Charting Out the Digital Ecosystem of Gangs in the U.S. and Mexico

Charting Out the Digital Ecosystem of Gangs in the U.S. and Mexico

Julian Way and Robert Muggah [1]

People, drugs and weapons are routinely smuggled across the U.S.-Mexican border. Drug trafficking cartels and organized criminal gangs are suppliers, brokers, retailers and regulators of the trade. Conventional assessments of the political economy of the illicit trafficking along known corridors such as San Diego-Tijuana or El Paso-Ciudad Juarez rely on painstaking qualitative assessments, including key informant interviews with those in and outside the business. In some cases, quantitative approaches are deployed, including modeling flows on the basis of extant data on sex trafficking or drugs and arms seizures.

Due in part to the rapid digital penetration of the Internet and social media over the past decade, there are novel ways of tracking cartel and gang activity. Many of these approaches are still experimental and in early stages of development.[2] This article considers the digital ecosystem linking gangs in San Diego, Tijuana and more widely across Mexico and other parts of Latin America. The focus is not restricted to mapping the online presence of gangs in social media and related public digital platforms, but also the dynamic interaction between members, affiliates and the wider public. The article draws on research conducted in partnership with the National Institute of Justice (NIJ) and University of San Diego in 2015.

The article considers the digital activities of gangs – especially Latin American groups – at two levels. At the micro-level, the focus was on mapping online gang involvement in sex trafficking in San Diego in the U.S. and Tijuana in Mexico.[3] At the macro-level, we considered the activities and dynamics of online gang networks in southern California, Mexico and wider Latin America. We then applied a combination of social media analytics, social network analysis, and digital forensics to understand the distribution and dynamics of cartels and gangs in cyberspace. While experimental in nature, the assessment generated descriptive and methodological findings.

First, there is no strong empirical evidence of Latino cartels and gangs in either the U.S. or Mexico using Twitter to solicit, sell, or profit from sex work. While there is considerable evidence in the public domain of San Diego-based gangs – especially African American and so-called hybrid groups – having used specific social media tools such as Twitter to recruit and pimp out women and girls, it is not evident in the profiles of specific Latino cartel, gang or affiliate groups on either side of the border.[4] It is also possible that related communications are encrypted, occurring in private messaging, or were simply not detected by the research team.[5]

Second, different Latino cartels and gangs use Twitter and other social media platforms to coordinate and conduct criminal activities. Several groups ranging from the Sinaloa Cartel’s enforcer unit – La Gente Nueva – and affiliates such as Los 12s and Los Antrax use Twitter to supplement more traditional communication channels. It was possible to detect confirmation codes, operational updates, locations, and explicit instructions issued by specific gang members in alphanumeric codes. Additional digital forensic research revealed key leaders, wider membership, and supporters, or “fans”.

Third, Latino cartels and gangs in Mexico and the U.S. adopt varied approaches to interacting on Twitter and other social media platforms. Some Mexican cartels and gangs developed large followings, or fan bases, on Twitter. Members often interact with fans through retweets, shout-outs and direct postings involving photos, text or codes. Fans that redistribute these messages are thanked by gang members specifically. Meanwhile, San Diego-based Latino gangs more routinely use unidirectional tweets, in some cases linked to celebrity accounts or YouTube videos. Content analysis suggests the messages of these latter groups are more superficial than their Mexican counterparts.

Fourth, Latino cartel and gang members are using Twitter to communicate with transnational network. Mexican-based members used Twitter to communicate with affiliates elsewhere in Mexico, the U.S., Central and South America. Evidence of interaction was also bolstered by photos/descriptions of cross-border travel. There were several cartel and gang member profiles that post messages from both sides of the U.S.-Mexico border. Likewise, there are examples of specific cartel and gang members with digital connections to street gangs in the U.S. as well as cartels in Colombia. Moreover, some northern Mexico-based gang members interact directly with fans elsewhere in Mexico as well as in Central and South America.

Finally, social media analysis can help detect, identify, track and monitor ongoing communications of cartels and gangs. While challenging, it is possible to undertake digital terrain studies of gangs at the micro- and macro-scale. After conducting multi-stage and iterative research, it was possible to begin charting the digital presence and networks of a host of gangs and affiliates. These include, for example, the Skyline Pirus, Los Antrax, Gente Nueva, and Los 12s. New and lesser-known groups in the public discourse were also identified, highlighting the practical application of social media analytics for law enforcement purposes.

