Protective Intelligence Lessons from an Ambush in Mexico

By Scott Stewart

On the afternoon of May 27, a convoy transporting a large number of heavily armed gunmen was ambushed on Mexican Highway 15 near Ruiz, Nayarit state, on Mexico’s Pacific coast. When authorities responded they found 28 dead gunmen and another four wounded, one of whom would later die, bringing the death toll to 29. This is a significant number of dead for one incident, even in Mexico.

According to Nayarit state Attorney General Oscar Herrera Lopez, the gunmen ambushed were members of Los Zetas, a Mexican drug cartel. Herrera noted that most of the victims were from Mexico’s Gulf coast, but there were also some Guatemalans mixed into the group, including one of the wounded survivors. While Los Zetas are predominately based on the Gulf coast, they have been working to provide armed support to allied groups, such as the Cartel Pacifico Sur (CPS), a faction of the former Beltran Leyva Organization that is currently battling the Sinaloa Federation and other cartels for control of the lucrative smuggling routes along the Pacific coast. In much the same way, Sinaloa is working with the Gulf cartel to go after Los Zetas in Mexico’s northeast while protecting and expanding its home turf. If the victims in the Ruiz ambush were Zetas, then the Sinaloa Federation was likely the organization that planned and executed this very successful ambush.

Photos from the scene show that the purported Zetas convoy consisted of several pickup trucks and sport utility vehicles (two of which were armored). The front right wheel on one of the armored vehicles, a Ford Expedition, had been completely blown off. With no evidence of a crater in the road indicating that the damage had been caused by a mine or improvised explosive device (IED), it would appear that the vehicle was struck and disabled by a well-placed shot from something like a rocket-propelled grenade (RPG) or M72 LAW rocket, both of which have been seen in cartel arsenals. Photos also show at least one heavy-duty cattle-style truck with an open cargo compartment that appears to have been used as a troop transport. Many of the victims died in the vehicles they were traveling in, including a large group in the back of the cattle truck, indicating that they did not have time to react and dismount before being killed.

Unlike many other incidents we have examined, such as the ambush by CPS and Los Zetas against a Sinaloa Federation convoy on July 1, 2010, near Tubutama, Sonora state, the vehicles involved in this incident did not appear to bear any markings identifying them as belonging to any one cartel. In the Tubutama incident, the vehicles were all marked with large, highly visible “X”s on the front, back and side windows to denote that they were Sinaloa vehicles.

Most of the victims were wearing matching uniforms (what appear to be the current U.S. Marine Corps camouflage pattern) and black boots. Many also wore matching black ballistic vests and what appear to be U.S.-style Kevlar helmets painted black. From the photos, it appears that the victims were carrying a variety of AR-15-variant rifles. Despite the thousands of spent shell casings recovered from the scene, authorities reportedly found only six rifles and one pistol. This would seem to indicate that the ambush team swept the site and grabbed most of the weapons that may have been carried by the victims.

Guns may not have been the only things grabbed. A convoy of this size could have been dispatched by Los Zetas and CPS on a military raid into hostile Sinaloa territory, but there is also a possibility that the gunmen were guarding a significant shipment of CPS narcotics passing through hostile territory. If that was the case, the reason for the ambush may have been not only to kill the gunmen but also to steal a large shipment, which would hurt the CPS and could be resold by Sinaloa at a substantial profit.

Whether the objective of the ambush was simply to trap and kill a Zetas military team conducting a raid or to steal a high-value load of narcotics, a look at this incident from a protective intelligence point of view provides many lessons for security professionals operating in Mexico and elsewhere.

Lesson One: Size Isn’t Everything


Assuming that most of the 29 dead and three wounded gunmen were Zetas, and that most of the 14 vehicles recovered at the scene also belonged to the convoy that was attacked, it would appear that the group believed it was big enough to travel without being attacked. But, as the old saying goes, pride goeth before destruction.

In an environment where drug cartels can mass dozens of gunmen and arm them with powerful weapons like machine guns, .50-caliber sniper rifles, grenades and RPGs, there is no such thing as a force that is too big to be ambushed. And that is not even accounting for ambushes involving explosives. As evidenced by events in places like Iraq and Afghanistan, even convoys of heavily armored military vehicles can be ambushed using large IEDs and smaller, sophisticated explosive devices like explosively formed projectiles.

There are people in both the private and public sectors who cling to the erroneous assumption that the mere presence of armed bodyguards provides absolute security. But this is simply not true, and such a misconception often proves deadly. Indeed, there are very few protective details in all of Mexico that employ more than two dozen agents for a motorcade movement — most are smaller and less well-equipped than the Zetas force that was destroyed May 27. Most protective details do not wear heavy raid vests and Kevlar helmets. This means that government and private-sector protective details in Mexico cannot depend on their size alone to protect them from attack — especially if the attackers are given free rein to conduct surveillance and plan their ambush.

In an environment where the threat is so acute, security managers must rely on more than just big men carrying guns. The real counter to such a threat is a protective detail that practices a heightened state of situational awareness and employs a robust surveillance-detection/countersurveillance program coupled with careful route and schedule analysis.

