When Cartels Fight Back: El Mencho and the NIAC Question in Mexico
On February 22, 2026, Mexican Army Special Forces launched a pre-dawn raid on a gated residential compound in Tapalpa, a mountainous municipality in the Western state of Jalisco. Their target was Nemesio Oseguera Cervantes, a.k.a. “El Mencho,” the elusive founder and supreme commander of the Jalisco New Generation Cartel (CJNG). At the time, he was Mexico’s most wanted man, with a $15 million U.S. bounty on his head.
Six helicopters provided air cover while ground troops closed a cordon, guided by a multi-year intelligence effort that culminated in the tracking of a trusted associate linked to one of El Mencho’s romantic partners. When his security detail opened fire with high-caliber weapons, two fierce firefights erupted: one at the compound; and a second in the surrounding forest, where El Mencho attempted to flee. A Mexican Army helicopter, providing aerial support, was hit by CJNG gunfire and forced to make an emergency landing, but none of the soldiers on board were killed. Mexican authorities seized armored vehicles, seven long firearms, and two rocket launchers from the scene (see here and here).
Within hours, the consequences of the operation swept across the country with stunning ferocity. Coordinated narcobloqueos—burning barricades assembled with hijacked buses, cargo trucks, and private vehicles—sprang up across nearly 20 of Mexico’s 32 states. In Guadalajara, the nation’s second-largest city, thick smoke rose over major intersections. Public transport—including bus routes, the Mi Macro Periférico bus system, and the electric rail system—was suspended. Schools closed across Jalisco, and banks were shuttered in several cities. Armed groups torched several Banco del Bienestar branches and more Oxxo convenience stores. Amid rumors of an active shooter, Guadalajara International Airport descended into panic as travelers fled terminals and cowered behind counters, although no gunmen breached the facility.
The government deployed the National Guard to secure the airport, while airlines including United, American, Delta, Alaska, and Air Canada canceled flights to both Guadalajara and Puerto Vallarta. The U.S. State Department issued shelter-in-place advisories for multiple states. Twenty-five National Guard members died in separate retaliatory attacks in Jalisco, while dozens of suspected CJNG gunmen died in clashes across Jalisco and neighboring states. The violence only began to ebb after Mexico deployed 2,500 additional troops to reinforce the roughly 7,000 already stationed in the state.
This post is a sequel to an earlier Articles of War piece that examined whether criminal organizations can be parties to a non-international armed conflict (NIAC) and what the legal consequences are for targeting their members. Mexico after El Mencho’s death offers a rare opportunity to test those arguments against a live, contested situation where theory collides with burning highways and a body count that climbs by the hour. Two theses structure the analysis that follows. The first concerns classification; that is, El Mencho’s killing is a stress test for the Mexico–cartel NIAC debate, illustrating why classification cannot turn on labels or a single spectacular raid, but must rest on sustained intensity and organization. The second concerns targeting. Even in a NIAC, “cartel member” is not a targeting status, and both the Tapalpa operation and the retaliatory wave expose the temptation to treat the entire CJNG as a target set rather than applying function-based rules.
What El Mencho’s Killing Shows (and Does Not Show)
Factual Picture Before and After February 22, 2026
The operation that ended El Mencho’s life was the culmination of years of intelligence work. Defense Secretary Ricardo Trevilla Trejo revealed that, on February 20, military intelligence tracked a trusted associate of one of El Mencho’s romantic partners as she traveled to a residence within the Tapalpa Country Club. Security forces confirmed El Mencho’s presence after the partner departed on February 21, and launched the raid early on February 22 with helicopters, Air Force overwatch, and Special Forces on the ground.
The White House confirmed that U.S. intelligence, channeled through the Joint Interagency Task Force-Counter Cartel (JITC-CC), contributed to the planning. When CJNG gunmen opened fire on the advancing troops, two separate firefights ensued. During the second, in the wooded terrain beyond the compound, El Mencho was struck and critically wounded. He died en route to medical evacuation.