Ultimately, research on the digital networks of gangs is inductive and iterative. While theoretically desirable it is not possible to develop a monolithic deductive methodology to “scan” websites for gang activity using keyword searches and content analysis alone. Gang nomenclature is highly dynamic, varies across time and space and is routinely coded. What is instead required is a “spiral” approach that involves selective research, testing micro-hypotheses, analyzing results, and repeating.[6] The findings from each spiral are cumulative and contribute to refining the next spiral of analysis. Research involves a combination of text searches, content analysis of selected profiles, examination of networks between groups, and re-testing.

There are reasons to be optimistic about the prospects for mapping cartels, gangs and their networks in cyberspace. A wide range of studies are emerging that not only seek to identify groups and activities, but also identify hostile threats[7] or predict future events on the basis of past trends.[8] This article explores the potential for tracking social media to better understand underlying behavior of non-state groups operating in clandestine markets. The article is divided into four sections. The first section considers the background for digital terrain studies of gangs, a new but rapidly growing space. The second section then explores the methods applied in the present study focusing first on San Diego County and Tijuana, and latterly on wider networks in Mexico and beyond. In section three, the authors hone in on key findings and implications. The final section offers a number of concluding observations. Taken together, it offers a positive empirical case for expanding social media analytics in the study of cartels and gangs in the U.S., Mexico and beyond.

Background

While difficult to count with precision, gangs are widely distributed in Mexico and the US. The Mexican Attorney General’s Office counts some 40 major drugs-related gangs in Mexico.[9] In Tijuana, a heavily contested area due to its land and coastal proximity to the U.S., there are at least three known cartels and various subgroup affiliates.[10] Meanwhile, the FBI counts as many as 33,000 street gangs in the U.S. with as many as 1.4 million members.[11] In San Diego, researchers have identified over 150 gangs with some 7,500 members.[12] Some of these groups play a disproportionate role in managing the distribution of people, drugs and weapons domestically, and also across borders.

Mexican cartels and gangs vary tremendously in size and scope of operation. Mexico-based and U.S.-based groups examined in the course of this assessment stretch from Tijuana to other parts of northern border with the U.S. In Mexico, the primary groups examined include Tijuana[13], Sinaloa[14], and Juarez[15] cartels and the BLO[16], which split from Sinaloa in 2008. Each of these groups has alliances with gangs – including Barrio-18, and MS-13 – as well as other subgroups. For example, Los Antrax, Los 12s, and La Gente Nueva – an enforcer of Sinaloa – are also active in Durango, Sonora and Chihuahua.[17] Other gangs of interest to this assessment include the Lorenzanas, Mendozas, Leones, CIACs, Chariros, Valles, Cartel de Texis, Perrones, Tarzanes, Renazcos, Norte del Valle Cartel, Urbanos, Los Paisas, and Libertadores stretching from Colombia, Nicaragua, Honduras, El Salvador, and Guatemala to Mexico.

San Diego is known in some circles as the “gang capital” of the U.S. There is an exceptional diversity of gangs of varying ethnic and ideological origins in San Diego County. Among them are at least 200 members of the Mexican Mafia, a prison-gang, and hundreds more associates of Mexican drug trafficking cartels and affiliates.[18] While the primary activities of Latino gangs are assumed to be drugs-related, it is also presumed that they are involved in other forms of contraband such as the smuggling of sex workers. A major crackdown on a San Diego-based sex trafficking ring in 2014 resulted in over two dozen gang members being indicted.[19] Researchers estimate the industry at roughly US$ 810 million a year involving as many as 100 gangs, including Latino groups.[20]

Many of San Diego, Mexican, and Central and South American gangs are online and regular users of social media platforms.[21] Gangs often geo-tag locations thus creating opportunities to recruit and target real or potential rivals. There has been some research into the ways in which local San Diego gangs use social media to lure young girls from schools.[22] Other assessments suggested that as much as 75 per cent of sex trafficking occurs online and can trace online pimping to sites like Craigslist and BackPage.com.[23] Meanwhile, in Mexico, cartels and gang leaders generate massive social media followings, including on Facebook, Twitter and YouTube.[24]

