After Mexico’s most-wanted cartel leader was killed, OSINT helped fuel both clarity and confusion online

When Nemesio “El Mencho” Oseguera Cervantes, the founder of the Jalisco New Generation Cartel and Mexico’s most wanted drug lord, was killed in a military operation in the state of Jalisco the morning of February 22, panic and chaos erupted across the country. Armed groups set fire to cars and stores and blocked roads in 20 out of Mexico’s 32 states.

Just before 1:00 p.m., @sentdefender, an open-source intelligence monitoring account with 1.8 million followers, tweeted a video of “passengers and staff seen fleeing from reported gunfire inside Guadalajara International Airport, as members of the CJNG Cartel attempt to storm the airport and several other nearby locations in the Mexican state of Jalisco.” It’s been viewed more than 915,000 times.

“That’s the moment when I realized this is going to be extremely complicated for us to make sense of,” Jan-Albert Hootsen, the Mexican representative for the Committee to Protect Journalists (CPJ), said. The complication: People were running and seemed panicked in the airport of Mexico’s second-largest city, but there was no gunfire or siege, the airport’s official account tweeted.

According to a preliminary analysis from the Technological Institute of Monterrey, somewhere between 200 and 500 posts containing false or unverified claims circulated on social media in the 48 hours following Oseguera’s death. The engagement on those posts generated “three to five million potential exposures to false or unverified content,” per El País.

Open-source intelligence (OSINT) — the use of publicly available information, from social media to satellite imagery, to verify or document events — can be a powerful tool that helps journalists uncover new information or debunk false claims. But it can also be misused. In 2024, Cardiff University researchers pointed out that disinformation agents create content that looks like OSINT but is meant to confuse or mislead. Oseguera’s death underscored that “OSINT-looking” content can also contribute to misinformation when it lacks context or verification.

Many OSINT analysts are experts in their fields and take care to verify information before publishing, Gisela Pérez de Acha, a Mexican OSINT researcher and investigative journalist, told me. But even well-intentioned OSINT accounts may inject more noise than clarity into an already tense situation.

“The really wide gap we’re seeing right now makes it hard to navigate disinformation during a massive breaking news event,” Pérez said. “There’s a deluge of information. Humans are trying to figure out what to do with it. And then there’s OSINT researchers who don’t have on-the-ground experience, and most of them don’t have any journalism training, either. The journalism training is what will actually tell you: ‘Wait a second. We need to verify this. We need to fact-check this. I need to talk to people. I need to report this out.’”

Just before noon on Tuesday, Mexican professor and columnist Rafael Prieto-Curiel tweeted an image of a map made by “Aleph Risk Intelligence” that claimed to show the locations of the drug cartel roadblocks and other violent outbreaks around the country. As of today, it’s been retweeted more than 4,000 times and has over a million views.

“I saw this unusually large number of accounts dedicated to OSINT starting to post a tsunami of posts with all these geotags and photos and maps,” CPJ’s Hootsen said. “It made the whole situation incredibly complex. We got a huge number of images, but very few interpretations of these images.”

An account that misleadingly uses the name of the anonymous hackers collective Guacamaya — which leaked six terabytes of military and police documents from several Latin American countries in 2022, spurring major news investigations — also tweeted the Aleph map. But the data points hadn’t all been confirmed to be caused by cartel roadblocks. One entry was labeled as “a hazardous situation at the Guadalajara airport,” accompanied by a photo of a plane in flames. But that never actually happened.

“Citizen mapping exercises are very valuable, but they need verification filters,” Quinto Elemento data journalist Efra Tzuc said in a quote tweet of the map. “In this one you can see a debunked claim. The image was created with AI.”