Every element of this sequence speaks directly to the NIAC indicators. The government deployed Army Special Forces and the National Guard, supported by Air Force aviation, i.e., military units, not police. The CJNG security detail fought back with weapons capable of striking a military helicopter, forcing an emergency landing. The seizure of armored vehicles and rocket launchers confirms access to heavy, military-grade weaponry. The scale of the operation—a multi-day intelligence effort, helicopter aerial package, ground cordon across multiple municipalities—is not the profile of a law-enforcement arrest, but the profile of a military engagement against an organized armed adversary.
What followed the operation was, in many respects, even more telling than the raid itself. Within hours of El Mencho’s death, a coordinated wave of violence swept across the country. Security Minister Omar García Harfuch reported hundreds of roadblocks across roughly 20 states (out of 31 states plus Mexico City), more than 70 attacks in 23 municipalities in Guanajuato alone, and armed assaults on banks, stores, and government infrastructure. Hugo César Macías Ureña, alias “El Tuli,” El Mencho’s right-hand man in Jalisco, served as the coordinator of the retaliation; he reportedly offered up to MX $20,000 (about U.S. $1,200) for every soldier killed. Security forces tracked him to El Grullo, where he opened fire on an aeromobile unit of the Brigada de Fusileros Paracaidistas before being fatally shot.
The retaliatory violence was not random. It unfolded simultaneously across more than a dozen states, including Jalisco, Colima, Michoacán, Nayarit, Guanajuato, Tamaulipas, Aguascalientes, Zacatecas, and Sinaloa, in the form of hijacked and burned vehicles, roadblocks, and attacks on banks, gas stations, and shops (here and here). The measures adopted by authorities, from suspending public transport and closing schools in Guadalajara to shutting government offices in parts of Jalisco, underline how deeply the violence disrupted ordinary institutional functioning (here). President Claudia Sheinbaum urged calm and praised Mexico’s security forces, while acknowledging that federal and state authorities were operating a national coordination center to manage the response (here and here). The CJNG’s ability to prompt State-wide emergency measures and sustain multi-state disruption for roughly 48 hours, with more than 250 roadblocks across some 20–22 states, demonstrates a level of organizational capacity that few non‑State actors in Latin America can match.
The events of February 2026 were shocking in their scale, but they were not without precedent. In May 2015, the CJNG shot down a Mexican military helicopter with rocket-propelled grenades in Villa Purificación during an earlier attempt to capture El Mencho, killing three soldiers and injuring more than a dozen others. This marked the first time in the Mexican drug war that a criminal organization had downed an aircraft. In that same operation, the cartel hijacked and burned dozens of vehicles and launched coordinated attacks across Jalisco and several neighboring states, setting gas stations and banks ablaze in what the government acknowledged was a display of coordination unmatched by other crime groups at the time (here and here).
In October 2019, the attempted arrest of Ovidio Guzmán in Culiacán likewise triggered a full-scale armed response by the Sinaloa Cartel, which seized strategic points across the city, shut down the airport, and ultimately forced the government to release the detainee. More recently, in the second half of 2024, the capture of Ismael “El Mayo” Zambada, a co-leader of the Sinaloa Cartel, set off armed confrontations between the Chapitos and Mayitos factions that drove violence in Sinaloa to unprecedented levels, as reflected in ACLED data and contemporary reporting.
A NIAC between Mexican Forces and the CJNG?
International humanitarian law (IHL) classifies conflicts based solely on facts, regardless of whether domestic authorities describe them as a “war on drugs,” “internal security operations,” or ordinary law enforcement. As it is well-known, the foundational definition comes from the International Criminal Tribunal for the former Yugoslavia (ICTY) in Prosecutor v. Tadić, which famously defined an armed conflict as either resort to armed force between States or, within a State, sustained armed violence between governmental forces and organized armed groups or between such groups.
Subsequent ICTY decisions refined that definition into two cumulative criteria including: the organization of the parties; and the intensity of violence. Indicative factors for organization include a command structure, the ability to plan and carry out military operations, the capacity to recruit and train, access to weapons, territorial control, and internal discipline (as summarized in Tadić Trial Judgment, para. 562; see also here). For intensity, tribunals look at the number and duration of confrontations, the types of weapons used, casualty figures, material destruction, the displacement of civilians, and, critically, the extent to which government forces have deployed military rather than police forces. In the Limaj decision, the ICTY made clear that the reasons why parties resort to force do not form part of the legal test for NIAC; classification turns on the objective patterns of organization and intensity, not on the actors’ political or economic motives. That principle is decisive in the cartel context, where the economic objectives of drug trafficking organizations have sometimes been invoked to deny them the possibility of becoming parties to a NIAC.