While gangs in Mexico and the U.S. vary considerably in how they engage with social media, there are nevertheless common patterns. Many use them to issue threats, exchange insults, and even initiate encounters that can rapidly escalate. So-called “cyber-banging” or “Internet banging” is increasingly common in the U.S. and parts of Mexico. The key characteristics include promotion of gang affiliation and communication of specific activities; search for notoriety and status associated with implied or real acts of violence; and networking and sharing of information with rival or friendly gangs across different locations. In some cases, social media may also involve proactive recruitment, thus creating bridges with non-gang member affiliates.[25]

The use of social media network analysis to identify high-risk groups and individuals is not new. Law enforcement and social workers in major U.S. cities regularly survey platforms such as Facebook, MySpace, Twitter and YouTube to better understand activities and interactions – including so-called “cyber-banging” and “cyber-tagging” – between specific groups.[26] Academic research is also expanding in this space, including partnerships with major corporations such as IBM and Microsoft.[27] Other studies have emerged from Chicago and other cities in recent years, looking at the intersection of gang violence and social media.[28]

A signal challenge for mapping gang interactions online relates to unlocking the base language – or better, lexicon – which can vary considerably across time and space. While it is often possible to decode gang nomenclature in a particular setting, it is not necessarily the case that the same pattern is used (or approaches to decoding can be replicated) in another. It is also important to stress that digital dialogue – including threats, posturing, and directives – are seldom limited to alphanumeric text. Indeed, signs, images, photos, videos, music and other “codes” are central to the communication structure – or shibboleth – of gangs.[29]

Methods

A key lesson from this assessment is that applied research on the digital ecosystem of gangs is complex, but feasible. Social media terrain studies and behavioral analysis of gangs are still in their infancy, and in this sense, the research contributes to a wider body of theoretical exploration. As expected, the study applied a grounded and mixed method approach. This means that theory is built from the “ground-up” through systematic collection and testing of data. Such an approach builds outward from the specific to the general. By definition inter-disciplinary, the authors required hard skills in social network analysis, as well as content and language knowledge of (Latino) gangs in San Diego County, Mexico and elsewhere in Latin America.

The study adopted Twitter as the primary platform for investigation. While other platforms were considered, including Facebook, Twitter was determined to be the most accessible and appropriate platform to deliver the most complete results. The majority of Twitter data is public and thus provides ready access for collection purposes. Facebook, in contrast, is not a reliable source of information due to our inability to access communications occurring on private group pages, via private messaging, and also the highly varied privacy settings that can be manually adapted by individual users. Accessibility issues also exist for WhatsApp, and other encrypted tools used for recruitment and prostitution. Moreover, applying website scraping techniques of websites used for prostitution and recruitment, such Craigslist and BackPage.com, were not within the scope of the study.

The approach adopted by the authors to mapping cartel and gang members, their networks, nodes, transnational relationship dynamics, and activities, can be summarized in six stages.[30] It is important to underline that this approach is iterative and overlapping, with feedback loops in the data collection, refinement and interpretation process. New information was constantly fed back into the data collection process. Key indicator datasets were continuously revised at each stage of analysis. The social media scanners (SMS) and social network analysis (SNA) dashboards developed by the authors were regularly updated to test new indicators, or potential shibboleths against previously collected data.[31]

The first phase involves open source research, data collection, and dataset compilation. This process entails open source and qualitative research to understand the target groups (Latino cartels and gangs) and the specific phenomena being explored (i.e. sex trafficking). It includes mapping the known presence of gangs and cartels of interest – including some 114 known street locations, the geographical scope of the collection process, and the specific activities of the target groups.[32] This first stage also includes the creation of “gang slang” libraries (key indicator datasets), in this case consisting of over 800 keywords using English, Spanish, Chicano, and other Latin American slang. Data collection runs for a set period of time. The collection process generally continues even after data interpretation begins and harvests all relevant data (worldwide) against the key indicators, in addition to all geo-located content within the predetermined geographical parameters.[33]

Figure 5.1 San Diego County Gang Activity Map 1

Source: Author’s research. Screenshot of San Diego County gang activity map and interactive dashboard created during the study.

