El Mencho is Dead but the Network He Built is Not

On February 22, Mexican military forces killed Nemesio Rubén Oseguera Cervantes, known as “El Mencho,” the kingpin of the Jalisco New Generation Cartel (CJNG).  Within hours it responded with coordinated attacks across multiple states, killing 25 National Guard troops and at least 75 others. The scene was replete with gunmen in balaclavas, roadblocks and vehicles set ablaze. A wave of cartel-amplified misinformation spread across social media, exaggerating the chaos and projecting an image that the government had lost control.

This was not the death knell of a defeated organization. It was a demonstration of force by a network that remains highly capable and deeply embedded across Mexico and the United States. El Mencho’s killing represents a significant tactical success for Mexican security forces and U.S. intelligence. But tactical wins are not strategic victories. If we learned anything from the War on Terror, it’s this: A counter-network strategy not a kingpin strategy is the only one capable of defeating a global transnational criminal empire like CJNG.

Think al-Qaeda, not Al Capone.

El Mencho led one of the largest and most powerful transnational criminal empires on the planet. It expanded rapidly from western Mexico, competing with the Sinaloa Cartel and diversifying into dozens of illicit business verticles, from fentanyl to migration to illegal fishing and even bootlegged avocados during the Super Bowl.   

The retaliation following El Mencho’s death reveals organizational depth that should concern anyone serious about disrupting these networks. Within hours, CJNG demonstrated it could coordinate multi-pronged attacks across the country even without its founder at the helm. That command capacity, local reach, and coercive ability doesn’t disappear because the kingpin is gone. Massive cartels like CJNG are criminal networks built on global supply chains, financial systems and armies of accountants, lawyers, logisticians, corrupted government officials and assassins.

This is why the kingpin strategy has repeatedly failed us.

For decades, the United States and Mexico relied on a simple playbook: Arrest the kingpin. Declare victory.  Move on. That approach does not work against a modern global criminal enterprise that functions like a Fortune 50 company sporting its own heavily armed militia.

The most immediate question is whether El Mencho’s killing triggers consolidation under new leadership or fragmentation into warring factions. Reports suggest a California-born relative, Juan Carlos Valencia Gonzales, may take over, which could limit violence.  Similarly, el Chapo’s sons, the “Chapitos,” maintained order after assuming control.  Unfortunately, though, Gonzales and the Chapitos just replace the last kingpin with another.  

On the other hand, if succession proves contested, the result could mirror the cartel wars of the 2000s and 2010s.  Those conflicts claimed over 100,000 lives in Mexico.  Descending into the carnage we witnessed at the turn of the century is in no one’s interest.  That violence brought us the “hugs not guns” policy in Mexico, which allowed narco tycoons to conduct business unabated after Mexican voters elected leaders who brokered peace between warring factions at all costs.    

Either outcome demands a response that goes far beyond celebrating one operation.  The good news is we know what actually works because we’ve done it before.  From 2023 through 2024, U.S. and Mexican authorities stopped chasing kingpins and started targeting cartels as networks. That meant sanctions from Treasury against Chinese chemical providers. DEA operations taking out mid-level brokers and managers. Border operations like Blue Lotus seizing tons of drugs and arresting thousands of henchmen. Intelligence community involvement from CIA, NSA, and military assets enabled us to watch how the cartels responded to our attacks.  We adapted and hit again in wave after wave of assault on every line of business in their criminal corporate enterprise.     

The result was a 37% reduction in fentanyl deaths in just over a year.    

A drop that steep is unprecedented.  In fact, the journal Science cited this shock to the supply chain for the drop.  The counter-network approach succeeded because it attacked thousands of nodes simultaneously. It crippled multiple lines of business at once. El Mencho’s death can be part of that strategy, but only if we layer in strategic attacks on other nodes in the network.   

Trump’s designation of CJNG as a Foreign Terrorist Organization (FTO) and fentanyl as a Weapon of Mass Destruction (WMD) are particularly relevant here as it gives the interagency the tools it needs to execute this layered approach.  Decapitation is fine as one element of a broader campaign.  However, to shutter the cartel’s fentanyl business verticle, all the levers those designations make available need to be pulled quickly.  Three key actions seem ripe to attack particularly vulnerable, high-value nodes in the CJNG network.  

First, Mexican leaders have been blunt: CJNG would be far less formidable if it wasn’t armed to the teeth with a military-grade arsenal Made In America. This is not a Second Amendment issue. American citizens have a right to bear arms. Mexican citizens, living in Mexico, working for a narco-cartel, do not have a right to bear military-grade firepower manufactured in the United States.  

America must defang the beast if the Mexican government is to have a fighting chance against it.     

