instead that message has been passed along digitally. Also mentioned are seven areas, La Luz, Juan Martín, Santa María del Refugio, El Sauz, Los Mancera, Celaya and Tamayo. In the coming days I will be working to geolocate the pictures that can be.

HOSTAGE: (…) to deliver merchandise

KIDNAPPER: For whom?

H: For Yeyo

K: Who else?

H: His wife and sister in law

K: Where? (They say “¿Qué punto?”, that means, the location where the drug is distributed)

H: Two in “La Lagos” for “Yayo” and “Cholo”; one in “Palo Seco” for Carreño; two in “Monteblanco" for “El chaparro” and “El Chucho” (all those points are neighborhoods in Celaya)

K: What did they promise you?

H: Well-being and protection for me and my family

K: Did they keep their promise?

H: No

K: What is your message for the “Cartel de Santa Rosa”?

H: You must retreat because Cartel de Jalisco is here and is la “mera verga” (they rule)

K: Stop killing innocent people, you filthy fucking cowards. M-1, R-5, Caña, go out and face us, you ordinary fuckers. Let’s make this clear: Celaya and all Guanajuato have an owner, we came to stay. Attentively, “Cartel de Jalisco Nueva Generacion, Grupo Elite”.

The video undoubtedly takes things to another level. It was very obviously made with the intention to release on social media given the precautions taken to hide their identities. Judging by the emojis and words sloppily place along the bottom, it seems safe to assume the video was made with nothing more than a cellphone camera.

Looking ahead

This Facebook account fills in some of the mystery. While the previous account appears to be an intermediary, this account looks ran by the organized crime group in Guanajuato itself. Since it only posts things related to CJNG and things that no one else has posted. All of the photos posted to the account are marked with a cursive letter. Now, they've posted a video which could have only come from the organized crime group. This account being established only in October and having less than a dozen posts, makes more evident that its purpose is solely for the distribution of material from the group.

In the December article I spoke about a concept called the gray zone of criminality. If these crimes are being perpetrated by CJNG, whom is understood to be an organized crime group, then all of this would be existing within the gray zone. The pictures from November 10 that appear taken by law enforcement could be a sign of this. I will need to go back and further investigate each of these incidents to see what was reported at the time, how it was reported, and which photos came out when. I see two explanations. One being that the Facebook account did not have photos of the crime scene and so through the gray zone was given photos to then distribute on social media. Why photos were not taken at the time by the criminals, who knows. The second possibility is that those photos still came from the gray zone but went to someone else. The someone else is where the Facebook account—El Guanajuatense—would have gotten them, and marked them with the cursive letter before sharing them to their page. I definitely have concern about this anomaly, it could show less cohesion between everything and that there is not always a consistent process for which this material is distributed. It could also show that it all kind of depends on the who, what, where. And that the style of narco-message can have an impact on that process.

The pictures in question from the November 10 incident are of a crime scene and a narco-message. Compared to the performative dismemberment and hanging of narco-blankets in various towns, the assassinations are less involved. As stated before, this leads me to believe that the narco-blanket incidents would be done less by hired hit man and more by members of the group. Producing the narco-blankets requires more expertise as opposed to a handwritten neon poster board. In addition, the messaging on the narco-blankets is more general, which could suggest that it was written by someone that is closer associated to whatever the leadership of CJNG is in Guanajuato. Since it would be presumed that leadership would be the ones directing the general messaging campaign of the group. Compared to the narco-messages left following targeted killings that are more individual in nature.


Altogether, this is a significant development because it provides information detailing an account that doesn't appear to be what I've described as an intermediary. Instead the account appears created by members of the group with the sole purpose of distributing material related to the crimes they've committed. The pictures of the narco-blankets are all marked with cursive lettering. One of the cardboards shows handwriting that is in the cursive style. For the first time, the page uploaded a video allegedly from the group. Which could only come from the group, and if they, the Facebook page, are the group, it makes sense for them to upload it.

But we are still left with unknowns. What if the pictures from the Nov 10 incident are taken by law enforcement? That would suggest that those cops were aligned through the gray zone of criminality with members of CJNG. I'll note though that doesn't mean that all cops in the gray zone are associated with CJNG. The gray zone of criminality is a mixture of all criminal and state actors, not just one group of them. But like mentioned, it could also be that cops didn't commit the act but provided pictures of it.

In some circumstances, these are unknowns we have to live with. Which is part of analyzing these kinds of incidents. It's difficult to know everything and with some things we can't expect we ever will. Closer analysis of the individual incidents listed in October and November I think could help further fill in some unknowns. And of course future events will provide more to compare and contrast. What's been gathered so far is just the beginning. This account only showed up in October. With little resistance to CJNG's excursion into the state, it'll be interesting to see how the account is utilized over the coming year. Uploading the video will certainly draw more attention, and I wouldn't be surprised if it leads to the account getting banned. If I was an investigator, I'd be on the phone to Facebook asking for that IP address.

Share article on Twitter Share article on Facebook Share article on LinkedIn

All company, product and service names used in this website are for identification purposes only. All product names, logos, and brands are property of their respective owners. Use of these names, logos, and brands does not imply endorsement. We disclaims proprietary interest in the marks and names of others.

narco dot  news