A second phase entails the analysis of dashboards, refining and constraining keywords and building catalogues of interest. Collected data is assessed, analyzed and refined. The collections are first transferred into SMS dashboards for visualization and interpretation. Indicators that generate considerable false positives or “noise” are removed or constrained with additional search terms, geo-references, or geo-locations (geo-tags). This stage also consists of the initial assessments and analyses of collected data and content. Indicators are selected and individually searched within the scanners and the resulting tweet and profile content is read and assessed for relevance. This stage further includes the cataloguing of (suspected) profiles of interest and of newly identified indicators.

The third stage involves deep level analysis of SMS scanners and profile content. Once content of interest is detected and identified using the scanners, the investigation turns to specific tweets and profile content. At this stage language pattern charts are initiated as new key indicators are discovered and profiles examined. These can include indicators, such as keywords or hashtags, but also spelling patterns (the substitution of certain letters, alphanumeric codes, the use of special or foreign characters or symbols) and the appearance of emoticons. Preliminary behavioral analysis is also conducted at this stage, and assessments are compiled, mapping out patterns detected, indicators discovered (and their meanings if identified), and any other relevant information. Importantly, these first three stages may be repeated several times before a fruitful network of seed accounts is detected and we commence the SNA stages.[34]

Figure 5.2 San Diego Network SNA Dashboard 1

Source: Author’s research. Screenshot of Social Network Analysis (SNA) dashboard of San Diego-based Latino gang members and affiliates, and their top interactions.

The fourth stage includes SNA and snowballing of detected and identified networks. Once a fruitful network of seed accounts is determined to have high relevance, the SNA process begins. This includes the snowballing of profiles to determine the top interactions of their accounts. This can include a number of restrictions, such as their top ten most frequent interactions, their top twenty most frequent interactions, unidirectional or mutual (two-way) interactions, or other limitations. Once the parameters of the SNA are determined, the profiles of the given network are fed through a snowball script or profile scraper that collects all tweet content against the seed accounts and their wider networks, as determined through the constraints. The collected data is then inputted into SNA dashboards for deeper analysis and interpretation.

Figure 5.3 Sinaloa Network SNA Dashboard 1

Source: Author’s research. Screenshot of Social Network Analysis (SNA) dashboard of Sinaloa Cartel members and affiliates, and their top interactions.

The fifth stage requires deeper analysis of SNA dashboards and profile content. Collected data and content is analyzed using content and profile analysis methods. As with the SMS scanner, this includes the searching of individual key indicators within the SNA dashboards. These can include specific geo-references, or indicators related to specific activities. Importantly, the SNA dashboards also collect and identify any geo-located content. Profile and key indicator cataloguing continues and particular indicators of interest are highlighted as potential shibboleths. As with the deep level analysis of the SMS scanners, this process also moves outside the SNA dashboards themselves and qualitative findings are followed to their actual tweet locations and profiles online for more in-depth analysis.

The final stage consists of mapping of network behaviors, nodes, activities and transnational connections. The research team applied digital forensics and behavioral analysis to better understand positive profiles and associated content. This process involves micro-level analysis to better unpack the scope and scale of cartel and gang networks. This stage maps out the relationships, motivations, influential nodes, and any relevant transnational connections. The minimum data required to build out any meaningful assessment includes the group’s online presence, confirmed offline IRL presence through open source research, gang member indicators, and geo-referenced or geo-tagged location within our geographical areas of interest.

Figure 5.4 Sinaloa Network SNA Dashboard 2

Source: Author’s research. Screenshot of Social Network Analysis (SNA) dashboard of Sinaloa Cartel members and affiliates, and their top interactions.

The abovementioned approach was necessarily experimental and iterative, requiring constant adjustments in hypothesis testing and methods. Research was undertaken between April and June 2015, and October and December 2015, in a series of overlapping “spirals”. There was repetitive testing and content analysis of individual cases studies and profiles. During the course of eight months, a number of basic micro- and macro-level findings emerged. At the micro-level, the study first required determining the locations (San Diego County and Tijuana), themes (sex-trafficking), and gangs (Latino/Hispanic) of interest. The underlying assumption was that specific groups were involved in discrete illicit activities in key locations. Another basic expectation was that some measure of their activities was rendered digitally, including on social media.[35]

Moreover, the researchers also required developing a better understanding of the social media profile of gangs in San Diego County and Tijuana. This required developing a “gang slang” lexicon, including hundreds of keywords associated with various kinds of illicit activity. Dozens of specialists were consulted in the U.S., Mexico, Central and South America to develop searchable keywords. Online research was conducted to understand the social media profiles of more than 100 gangs and affiliate groups. Daily visits involved consulting dozens of social media sites of groups and individuals and retracing connections across complex terminologies.