The CJNG is not a loose criminal gang, but a paramilitary enterprise with an estimated 15,000 to 20,000 members, operating in more than 20 Mexican states. The U.S. National Counterterrorism Center describes it as having “a hierarchical command structure in which regional leaders manage day-to-day operations” for El Mencho, who exercised overall leadership, combined with “a franchise model” for expansion outside its strongholds in Jalisco, Nayarit, and Colima. Below El Mencho, specialized armed units carried out distinct military functions: the Grupo Élite, the cartel’s main armed wing used for territorial conquest; Fuerzas Especiales Mencho, a personal protection force; Operadores Droneros, a dedicated drone unit conducting intelligence, surveillance, reconnaissance, and targeted killings since at least 2017 (here and here).
The firepower deployed by these units is not that of a criminal gang operating with pistols or machetes. Open‑source reporting identifies AR‑15 and FN SCAR‑series rifles, and AK‑47/AK‑74 platforms, often with under‑barrel grenade launchers; M60 and M249 machine guns; PKM variants; M2 Browning heavy machine guns; M134 Miniguns mounted on improvised armored vehicles; .50‑caliber anti‑materiel rifles; RPG‑7, RPG‑22, and RPG‑27 launchers; and pickup trucks and dump trucks armored with thick steel plating (see here, here and here). The 2015 helicopter shoot‑down near Villa Purificación confirmed the cartel’s capacity to engage military aviation with rocket-propelled grenades (here and here).
In February 2025, the U.S. Secretary of State, acting under President Trump’s Executive Order 14157 (“Designating Cartels and Other Organizations as Foreign Terrorist Organizations and Specially Designated Global Terrorists”), designated CJNG as both a Foreign Terrorist Organization and a Specially Designated Global Terrorist entity, with the designation taking effect on February 20, 2025. The U.S. Treasury’s June 2025 sanctions action further detailed CJNG’s internal leadership and highlighted its recruitment camps, including the Izaguirre Ranch in Teuchitlán, Jalisco, where, in March 2025, authorities and search collectives discovered hundreds of items of clothing, shoes and bags, alongside skeletal remains. According to investigators, these items amounted to evidence that the site had been used to train recruits and execute those who defied instructions.
With regard to the intensity of violence threshold, it is worth recalling that the Tapalpa operation and its aftermath did not occur in a vacuum. They are part of a longer sequence of lethal confrontations involving heavy weaponry and significant territorial impact. The CJNG has waged sustained armed confrontations with Mexican security forces for over a decade. The 2015 Villa Purificación attack, the recurrent narcobloqueos following high-profile arrests, and the consistent use of military-grade weaponry in clashes across Jalisco, Michoacán, Guanajuato, and Colima all point toward a threshold that exceeds internal disturbances and tensions.
Critically, the Mexican government has responded not with ordinary police operations but with military deployments, spanning from President Calderón’s 2006 launch of the “war on drugs” and the creation of hybrid forces, through the 2019 establishment of the National Guard (staffed substantially by former military personnel), to the massive troop surges of February 2026. The Inter-American Court of Human Rights, in Alvarado Espinoza v. Mexico (2018), examined enforced disappearances in a context of increasing reliance on the armed forces for public‑security tasks and warned of the human‑rights risks associated with that militarized approach. Viewed cumulatively, the confrontations between CJNG and State forces are marked by heavy weapons, military aviation, high casualty counts, and displacement of civilian populations, hence supporting the view that, at least in specific regions and during specific periods, hostilities reach the NIAC threshold.
Challenges to Classification: Fragmentation and the Question of Attribution
Against this conclusion, a serious counter-argument emerges. The kingpin strategy—namely the systematic targeting of cartel leadership—has been a central feature of Mexican security policy since 2006, and its primary documented effect is fragmentation. The Mexico Peace Index 2024 notes that, after the launch of the “war on drugs” and the adoption of the kingpin strategy, the number of criminal organizations involved in lethal violence rose sharply, and that fragmentation “contributed to such organizations breaking up into smaller but more violent groups.”
