Hybrid war in Mexico: how an anti-impunity protest was hijacked

In the days leading up to November 15, social media in Mexico circulated calls for a nationwide demonstration, “Generation Z Mexico.” Organizers presented the protest as a youth-led response to crime, corruption, and rising living costs. The message spread rapidly on Instagram, TikTok, and X, with videos and slogans urging young people to “take back the country.”

On the ground, the march revealed that while concerns about insecurity, economic strain, and distrust of institutions were widespread, the event’s rapid visibility was neither organic nor as large as online narratives suggested. Its amplification was coordinated by media outlets, political strategists, paid influencers, and automated accounts, elevating the protest to national prominence and intensifying calls against the elected government. Infodemia’s monitoring unit reported that over two million protest-related posts originated from accounts created within forty-eight hours, many later flagged for automated behavior and foreign IP routing. This coordination, combined with genuine public hardship, allowed political and foreign influence networks to co-opt authentic discontent.

As Mexico faces rising violence, regional inequality, water shortages, and disappearances, analysts say the November 15 protest reflects both the country’s mounting anxieties and the increasingly sophisticated efforts by political and economic actors to channel those anxieties for their own ends. The homicide rate, while slightly lower than in previous years, remains among the highest in the world, with several cities reporting levels above 100 deaths per 100,000 residents. Over one hundred thousand people are officially missing, and the figure rose after more clandestine sites appeared in 2025. Nearly two-thirds of Mexicans say they feel unsafe, even as the government claims progress.

Resource and economic pressures have intensified these challenges, leaving many feeling unsupported by national leadership. While the underlying frustrations are real, analysts note that powerful networks, rather than the protesters themselves, have redirected these grievances to serve their own agendas. As a result, the protest appears less as a grassroots movement and more as a strategically engineered form of dissent.

What happened at the protests?

At least 50 cities reported protests, but the demographic composition did not match the digital narrative. In cities such as Puebla, León, Guadalajara, and Monterrey, independent observers found that most marchers were older than the “Gen Z” imagery suggested. Drone footage, crowd photos, and interviews showed PRI and PAN loyalists, many in their fifties and sixties, carrying signs or wearing party colors. This contrasted sharply with the youthful, AI-generated images used in online promotion. A report from El Universal confirmed that many participants were registered voters of PRI and PAN, wearing branded merchandise distributed at party events earlier in the year. The demographic mismatch between digital imagery and actual turnout is a classic indicator of astroturf operations.

The largest gathering occurred in Mexico City, starting at the Ángel de la Independencia and moving toward the Zócalo. The march was peaceful for several hours, but when the crowd reached the National Palace security perimeter, the situation changed. A subgroup of masked or hooded individuals dismantled barricades and confronted police. Security forces responded with shields, gas, and batons. By the end, about one hundred officers and twenty civilians were injured, and approximately twenty people were detained. Smaller disturbances occurred in other cities, including vandalism in Guadalajara and standoffs in Monterrey, Oaxaca, Puebla, Tijuana, and León. Despite the “Gen Z” branding, most participants were older PAN and PRI loyalists, not the youthful demographic suggested online.

The violence in Mexico City appears to have been triggered by this small faction rather than by the larger body of demonstrators. The main march had held to a peaceful trajectory until these actors breached the front line. Eyewitness accounts, video evidence, and official statements all point to a clear separation between the broader crowd and the masked individuals who initiated the confrontation. Authorities suggested that political operatives or infiltrators may have used the moment to provoke disorder and generate footage that could fuel the digital component of the operation. Although those investigations are ongoing, the sequence of events indicates that the escalation was deliberate and operated independently of the majority of attendees.

Parallel to the street mobilization, a highly coordinated digital environment had been taking shape for days. While the public-facing narrative portrayed the protest as a spontaneous youth uprising, the online ecosystem surrounding it told a different story. In the days preceding the protest, Mexico’s cybersecurity units identified massive waves of new account creation that spiked within thirty-minute windows, a behavioral pattern characteristic of botnet deployment. These new accounts were reported to have increased traffic five times higher than the baseline, highlighting the significant abnormality of this digital surge.