It is worth stressing that many high-risk actors use codes that identify themselves as members of their “ingroup”, only to other ingroup members. We refer to these codes as shibboleths. A concept of Biblical origin, a “shibboleth” is a term used by a group to identify members of their ingroup and potentially detect members of opposing outgroups.[36] By using a shibboleth term, a member of a closed ingroup demonstrates affiliation and distinguishes his/herself from the crowd. In practice, this refers to gang member’s use of non-standard spellings and or alphanumeric codes, as well as hashtags, that can be picked up by other members of their gang or cartel. These shibboleths can contain symbols, Latin or Arabic numerals, special and/or foreign characters, which could not be detected in data collection methods without prior knowledge. To be clear, some gang members use almost no standardized spellings so that it is not possible to detect their communications without knowledge of their language patterns, or the actual indicators they use. A shibboleth provides immediate access to their content.

Examples of this include the African American and so-called hybrid gangs in San Diego. The Skyline Pirus, San Diego’s largest Bloods gang, use alphanumeric shibboleths (Bl80d, H69d, Wh80p, etc.) replacing the “oo” with the street numbers associated with their gang units. This is important because, once a shibboleth of this nature is identified, open text searches turn up 90 per cent or more gang-specific positive content. Thus we use the term shibboleth as an indication of a highly critical, group-specific indicator, which is often used in social media by groups whose membership is highly restrictive. Detecting, identifying and “unlocking” a gang’s shibboleths can allow for an accelerated process of detection and network expansion, and provide immediate access to new profiles for in-depth content analysis.

Ultimately, in order to detect and map-out gang networks in cyberspace – and social media in particular – one must necessarily build out from the micro to the macro. Real world phenomena are not necessarily reproduced digitally. Put another way, it is not correct to assume that a particular gang network exists online on the basis of IRL interactions. As such, it is necessary to build out the basic spatial, temporal, group and network parameters from the bottom-up. It is critical to draw on IRL phenomena to help reconstruct the digital profile of gangs and their networks, but they cannot be equated in an a priori manner.

Findings and Implications

The assessment generated a host of findings that apply to San Diego and Tijuana specifically, but also more broadly to Mexico and Latin America. The research initially focused on the existence of sex trafficking in San Diego by Latino gangs. It then widened out to examine potential involvement of groups in Tijuana. Finally, the research was extended to mapping out Latino gangs in Mexico and Central and South America.[37] The research terms examined several categories of sex trafficking, including sex trade actors, locations according to sex trade, act of prostitution, sex trade slang, known gangs and associated terminology. This involved monitoring over 800 terms in multiple languages.[38]

The mapping of cartel and gang presence and activities online was supplemented with deep digital forensics and behavioral analysis. Each time a positive example emerged of a relationship between specific cartel and gang members, content analysis was undertaken to explore the scope and scale of the association. A new discovery led to a new “spiral” of hypothesis testing and research. Often a series of “tweets” or “posts” needed to be followed retrospectively and prospectively to develop a more robust profile of the network. While far from exhaustive, the analysis revealed a host of findings about cartel and gang activities and dynamics in San Diego, Tijuana and more widely.

Silent About Sex Work

Despite being widely advertised online, there was virtually no evidence of Latino gang involvement in prostitution and sex work on Twitter. Instead, the team detected evidence of extensive African American and hybrid gang engagement on Twitter. The shibboleths adopted by these latter groups tended to be basic involving a combination of street numbers and letters. Additional examination of these non-Hispanic gangs in San Diego and other parts of the U.S. revealed extensive communications between affiliates in San Diego and other key prostitution circuit cities, including Atlanta, Phoenix, Houston, and others, but no direct involvement in the sex industry.[39] Another overall finding was the exposure of several Latino cartel and gang-affiliated members in San Diego, Tijuana and more widely in Latin America. Specifically, the research identified 22 San Diego-based gang affiliates using Twitter, many of them Sureños. Research also uncovered members of Los Antrax, La Gente Nueva, and new lesser-known groups.[40]

As noted in SecDev (2015a, 2015b) the study did not identify specific examples of Mexican or U.S.-based Latino cartels and gangs engaging in the sex trafficking industry online. There is growing open source references to likely cartel and gang engagement.[41] Other studies have highlighted examples of recruitment and prostitution using popular social media and digital marketing sites.[42] This assessment, however, did not reveal specific examples of individual or group involvement either in San Diego County or Tijuana.[43] It is possible, then, that gangs are simply not actively discussing their involvement or organizing operational activities associated with sex trafficking on Twitter for reasons described in the methods section above.