Los ejercicios de mapeo ciudadano son revaliosos, pero se necesitan filtros de verificación.
En este se puede ver un hecho desmentido. La imagen fue creada con IA. https://t.co/0FhvmShYN8 pic.twitter.com/sfECx0ipWU

— efratzuc.bsky.social (@efra_tzuc) February 22, 2026

Some reporters told Hootsen they traveled to points geolocated on some of the unverified maps to see the reported roadblocks, shootings, or fires to report from the scene. The points don’t always indicate whether police have secured the area, which Hootsen urges reporters in Mexico to confirm before going to sites of potential violence.

Mexican journalists have used OSINT for investigative journalism in the past, but it isn’t yet a common tool in Mexican newsrooms, data journalist Hector Piña said.

“This type of work is happening outside of newsrooms, collaboratively between citizens and some journalists acting on their own initiative,” Piña said. “Maps and platforms have been created to understand forced disappearances in Mexico, policies against drug dealing, gentrification in the city, and…femicide and gender-based violence in the city. There are a number of very powerful projects, although they are still few and far between and not happening in [legacy] newsrooms.”

Piña and data analyst Fernanda Verduzco created their own map of road closures and fires in the Guadalajara Metropolitan Area. They only included incidents that had been surfaced by journalists reporting from the scenes, private citizens who’d witnessed an incident and had enough information to support their claims, or communications from police and other local authorities. Each point names the type of incident, where it occurred, and the source of information. They then verified the incidents’ exact locations using Google Maps and its street view function.

Por la cantidad de usuarios que está recibiendo el mapa, habilitamos 3 sitios espejo
Si alguno luce caído , intenten en cualquiera de los otros
1⃣ https://t.co/tNNYbgqaIS
2⃣ https://t.co/MQy8f6Bx3N
3⃣ https://t.co/zN3G8AiHo3

Gracias por la paciencia y por compartir

— Hector Pina (@YaNiPaper) February 22, 2026

In Mexico, OSINT can be a particularly useful tool to report on cartels from a distance when journalists might face security risks from doing so on the ground. When @Halip0n, an anonymous OSINT researcher who posts cartel geolocations on Twitter, saw a viral social media video showing armed forces moving in on a vacation rental in Tapalpa, a town two hours southwest of Guadalajara, they worked to identify the exact coordinates. Their tweet of the coordinates has more than 994,000 views.

“[The video] showed a few structures in passing which I knew would be distinctive enough to show up clearly and, more importantly, provably in satellite imagery,” @Halip0n said in an email. “I verify every geolocation through the same process, which is identifying and marking the features seen in both video and satellite imagery of a place. There’s no hard and fast rule as to what constitutes proof, but a good rule of thumb is that I won’t post if there is any doubt as to whether or not the geolocation is correct.”

Geolocation:

This morning’s military action against Mencho in the country club zone of Tapalpa. The CJNG leader died while in transit to CDMX following his capture in this operation.

Tapalpa Country Club, Tapalpa, Jalisco

19.93028, -103.79936 https://t.co/61HZMx6spI pic.twitter.com/mumh11K5hG

— halipon (@HALIP0N) February 23, 2026

@Halip0n’s tweet caught the attention of CNN open-source researcher Avery Schmitz, who verified @Halip0n’s findings on his own to pinpoint where the Mexican Army found Oseguera. CNN credited @Halip0n in its story about the operation.

“Cartel reporting is notoriously complex, but the researchers behind accounts like Halipon and Pernicious Propaganda — among others — volunteer their time to produce invaluable analysis that improves a hostile information environment,” Schmitz said.

El País reporter Micaela Varela also saw the videos and coordinates on social media. Varela, based in Mexico City, used the coordinates, details from official government statements, and shoe-leather reporting to geolocate the house. She contacted Tapalpa’s mayor and local hotels to confirm her findings, but the mayor didn’t respond and hotel representatives were too afraid to speak to the press. She later found a resident who lives in a nearby housing development who confirmed the location.

“The ideal thing would have been to go to the town to verify the information,” Varela said. But “when covering drug trafficking, you always have be extremely cautious, and in this instance, it wasn’t worth risking our lives to reveal where the operation took place.”