Calls for confrontation circulated from accounts not linked to established activist networks, and analysts quickly identified signs of inauthentic coordination. President Claudia Sheinbaum stated that over eight million bot accounts, many based outside Mexico, artificially amplified the November 15 mobilization. Independent reporting from El País and other outlets confirmed that automated engagement and paid influencer activity drove the protest’s online visibility. Analysts observed repeated use of identical slogans, templated graphics, and synchronized posting across platforms, consistent with coordinated digital operations. Several influencers promoting the march had no prior political involvement, and their near-identical messaging suggested external guidance or compensation. These factors indicate the online surge was engineered to inflate public perception and frame the event as a nationwide generational uprising, despite limited organic momentum.

Additional indicators of manipulation appeared in the media circulating during the protest. Digital forensic reviewers identified cases in which videos shared as “live” were found to have metadata inconsistent with the event timeline, suggesting they had been recorded or edited earlier and then deployed during peak engagement windows. Journalists and researchers also documented the reuse of footage from previous demonstrations in Mexico and other Latin American countries, repackaged with new captions to imply real-time unrest on November 15. Media outlets, including El País and Animal Político, confirmed that several high-trafficked clips were miscaptioned or taken from unrelated events. Open-source analysts further noted that some viral images displayed common markers of AI-generated or manipulated content, such as duplicated facial features or inconsistent lighting, which made them visually compelling but not reliable as documentation. While not all of these anomalies prove coordinated foreign involvement, they establish that misleading or pre-fabricated content played a measurable role in shaping the digital narrative of the protest.

On the day of the protest, intensified calls to violence came from accounts neither Mexican nor linked to domestic groups. Many extreme messages, such as “storm the palace,” “remove the regime by force,” and “ignite the uprising now,” originated from accounts geolocated outside Mexico. In addition to Mexico and the U.S., smaller clusters in Spain, Colombia, El Salvador, and Argentina participated, echoing regional anti-left narratives. These accounts broadened the framing, presenting November 15 as a moral battle rather than a local protest. Some were routed through server farms in Eastern Europe and Southeast Asia, regions known for political influence outsourcing. Others appeared linked to diaspora networks with histories in U.S.-aligned campaigns against Latin American governments. These accounts showed little prior activity and only gained relevance after being boosted by automated networks. Their rapid amplification, with spikes of tens of thousands of shares in minutes, is consistent with botnet-driven signal inflation.

Influencers within Mexico amplified this rhetoric. Several mid-tier figures, often associated with business lobbies or right-leaning networks, escalated their messaging before the march. Their language shifted from civic participation to open provocation, urging followers to “defend Mexico from communism,” “force accountability,” and “go to the palace if the government will not listen.” Many had no prior political engagement and typically worked in lifestyle, fashion, entrepreneurship, or Christian branding. Their behavior was consistent with paid coordination, as posting schedules and scripts were nearly identical across platforms. Financial disclosures later revealed that several had recently received advertising payments from companies linked to the business networks behind the mobilization. Their accounts also interacted with the same cluster of foreign agitators, forming a repeating pattern in social graph analysis.

This digital atmosphere created conditions ripe for escalation. From early on, the presence of pre-fabricated graphics and orchestrated digital manipulation within social media platforms hinted at a calculated effort to shape public perception. By the time the march reached the National Palace, the expectation of confrontation had been repeatedly seeded online. Within minutes of the masked faction breaching the barricades, pre-prepared graphics, slogans, and English-language summaries of the confrontation spread across social platforms. The speed and polish of these materials, formatted identically across accounts that did not normally interact, indicated that they were not made spontaneously during the event. Network analysis showed that hundreds of accounts posted the same phrasing within the same sixty-second interval, an automation signature inconsistent with human coordination. Some digital actors urged simultaneous uprisings in other cities and encouraged demonstrators to replicate the breach attempt. While these calls were not representative of the majority of participants, they shaped the public’s perception of the event and helped frame the narrative in real time.

The November 15 mobilization was not a simple protest. It was a hybrid simulation, blending authentic pain with engineered narrative. This movement represented the convergence of genuine public discontent with a hybrid operation, where street-level events were shaped and amplified by foreign agitators, domestic elites, and a coordinated influence network seeking to turn national frustration into efforts to unseat the government.

What was the original reason behind the protest?

Underlying the protest were real grievances, and this is precisely what made the moment exploitable. Mexico has endured a prolonged crisis marked by cartel expansion, municipal government collapses, routine assassinations of public officials, and a justice system widely viewed as unable or unwilling to prosecute powerful actors. The killing of Uruapan mayor Carlos Alberto Manzo Rodríguez was not an isolated event. It became a symbol because it fit a grim national pattern: local officials murdered in broad daylight, municipal governments infiltrated or intimidated by organized crime, and citizens left with the sense that institutional protection had evaporated. His assassination triggered widespread anger because it illustrated the country’s vulnerability at the level closest to ordinary people, where governance touches daily life.