It is worth drawing attention to the challenges in detecting and monitoring Latino gang activities in the commercial sex trade industry using social media analytics. Hispanic cultural and gender norms relating to the position and sexual identity of women suggest that Latin American prostitution networks are unlikely to promote or publicly discuss their role in the sex trade. Additionally, many Latino gangs in California operate in top-down hierarchical structures, with gangs’ street activities dictated by their prison gang counterparts. These gangs prohibit prostitution and rape amongst their street colleagues and affiliates. These findings suggest that Latino gang members might be less likely to openly discussing prostitution on social media.[44]

Twitter is King

On both sides of the U.S. and Mexican border, cartels and gangs are using Twitter and other social media platforms to coordinate and conduct criminal activities. There are several examples of how groups are collaborating online. For example, the armed wing of the Sinaloa Cartel, La Gente Nueva, routinely used Twitter to coordinate with Los 12s, another subgroup of the cartel. In their interactions, confirmation codes, status updates, meeting locations, and individual identities are issued, often in code. What is more, content analysis of specific profiles allowed for the identification of key leaders, members, and supporters.

Figure 5.5 GN Tweet 1

There is a high degree of resolution afforded by the study’s analysis of online profiles. For example, “El Gallito” Hernandez, aka El12 (The 12), is not only one of the primary communicators but also the leader of the Gente Nueva subgroup – Los 12s (The 12s). He goes by the Twitter handle @El12GxNx: members of Los 12s almost all adopt alphanumeric code names with “Rs” to identify individuals, while also protecting real identities. Gente Nueva and Los 12s used Twitter to tweet code names, radio frequencies, meeting locations, specific instructions and updates. They also provided status updates on their criminal activities, warnings to colleagues, and information on the movement of law enforcement agencies in Mexico and the U.S.

Figure 5.6 GN Tweet 2

The following tweets are illustrative of how these activities work in practice. Consider the profile description of one of the key members of Gente Nueva (G.N.), Ricardo Cano (Figure 5.5). It reads: “Always full battery and at the order of #Pure701 #GxNx and standing firm with #The12 shots upward until they meet metal”. The geo-references include Laredo Texas, Sinaloa and Mexico City. The first retweet on his profile from Los 12s leader El12 reads “@El12GxNx: Eagle Ranch is indisposed! They are in Cosala 05.07.09 full battery team in the 24/20 12’s greens and Gabachos in 20”. It shows how senior cartel members are using Twitter to transmit information about locations, radio channels and people. The messages can at first be challenging to decipher, which of course is the point. The use of “Gabachos” here is an explicit reference to foreigners and likely U.S. law enforcement given its use alongside “greens”, which is frequently used for military or police.

Figure 5.7 GN Tweet 3

The use of alphanumeric codes is common practice across groups such as Gente Nueva and Los 12s. Examine the tweet from El Gallito Hernandez (Figure 5.6). It reads: “Again on route to the 03 #R now #the12 we’re going to re-establish order again! #R7 #R15 #R18 in 1. Full battery #The12”. The use of multiple “Rs” is common in profile names – they are specific designations of membership.[45] Also common in exchanges on Twitter are status updates as Figure 5.7 amply shows. The initial tweet reads: “@_LaGenteNueva_ @4e0e1217eb374ec You know guys get in it! In 1 and aware! You know our frequency, battery in 1 #EL12 and team GXNX”. The response tweet reads: “@EL12GxNx @_LaGenteNueva_ it’s done, they passed me 38 of my 20 in the sierra, everything 10.4 thank you for the information, the greens aren’t here yet”. Here the “greens” are an explicit reference to either the military or police.

