On the afternoon of May 27, a convoy transporting a large number of heavily armed gunmen was ambushed on Mexican Highway 15 near Ruiz, Nayarit state, on Mexico’s Pacific coast. When authorities responded they found 28 dead gunmen and another four wounded, one of whom would later die, bringing the death toll to 29. This is a significant number of dead for one incident, even in Mexico.
According to Nayarit state Attorney General Oscar Herrera Lopez, the gunmen
ambushed were members of Los Zetas, a Mexican drug cartel. Herrera noted that
most of the victims were from Mexico’s Gulf coast, but there were also some
Guatemalans mixed into the group, including one of the wounded survivors. While
Los Zetas are predominately based on the Gulf coast, they have been working to
provide armed support to allied groups, such as the Cartel Pacifico Sur (CPS), a
faction of the former Beltran Leyva Organization that is currently battling the
Sinaloa Federation and other cartels for control of the lucrative smuggling
routes along the Pacific coast. In much the same way, Sinaloa is working with
the Gulf cartel to go after Los Zetas in Mexico’s northeast while protecting and
expanding its home turf. If the victims in the Ruiz ambush were Zetas, then the
Sinaloa Federation was likely the organization that planned and executed this
very successful ambush.
Photos from the scene show that the purported Zeta convoy consisted of
several pickup trucks and sport utility vehicles (two of which were armored).
The front right wheel on one of the armored vehicles, a Ford Expedition, had
been completely blown off. With no evidence of a crater in the road indicating
that the damage had been caused by a mine or improvised explosive device (IED),
it would appear that the vehicle was struck and disabled by a well-placed shot
from something like a rocket-propelled grenade (RPG) or M72 LAW rocket, both of
which have been seen in cartel arsenals. Photos also show at least one
heavy-duty cattle-style truck with an open cargo compartment that appears to
have been used as a troop transport. Many of the victims died in the vehicles
they were traveling in, including a large group in the back of the cattle truck,
indicating that they did not have time to react and dismount before being
killed.
Unlike many other incidents we have examined, such as the ambush by CPS and
Los Zetas against a Sinaloa Federation convoy on July 1, 2010, near Tubutama,
Sonora state, the vehicles involved in this incident did not appear to bear any
markings identifying them as belonging to any one cartel. In the Tubutama
incident, the vehicles were all marked with large, highly visible “X”s on the
front, back and side windows to denote that they were Sinaloa vehicles.
Most of the victims were wearing matching uniforms (what appear to be the
current U.S. Marine Corps camouflage pattern) and black boots. Many also wore
matching black ballistic vests and what appear to be U.S.-style Kevlar helmets
painted black. From the photos, it appears that the victims were carrying a
variety of AR-15-variant rifles. Despite the thousands of spent shell casings
recovered from the scene, authorities reportedly found only six rifles and one
pistol. This would seem to indicate that the ambush team swept the site and
grabbed most of the weapons that may have been carried by the victims.
Guns may not have been the only things grabbed. A convoy of this size could
have been dispatched by Los Zetas and CPS on a military raid into hostile
Sinaloa territory, but there is also a possibility that the gunmen were guarding
a significant shipment of CPS narcotics passing through hostile territory. If
that was the case, the reason for the ambush may have been not only to kill the
gunmen but also to steal a large shipment, which would hurt the CPS and could be
resold by Sinaloa at a substantial profit.
Whether the objective of the ambush was simply to trap and kill a Zeta
military team conducting a raid or to steal a high-value load of narcotics, a
look at this incident from a protective intelligence point of view provides many
lessons for security professionals operating in Mexico and elsewhere.
Lesson One: Size Isn’t Everything
Assuming that most of the 29 dead and three wounded gunmen were Zetas, and
that most of the 14 vehicles recovered at the scene also belonged to the convoy
that was attacked, it would appear that the group believed it was big enough to
travel without being attacked, but, as the old saying goes, pride goeth before
destruction.
In an environment where drug cartels can mass dozens of gunmen and arm them
with powerful weapons like machine guns, .50-caliber sniper rifles, grenades and
RPGs, there is no such thing as a force that is too big to be ambushed. And that
is not even accounting for ambushes involving explosives. As evidenced by events
in places like Iraq and Afghanistan, even convoys of heavily armored military
vehicles can be ambushed using large IEDs and smaller, sophisticated explosive devices like
explosively formed projectiles.
There are people in both the private and public sectors who cling to the
erroneous assumption that the mere presence of armed bodyguards provides
absolute security. But this is simply not true, and such a misconception often
proves deadly. Indeed, there are very few protective details in all of Mexico
that employ more than two dozen agents for a motorcade movement — most are
smaller and less well-equipped than the Zeta force that was destroyed May 27.
Most protective details do not wear heavy raid vests and Kevlar helmets. This
means that government and private-sector protective details in Mexico cannot
depend on their size alone to protect them from attack — especially if the
attackers are given free rein to conduct surveillance and plan their ambush.
In an environment where the threat is so acute, security managers must rely
on more than just big men carrying guns. The real counter to such a threat is a protective
detail that practices a heightened state of situational awareness and employs a
robust surveillance-detection/countersurveillance
program coupled with careful route and schedule analysis.