Research shows that, on average, one additional criminal group begins operating in a territory following the killing or capture of a kingpin. The number of armed criminal outfits in Mexico more than doubled during the so-called “war on drugs,” from around 75 in 2009 to over 200 by 2020 (here and here). The 2024 capture of “El Mayo” Zambada fractured the Sinaloa Cartel into warring factions, elevating violence in Sinaloa to unprecedented levels without reducing drug trafficking to the United States. The “hydra effect” is a common consequence of kingpin targeting: “Chopping off one head often results in the emergence of several more that are harder to control and compete both with the state and with each other.”
For the CJNG, the risk is real. El Mencho did not have a direct successor in place; his son, Rubén Oseguera González (“El Menchito”), is imprisoned in the United States. Key lieutenants commanding fighting units could reject any appointed successor, break off, and battle for territory and control over trafficking routes, a scenario analysts have already raised in the wake of his death (here and here). If the CJNG splinters into competing factions, the organizational criterion that underpins NIAC classification—namely, the existence of a single entity with a responsible command structure capable of waging sustained hostilities—could dissipate, even as violence itself intensifies. This is precisely the danger recent policy papers and conflict‑data analyses of post‑El Mencho scenarios highlight (here and here).
In response to the kingpin strategy, many Mexican cartels adopted more horizontal and decentralized structures. The Sinaloa Cartel, for example, now relies on a loose federation of semi‑autonomous factions rather than a single tightly centralized hierarchy. The CJNG itself, while retaining hierarchical leadership at the top, operates through a franchise model in which regional operators enjoy substantial autonomy over day‑to‑day tactical decisions. This combination of federated and franchise arrangements, similar to structures seen in Brazil’s Primeiro Comando da Capital (PCC) and, to varying degrees, Colombia’s Autodefensas Gaitanistas de Colombia (also known as Urabeños or Gulf Clan) and Venezuela’s Tren de Aragua (here, here, and here), poses a challenge for classification. Horizontally organized groups may satisfy the functional requirements of a responsible command capable of sustaining hostilities, yet the absence of a clear pyramidal chain of command makes the organization criterion harder to establish using conventional indicators.
An International Committee of the Red Cross (ICRC) interpretation of Article 1 of Additional Protocol II underlines that what matters for the organization requirement is the existence of a responsible command capable of planning and sustaining coordinated military operations and enforcing discipline, not the presence of a classic, State‑style hierarchy (ICRC, Commentary to AP II, para. 4463). A 2016 ICRC commentary explains that, for Common Article 3 and NIAC classification, “organization” is understood functionally by reference to the ability to conduct coordinated operations and to implement IHL rules rather than by comparison to State armed forces (here and here).
In other words, a group does not need a centralized, pyramidal chain of command to count as organized; it must be able to direct operations over time and to implement basic IHL obligations. The ICRC stresses that the notion of “responsible command … implies some degree of organization of the insurgent armed group … but this does not necessarily mean a classic military hierarchy” (here and here). Decentralization, therefore, does not automatically imply disorganization. On the contrary, non‑State armed groups “are very diverse” in their degree of centralization and internal structure, and horizontally structured alliances can be highly resilient, because no single cell is indispensable for the survival of the broader network.
There is a related but distinct challenge. If cartels splinter and engage in internal fighting precisely because the government has eliminated their leaders, or if they adopt franchise models where local cells operate semi-independently, the result may be a landscape in which the intensity of violence is extremely high, but it becomes nearly impossible to attribute specific episodes to a particular armed group.
In practice, this attribution problem undercuts the usual practice of assessing intensity bilaterally for each relationship between a given non‑State group and the State. In settings where multiple splinters, franchises, and semi-autonomous cells are simultaneously fighting government forces and one another in overlapping areas, applying that pair-by-pair test across the board is neither realistic nor conceptually satisfying. In fact, it can yield a legal picture in which no single dyad crosses the NIAC threshold, even though the cumulative level of organized armed violence in the country plainly does.
One proposed response is to aggregate the intensity of violence for classification purposes. In a 2021 Humanitarian Law & Policy blog post, one of the present authors suggested that intensity should be considered cumulatively when several organized non-State armed groups are fighting (1) in the same geographical region, (2) during the same period of time, and (3) against a common enemy. This approach has the virtue of reflecting the reality on the ground in places like Mexico, where the government cannot practically distinguish between CJNG cells, CJNG franchise affiliates, CJNG splinters, and independent groups when facing down a burning barricade.