Figure 5.8 GN Tweet 4

It is important to underline that the transmission of messages via Twitter (and Facebook) is often in both textual and image-based code. Figure 5.8, for example, shows how codes are sometimes embedded in images themselves, thus presenting a challenge to simple text-based searches. The image provides superimposed codes to confirm the alphanumeric designations for specific members. El Flako (The Thin Guy) and El Halcon (The Falcon) were not issued designations, though these are obviously pseudonyms, and their profiles were extracted using more basic forensic analysis.

Mexico-based Gangs are Chattier

While adopting different approaches to Twitter, Mexican cartels and gangs have developed large followings, or fan bases, on Twitter. Mexican gang and cartel members regularly interact with supporters through re-tweets, shout-outs/mentions and direct posting of photos and other forms of content. Supporters who retweet messages are often publicly thanked for their endorsement with explicit mention by name. The openness of Mexican groups in cyberspace may be an indicator of their sense of impunity, a deliberate attempt to mislead, naivety or some combination all of the above. It stands in marked contrast to the online behaviors of San Diego-based Latino gang and cartel affiliates who are largely silent.

The extent to which cartel and/or gang members are active on social media and reporting on their activities has a direct bearing on research-related analytics (and policing). Once a specific group or individual profile is identified, the relevance of the content must then be examined. In Mexico, for example, many profiles suggest explicit activities and shibboleths that can open-up new doors of enquiry. In San Diego, however, identified profiles seldom discuss potential criminal activity, instead offering links to celebrity accounts, YouTube videos or other forms of content. Many suspected gang members issue unidirectional tweets, and seldom discuss specific activities or interact with their followers. In this sense, their messages are more “superficial” when compared to their Mexican counterparts.

Figure 5.9 Son of a Badass

An interesting example of how “chatty” gang members shed light on wider networks is the profile of the Leader of Los 12s. El Gallito (The Little Rooster) Hernandez, known as EL12 (@El12GxNx) provides fascinating insight on the nature of the groups online behavior (Figure 5.9). His profile reads “I am what I am from inheritance. Son of a badass. #GxnX #XX #Rs #FDG #12s Los 12 once again!”. A few features stand out. For example, his profile includes references to both Gente Nueva and Los 12s. A review of his network shows that he is El12 (The12) and leads Los 12s, a subgroup of La Gente Nueva.[46] While the specific functions and aspirations of Los 12s is unclear, though on the basis of open source research, this study can lay claim to be the first public revelation of its existence.

Most importantly, El12 has a very active profile. He generates a massive array of content and boasts of illicit activities and cartel connections. His profile emerges repeatedly across the Gente Nueva network, and is routinely affiliated with other members of the latter group. His tweets are often retweeted, and he geo-locates himself in Sinaloa, Sonora and Mexico City. While caution must be exercised when examining profiles such as El12 – any analysis requires extensive triangulation and background research – it does offer a glimpse into the methods, activities and operations of cartels and gangs in social media.

It is important to acknowledge contrasting characteristics across different cartel and gang types. For example, in San Diego, it was possible to detect numerous shibboleths for African American and so-called hybrid gangs, thus generating insight on their networks and activities. It was also possible to identify partial information from affiliates of the Sinaloa Cartel, including Los Antrax and associated sicarios, or hitmen. This was made possible by profile interactions. Put another way, the “behavioral” nature of a given profile is a critical determinant of unlocking networks. As noted above, the distinctions between U.S. and Mexican cartel and gang profiles may be due to stronger and more stable law enforcement and judicial environment in the U.S.[47] Likewise, recent high profile take-downs of gangs through social media may also have generated a chill in the use of online platforms. Gangs are likely adapting their behavior.[48]

Cartels and Gangs are Digitally Transnational

The study found that Latino cartel and gang members are using Twitter to communicate with transnational networks. Mexican-based members used Twitter to communicate with affiliates elsewhere in Mexico, the U.S., Central and South America. Evidence of interaction was also bolstered by photos/descriptions of cross-border travel. There are examples of several cartel and gang members posting messages from both sides of the U.S.-Mexico border.[49] Likewise, there are examples of specific cartel and gang members making references to specific street gangs in the U.S. as well as cartels in Colombia.[50] Moreover, some northern Mexico-based gang members interact directly with fans elsewhere in Mexico as well as in Central and South America.