Indeed, many people — including police and executive protection personnel —
either lack or fail to employ good observation skills. These skills are every
bit as important as marksmanship (if not more) but are rarely taught or put into
practice. Additionally, even if a protection agent observes something unusual,
in many cases there is no system in place to record these observations and no
efficient way to communicate them or to compare them to the observations of
others. There is often no process to investigate such observations in attempt to
determine if they are indicators of something sinister.
In order to provide effective security in such a high-threat environment,
routes and traveling times must be varied, surveillance must be looked for and
those conducting surveillance must not be afforded the opportunity to operate at
will. In many cases it is also far more prudent to maintain a low profile and
fade into the background rather than utilize a high-profile protective detail
that screams “I have money.” Suspicious events must be catalogued and
investigated. Emphasis must also be placed on attack recognition and driver
training to provide every possibility of spotting a pending attack and avoiding
it before it can be successfully launched. Proper training also includes immediate
action drills in the event of an attack and practicing what to do in the
event of an ambush.
Action is always faster than reaction. And even a highly skilled protection
team can be defeated if the attacker gains the tactical element of surprise —
especially if coupled with overwhelming firepower. If assailants are able to
freely conduct surveillance and plan an attack, they can look for and exploit
vulnerabilities, and this leads us to lesson two.
Lesson Two: Armored Vehicles Are Vulnerable
Armored vehicles are no guarantee of protection in and
of themselves. In fact, like the presence of armed bodyguards, the use of
armored vehicles can actually lead to a false sense of security if those using
them do not employ the other measures noted above.
If assailants are given the opportunity to thoroughly assess the protective
security program, they will plan ways to defeat the security measures in place,
such as the use of an armored vehicle. If they choose to attack a heavy target
like the Los Zetas convoy, they will do so with adequate resources to overcome
those security measures. If there are protective agents, the attackers will plan
to neutralize them first. If there is an armored vehicle, they will find ways to
defeat the armor — something easily accomplished with the RPGs, LAW rockets and
.50-caliber weapons found in the arsenals of Mexican cartels. The photographs
and video of the armored Ford Excursion that was disabled by having its front
right wheel blown off in the Ruiz ambush remind us of this. Even the run-flat
tires installed on many armored vehicles will not do much good if the entire
wheel has been blown off by an anti-tank weapon.
Armored vehicles are designed to protect occupants from an initial attack and
to give them a chance to escape from the attack zone. It is important to
remember that even the heaviest armored vehicles on the market do not provide a
mobile safe-haven in which one can merely sit at the attack site and wait out an
attack. If assailants know their target is using an armored vehicle, they will
bring sufficient firepower to bear to achieve their goals. This means that if
the driver freezes or allows his vehicle to somehow get trapped and does not “get off the X,” as the attack site is known in the
protection business, the assailants can essentially do whatever they please.
It is also important to recognize that high-profile armored vehicles are
valued by the cartels, and the types of vehicles usually armored generally tend
to be the types of vehicles the cartels target for theft. This means that the
vehicle you are riding in can make you a target for criminals.
While armored vehicles are valuable additions to the security toolbox, their
utility is greatly reduced if they are not being operated by a properly trained
driver. Good tactical driving skills, heightened situational awareness and
attack recognition are the elements that permit a driver to get the vehicle off
the X and to safety.
Lesson Three: Protect Your Schedule
Even for an organization as large and sophisticated as the Sinaloa
Federation, planning and executing an operation like the Ruiz ambush took
considerable time and thought. An ambush site needed to be selected and gunmen
needed to be identified, assembled, armed, briefed and placed into position.
Planning that type of major military operation also requires good, actionable
intelligence. The planner needed to know the size of the Zeta convoy, the types
of vehicles it had and its route and time of travel.
The fact that Los Zetas felt comfortable running that large a convoy in broad
daylight demonstrates that they might have taken some precautionary measures,
such as deploying scouts ahead of the convoy to spot checkpoints being
maintained by Mexican authorities or a competing cartel. It is highly likely
that they consulted with their compromised Mexican government sources in the
area to make sure that they had the latest intelligence about the deployment of
government forces along the route.
But the route of the Zeta convoy must have been betrayed in some way. This
could have been due to a pattern they had established and maintained for such
convoys, or perhaps even a human source inside the CPS, Los Zetas or Mexican
government. There was also an unconfirmed media report that Los Zetas may have
had a base camp near the area where the ambush occurred. If that is true, and if
the Sinaloa Federation learned the location of the camp, they could have planned
the ambush accordingly — just as criminals can use the known location of a target’s home or office to plan an
attack.
If an assailant has a protectee’s schedule, it not only helps in planning an
attack but it also greatly reduces the need of the assailant to conduct
surveillance — and potentially expose himself to detection. For security
managers, this is a reminder not only that routes and times must be varied but
that schedules must be carefully protected from compromise.
While the Ruiz ambush involved cartel-on-cartel violence, security managers
in the private and public sectors would be well-served to heed the lessons
outlined above to help protect their personnel who find themselves in the middle
of Mexico’s cartel war.
Protective Intelligence Lessons from an Ambush in
Mexico is republished with permission of STRATFOR