Second, we must put our elite cyber warriors in the game and let them hack these goons back to the Stone Age.  Modern cartels cannot function without access to the Internet, digital communication and financial systems.  When approached about hacking the cartels, NSA and CyberCom often demur.  They cite Great Power adversaries far more strategically important in the long term, like China, Iran, North Korea and Russia.  In NSA and CyberCom’s defense, they have limited budgets and workforce and there is plenty to hack in those four nation-states.  

However, this is a false choice.  The U.S. Coast Guard, operating on military cyber platforms, and HSI via its Cyber Crime Center, have all the authority and know-how they need to burrow so deep into CJNG’s network they can turn the mafiosi’s refrigerators on and off at will.      

Third, home appliances notwithstanding, we should start by hacking their finances.  The narco-tycoons are motivated by money alone.  Further, among the hundreds of thousands of rank-and-file and corrupted government officials, CJNG has a lot of mouths to feed to stay in business.  Liquidating their profits would hobble the organization.   

We know how to do this. For example, the FBI digitally clawed back payments after the Colonial Pipeline ransomware attack.  We should immediately seize as much of CJNG’s ill-gotten gains as possible and use that money to finance Mexican military operations against the cartel.   

Poetic justice aside, the real benefit of this financial scheme is political.  Using repatriated cartel plunder to pay for counter-cartel operations is far more politically palatable to Mexico’s elected leaders. They resist options that smack of kowtowing to do Uncle Sam’s bidding for a handout.  Fortunately, the Mexican government still seems somewhat cowed into compliance by Trump’s with-us-or-against-us bravado.  However, eventually Mexican leaders will have to answer to Mexican voters in Mexican elections.  The more we can align good policy with good politics in Mexico, the more durable the Administration’s campaign against the cartels will be.         

El Mencho is dead. But the network he built is alive and kicking.  It still trafficks fentanyl into American communities, and can still often outfight the government in its strongholds. The final victory won’t come from assassinating the next kingpin or the one after that. It will come from the systematic, sustained dismantling of the criminal network that enables the mass poisoning of America.

50

Jake Braun most recently served in the White House as acting Principal Deputy National Cyber Director. Prior to that role, Mr. Braun was appointed by the President as Senior Counselor to the Secretary of the Department of Homeland Security. Mr. Braun is the author of Fentanyl: Fighting the Mass Poisoning of America and the Cartel Behind It (Bloomsbury, 2025), and Democracy in Danger: How Hackers and Activists Exposed Fatal Flaws in the Election System (Rowman & Littlefield, 2019).

Mr. Braun is Executive Director of the Cyber Policy Initiative at the University of Chicago Harris School of Public Policy and CEO and Co-Founder of Cambridge Global Advisors, a national security consulting firm.

Mr. Braun’s career has spanned a litany of modern hybrid threats facing America, from counter terrorism to cybersecurity to election interference, fentanyl, cartels and AI security. While at the White House, he oversaw implementation of the National Cybersecurity Strategy, including efforts to secure our water systems, modernize the federal cyber workforce, enhance cyber cooperation with allied nations, and develop AI security policy. During his most recent tour at DHS, he advised on multiple cross-cutting initiatives to mitigate hybrid threats. He helped spearhead the first DHS-wide counter-fentanyl strategy and worked on the National Security Council team that developed the first U.S. government-wide counter-fentanyl strategy. He also helped lead the effort to resettle nearly 150,000 Afghan allies during the withdrawal from Afghanistan.

In 2009, Mr. Braun was appointed by President Obama as White House Liaison to the Department of Homeland Security. He was instrumental in the effort to gain passage in the European Parliament of the largest data-sharing agreement in history between the United States and the European Union to combat terrorism. In addition, before his tenure as White House Liaison, Mr. Braun served on the Presidential Transition Team for the Obama Administration as Deputy Director for the National Security Agencies Review.

In addition to his role at the University of Chicago, Mr. Braun co-founded the DEF CON Voting Machine Hacking Village. In that capacity, he co-authored two award-winning reports on election interference: the DEF CON 25 and 26 Voting Village Reports. Most recently, he partnered with DEF CON, the world's largest and longest-running hacker conference, to launch “Franklin,” a program to memorialize the most innovative and impactful findings from DEF CON in the annual “Hackers’ Almanack.” “Franklin” also recruits cyber volunteers to support underresourced water utilities.

Mr. Braun began his career in politics and journalism. He has worked on five presidential campaigns and, separately, as a journalist for newspapers in Illinois and Taiwan. He holds an MA in International Relations from Troy St. University, an MA in Secondary Education from National-Louis University, Chicago, and a BA in Philosophy from Loyola University of Chicago.

Related Articles

Latest Articles