An examination of cartel and gang connections beyond San Diego and Tijuana generated a veritable explosion of content. The authors were able to identify extensive transnational connections and activities, including interactions across the U.S., Mexico, most Central American countries, Ecuador, and Colombia. For example, connections were detected between Mexico-based cartels and affiliates in Chicago, as well references to branches of the Italian mafia (Cosa Nostra).[51] These associations are based on repeated geo-references and connections between groups and individuals, as well as geo-located tweets. For example, Gente Nueva members often tweeted specific U.S. locations and references to U.S.-based gangs. Affiliates of the Gente Nueva group included tweets or geo-references to, inter alia, San Diego, Los Angeles, Chicago, Miami, New York, Wichita, El Paso, Baltimore, Tijuana, Sinaloa, Culiacán, Mazatlán, Durango, Gomez Palacio, Sonora, Michoacán, Nicaragua, Guatemala, Colombia, Argentina, Ecuador and Uruguay. References were also made to the Black Disciples (Chicago), Cosa Nostra, GS9 (New York gang), Los Negros (BLO enforcer), Medellín Cartel, and many others.

Social Media Analytics is Powerful, But be Careful

Social media analytics methods are capable of effectively detecting, identifying, tracking, and monitoring the ongoing communications, interactions, activities and operations of criminal gangs in the U.S. and Mexico. The approach to research requires a clear recognition of the opportunities and constraints of monitoring social media. It is not merely a matter of hoovering-up masses of social media profiles and generating “hits”, though this is part of the process. What is often required is very detailed assessments of “suspected” profiles, assessing content and associated networks, and then repeating the process with positive returns. The approach is less Big Data crunching, and more mixed method and qualitative.

During the assessment, the authors were able to monitor known profiles and networks, while also identifying new ones. For example, the detection of Los 12s and the wider characteristics of Gente Nueva were revelatory. The profile @Huslinglife2Jm led to the profile of @CanoRachard02, which is an extremely active user appearing as a key member of Los 12s. This profile then led to @JBasilioTorres, and eventually the detection of @El12GxNX, later identified as El12 and the leader of Los 12s.

An obvious limitation of this approach is that it is only possible to build out a valid network after first detecting and analyzing critical tweets, profiles, and associated content. There is, ultimately, a basic element of detective work required which is essential to revealing the full scope and scale of a given suspected cartel/gang members involvement in the wider network. Failure to locate a specific link in the chain – either because of an inability to crack a specific code or the absence of said entity from social media – can be debilitating.

Concluding Reflections

The examination of the digital footprint of gangs involves frontier, or pioneering, research methods. When pursued cautiously and mindful of biases, it can usefully supplement ongoing investigations into the domestic and transnational dynamics of cartel and gang activities. This experimental study was undertaken initially to test whether sex-trafficking activities pursued by gangs in San Diego County and Tijuana were visible online. The assessment was later expanded to account for a wider range of activities and actors straddling U.S., Mexican and Central and South American borders. The goal was to generate a more nuanced profile of the digital ecosystem of Latino gangs.

Taken together, this article shows how cyberspace can be mined for better understandings of gang presence, motivations, relationships and activities. Our research exposes nodes of influence and collaboration across networks. It also highlights the ways in which wider groups can show sympathy and even outright support for gangs. These findings can be potentially used to help disrupt gang networks. The methods, while requiring additional refinement and testing, have potentially dramatic implications for social science research more generally. Meta-analysis alone is insufficient, and any future research must be supplemented with digital forensics and especially content and behavioral analysis of gang member profiles and related networks.

This article was prepared on the basis of generous support from the U.S. National Institute of Justice (NIJ) and the University of San Diego´s Joan B. Kroc Institute for Peace and Justice. The authors would like to credit Ami Carpenter and Micah Clark, in particular, for their substantive inputs into earlier drafts. The article in no way reflects the views or positions of the NIJ or University of San Diego and its personnel.

End Notes

[1] This article is drawn from Muggah, R. and Rohozisnki, R. (2016) Open Empowerment? From Digital Protest to CyberWar. Ottawa: SecDev and IDRC. http://www.amazon.com/Open-Empowerment-Digital-Protest-Cyber-ebook/dp/B01D0LVXCY. Key inputs during the study were also received by Rafal Rohozinski, Micah Clark, Alexander Corbeil, Clyde Seto, Michelle Peres, Kendra Eyben and Jacqui Ruesga. The chapter is reprinted with permission from the University of San Diego and NIJ, institutions that also supported the research process.