However, the aggregating approach is not without its difficulties. It risks over-classification, bringing situations under IHL that ought to remain governed by human rights law and law-enforcement standards. It also raises questions about when conflicts end. If a NIAC is classified based on aggregated violence, does it end only when the cumulative violence drops below the threshold, or when any single group ceases to meet the criteria? These questions remain unsettled and deserve careful doctrinal development, particularly as the post-Mencho landscape unfolds (see here). However, as we draw the outer lines of NIAC classification, crossing that threshold does not itself answer who may lawfully be targeted, particularly in cartel-driven conflicts.
Targeting: Why “Cartel Member” Is Not a Status
From Criminal Organization to NIAC Party: What Changes (and What Does Not)
Upon crossing the NIAC threshold, large criminal organizations such as CJNG can, in principle, be treated as parties to the conflict on a par with political insurgent groups where they meet the organization and intensity criteria. In such cases, IHL governs their use of force rather than domestic criminal law (here and here). That moves their members into the IHL framework, but it does not convert “cartel membership” into a targeting status. There remains a central distinction between the organization as a whole and the subset of individuals who perform a continuous combat function (CCF) within it. The ICRC’s Interpretive Guidance on the Notion of Direct Participation in Hostilities, argues that State armed forces are continuously targetable, and “members of organized armed groups belonging to a non‑State party to an armed conflict lose protection against direct attack for the duration of their membership, i.e. for as long as they assume a continuous combat function” (ICRC, Interpretive Guidance, p. 33–36). By this approach, everyone else is a civilian, who “shall enjoy protection against direct attack unless and for such time as they take a direct part in hostilities” (Additional Protocol II, Article 13(3)).
In earlier works (including on this site, see here and in the International Review of the Red Cross here), we suggested a teleological approach to make this CCF concept workable in cartel settings where there is no neat “armed wing.” The starting point is the purpose of the principle of distinction. Fighters are lawful targets at any time because they themselves can threaten the enemy, whereas civilians may not. Applied to cartels, this suggests that a member should be treated as having a CCF when their role within the group includes, by design, the use of force against enemy forces or rival armed actors, not merely the commission of profit-driven crimes. Indicators include whether a cartel selects and prepares a person to fight through weapons training and arming, assigns him or her to units whose very purpose is to use force beyond self‑defence, and gives him or her an ongoing authorization to participate in attacks.
Seen through that lens, El Mencho himself is a relatively “easy” case. As CJNG’s founder and overall commander, he set the group’s strategy, approved and directed armed campaigns against State forces and rivals, and remained in that leadership role for years. In teleological terms, the use of organized force on behalf of CJNG defines his function; he was not simply a wealthy drug producer who occasionally hired protection. Likewise, the armed escort that died with him— operating armored vehicles, equipped with long guns and rocket launchers, and tasked with shielding the leader from military raids—fits squarely within the category of members whose assigned role is to employ force against enemy forces (here and here). On this reading, both El Mencho and his close protection unit qualify as CCF members and are continuously targetable in a CJNG-Mexico NIAC.
By contrast, the broader CJNG universe includes many roles that remain outside this CCF core, including, for example, call‑center staff running timeshare scams in Puerto Vallarta, professionals fronting real‑estate and tourism companies used for fraud, chemists in fentanyl labs, accountants managing money‑laundering structures, and local enforcers focused on extortion or fuel theft in areas far from active hostilities (here, here, and here). Even if those individuals are criminally liable and even if their work sustains CJNG’s war-fighting capacity, their functions do not, without more, entail using force against enemy fighters. Under a teleological reading, they remain civilians for targeting purposes and are not subject to lawful attack unless and for such time as they directly take part in hostilities.