Indeed, many people, including police and executive protection personnel, either lack or fail to employ good observation skills. These skills are every bit as important as marksmanship (if not more) but are rarely taught or put into practice. Additionally, even if a protection agent observes something unusual, in many cases there is no system in place to record these observations and no efficient way to communicate them or to compare them to the observations of others. There is often no process to investigate such observations in an attempt to determine if they are indicators of something sinister.

In order to provide effective security in such a high-threat environment, routes and traveling times must be varied, surveillance must be looked for and those conducting surveillance must not be afforded the opportunity to operate at will. In many cases it is also far more prudent to maintain a low profile and fade into the background rather than utilize a high-profile protective detail that screams “I have money.” Suspicious events must be catalogued and investigated. Emphasis must also be placed on attack recognition and driver training to provide every possibility of spotting a pending attack and avoiding it before it can be successfully launched. Proper training also includes immediate action drills in the event of an attack and practicing what to do in the event of an ambush.

Action is always faster than reaction. And even a highly skilled protection team can be defeated if the attacker gains the tactical element of surprise — especially if coupled with overwhelming firepower. If assailants are able to freely conduct surveillance and plan an attack, they can look for and exploit vulnerabilities, and this leads us to lesson two.

Lesson Two: Armored Vehicles Are Vulnerable

Armored vehicles are no guarantee of protection in and of themselves. In fact, like the presence of armed bodyguards, the use of armored vehicles can actually lead to a false sense of security if those using them do not employ the other measures noted above.

If assailants are given the opportunity to thoroughly assess the protective security program, they will plan ways to defeat the security measures in place, such as the use of an armored vehicle. If they choose to attack a heavy target like the Los Zetas convoy, they will do so with adequate resources to overcome those security measures. If there are protective agents, the attackers will plan to neutralize them first. If there is an armored vehicle, they will find ways to defeat the armor — something easily accomplished with the RPGs, LAW rockets and .50-caliber weapons found in the arsenals of Mexican cartels. The photographs and video of the armored Ford Excursion that was disabled by having its front right wheel blown off in the Ruiz ambush remind us of this. Even the run-flat tires installed on many armored vehicles will not do much good if the entire wheel has been blown off by an anti-tank weapon.

Armored vehicles are designed to protect occupants from an initial attack and to give them a chance to escape from the attack zone. It is important to remember that even the heaviest armored vehicles on the market do not provide a mobile safe-haven in which one can merely sit at the attack site and wait out an attack. If assailants know their target is using an armored vehicle, they will bring sufficient firepower to bear to achieve their goals. This means that if the driver freezes or allows his vehicle to somehow get trapped and does not “get off the X,” as the attack site is known in the protection business, the assailants can essentially do whatever they please.

It is also important to recognize that high-profile armored vehicles are valued by the cartels, and the types of vehicles usually armored generally tend to be the types of vehicles the cartels target for theft. This means that the vehicle you are riding in can make you a target for criminals.

While armored vehicles are valuable additions to the security toolbox, their utility is greatly reduced if they are not being operated by a properly trained driver. Good tactical driving skills, heightened situational awareness and attack recognition are the elements that permit a driver to get the vehicle off the X and to safety.

Lesson Three: Protect Your Schedule


Even for an organization as large and sophisticated as the Sinaloa Federation, planning and executing an operation like the Ruiz ambush took considerable time and thought. An ambush site needed to be selected and gunmen needed to be identified, assembled, armed, briefed and placed into position. Planning that type of major military operation also requires good, actionable intelligence. The planner needed to know the size of the Zetas convoy, the types of vehicles it had and its route and time of travel.

The fact that Los Zetas felt comfortable running that large a convoy in broad daylight demonstrates that they might have taken some precautionary measures, such as deploying scouts ahead of the convoy to spot checkpoints being maintained by Mexican authorities or a competing cartel. It is highly likely that they consulted with their compromised Mexican government sources in the area to make sure that they had the latest intelligence about the deployment of government forces along the route.

But the route of the Zetas convoy must have been betrayed in some way. This could have been due to a pattern they had established and maintained for such convoys, or perhaps even a human source inside the CPS, Los Zetas or the Mexican government. There was also an unconfirmed media report that Los Zetas may have had a base camp near the area where the ambush occurred. If that is true, and if the Sinaloa Federation learned the location of the camp, they could have planned the ambush accordingly — just as criminals can use the known location of a target’s home or office to plan an attack.

If an assailant has a protectee’s schedule, it not only helps in planning an attack but it also greatly reduces the need of the assailant to conduct surveillance — and potentially expose himself to detection. For security managers, this is a reminder not only that routes and times must be varied but that schedules must be carefully protected from compromise.

While the Ruiz ambush involved cartel-on-cartel violence, security managers in the private and public sectors would be well-served to heed the lessons outlined above to help protect their personnel who find themselves in the middle of Mexico’s cartel war.


"Protective Intelligence Lessons from an Ambush in Mexico is republished with permission of STRATFOR."