Guardrails for Targeting in Cartel NIACs
A teleological approach helps to identify who falls on the “fighter” side of the line, but it does not eliminate hard cases from an evidence standpoint. In cartel NIACs, the risk of status‑by‑association is acute. Labels such as “CJNG collaborator” or “financial operator” can too easily become proxies for CCF. To avoid that slide, targeting practice should demand concrete indicators before treating a cartel actor as a member of the armed wing. Relevant indicators include sustained involvement in planning or executing armed attacks, command responsibility over armed cells such as Grupo Élite units, specialized training and regular deployment with weapons, and integration into units whose primary role is to confront State forces or rival groups, rather than to move product or launder proceeds (here and here).
Roles centered on logistics, finance, social control, or non-violent fraud typically do not meet this threshold. A halcón who reports army movements may be directly participating in hostilities while performing that task, but unless they are durably integrated into a combat unit, their participation is episodic rather than continuous. A chemist who never leaves the lab, a lawyer who only sets up shell companies, or a truck driver moving precursor chemicals remains a civilian in IHL terms, however central they are to the cartel’s business model. The Mexican context, with CJNG’s diversified portfolio of timeshare fraud, fuel theft, extortion, and agricultural racketeering, makes that distinction more, not less, important.
Recognition of a NIAC does not displace human rights law or domestic criminal law. Away from active hostilities and where individuals are subject to arrest, authorities remain bound by the law‑enforcement paradigm. In such situations, the use of force must be necessary and proportionate, lethal force is a last resort against an imminent threat, and due‑process guarantees apply. The Inter‑American Court of Human Rights has repeatedly insisted that public security is primarily a task for civilian police, not the armed forces, and has criticized Mexico’s over-reliance on military deployments in internal security operations. In that light, NIAC classification with CJNG should lead not to a generalized “license to kill cartel members,” but to more carefully calibrated rules of engagement, intelligence procedures, and accountability mechanisms that operationalize the distinction between CCF members, directly participating civilians, and all other civilians.
Practically, that means embedding function-based criteria into targeting guidance, building investigative capacity to document individuals’ roles before and after strikes, and drawing on comparative NIAC practice with insurgent groups in Colombia or the Sahel without assuming that cartel structures map neatly onto rebel “armed wings.” The combination of CJNG’s franchise model, its economic diversification, and its deep social penetration makes misidentification a structural risk. A teleological approach, applied rigorously, is one way to keep the focus on those whose function is to fight, rather than on everyone whose life, willingly or not, touches the cartel.
Conclusions: Stress Testing Doctrine Without Lowering Standards
El Mencho’s killing and its aftermath confirm that NIAC classification in Mexico does not turn on rhetoric or any one spectacular raid. It requires a sober assessment of whether hostilities between the CJNG and Mexican armed forces show sustained intensity and whether the CJNG retains the organization to wage them. Recent events suggest that, at least in parts of Mexico, they do. At the same time, even in such a NIAC, “cartel member” is not a lawful targeting status. El Mencho and his armed escort illustrate the core of continuous combat function. But the retaliatory violence and the political pressure may tempt States to treat the CJNG as a target set, in defiance of IHL’s function-based logic.
The Mexican case should not prompt States to abandon classic NIAC and targeting doctrine. It should demand greater discipline from States in applying it to criminal organizations, where States both resist denying a NIAC’s existence where facts support it, but also the slide toward group-based targeting. The true measure of IHL’s adaptability lies not in how quickly States can stretch it to accommodate new forms of violence, but in whether it can impose meaningful constraints on the most politically fraught and operationally tempting uses of force. The burning highways of Jalisco are a test of that proposition. Whether Mexico’s security forces, and those of its international partners, can meet that test with precision rather than with firepower will determine not just the outcome of the post-Mencho power struggle, but the credibility of the legal framework that is supposed to govern it.
***
Chiara Redaelli is a Research Fellow at the University of Geneva and Legal Expert for IDLO, Ukraine Office.
Carlos Arévalo is a Professor of International Law and International Humanitarian Law at Universidad de La Sabana in Colombia.
The views expressed are those of the authors, and do not necessarily reflect the official position of the United States Military Academy, Department of the Army, or Department of Defense.
Articles of War is a forum for professionals to share opinions and cultivate ideas. Articles of War does not screen articles to fit a particular editorial agenda, nor endorse or advocate material that is published. Authorship does not indicate affiliation with Articles of War, the Lieber Institute, or the United States Military Academy West Point.
Photo credit: La Prensa Gráfica Noticias de El Salvador