On social media and in street interviews, many demonstrators spoke about impunity as a defining feature of their reality. They described police forces compromised by criminal networks, prosecutors incapable of securing convictions, and political elites who seem immune from accountability even when linked to corruption or money laundering. These sentiments are not manufactured. They represent a deep structural exhaustion with successive governments’ failures; the movement tapped into this reservoir of disillusionment.

For younger participants, the grievances took on a different texture. Many described a sense of economic claustrophobia, shaped by stagnant wages, soaring rents, inaccessible housing markets, and job precarity. The fear that the country is becoming unlivable for ordinary people, combined with rising violence and worsening environmental insecurity, has created a generational feeling of being trapped. Young people expressed frustration not only about the present but also about the possibility that Mexico is losing its future. While the branding of the protest as a “Gen Z uprising” was artificially constructed, the economic grievances held by actual young people were sincere.

Older participants framed the crisis through a political lens. Many no longer trust the ruling party, arguing that Morena has failed to contain violence, that its anti-corruption agenda has stalled, or that it prioritizes political loyalty over institutional competence. Others fear that federal power is becoming too centralized. For them, the march was not just about insecurity, but about a growing perception that the government is managing the crisis poorly or dishonestly. This distrust has roots extending far beyond the current administration. It reflects decades of political volatility, party realignments, and elite impunity that eroded confidence across the ideological spectrum.

The raw public anger was used as combustible material. Into that anger, external operators inserted a framework that redirected frustration toward a specific political outcome. The original grievances did not disappear; they were repurposed. In effect, the destabilization strategy functioned by hijacking legitimate public frustrations and placing them inside a pre-engineered political container. The pain was real. The anger was real. The distrust was real. But the narrative direction, timing, coordination, slogans, visual branding, and escalation sequence were not. They were constructed around those emotions and then fed back into the public sphere through a hybrid system of physical mobilization, digital manipulation, and political agitation.

This blending of organic discontent with manufactured narrative scaffolding transformed a moment of collective frustration into a destabilization tool. It allowed powerful political and economic actors, domestic and foreign, to weaponize public sentiment while maintaining plausible deniability. It also ensured that the protest could be portrayed internationally not as a coordinated political operation but as a spontaneous democratic uprising, even when the underlying evidence showed a far more complex, orchestrated reality.

Mexico’s Fascist Coalition

Ricardo Salinas Pliego, Mexico’s oligarch

Ricardo Salinas Pliego is not simply a billionaire with media influence; he is an oligarch who has influenced policy behind the scenes for decades. He is one of the most powerful corporate actors in Mexico, a figure whose empire spans television, banking, telecommunications, retail finance, resource extraction, and gaming. Through Grupo Salinas, he controls TV Azteca, Banco Azteca, Elektra, and Totalplay, companies that give him unmatched reach into public opinion, credit markets, household consumption, and national infrastructure. His companies’ interests intersect directly with areas where federal regulation, tax enforcement, and anti-corruption policy have become more aggressive in recent years, creating friction between the oligarch and the current Sheinbaum government.

Salinas has faced significant legal scrutiny over the past two decades, both in Mexico and abroad. Notably, in 2005, the U.S. Securities and Exchange Commission accused him and TV Azteca of financial misconduct; this case was settled. Currently, in Mexico, tax disputes have intensified. Courts have ordered Grupo Elektra to pay billions of pesos in overdue liabilities, part of a broader federal effort to recover more than 63 billion pesos tied to his conglomerate. Mexican officials have openly accused Salinas of leveraging influence over the judiciary to obstruct payment. To date, no court has concluded that Salinas Pliego personally maintains direct ties to drug cartels. However, the casino investigations have tied his companies to criminal financial networks, raising questions about oversight, compliance, and exposure to cartel influence or collaboration.

The oligarch and the orange tyrant

Ricardo Salinas Pliego’s political reach extends far beyond Mexico’s borders. Over the past decade, he has cultivated ties with influential figures in the United States, particularly within the Republican Party and networks aligned with former President Donald Trump. A U.S. subsidiary of Grupo Salinas donated $250,000 to Trump’s 2017 presidential inauguration committee, placing him among a small circle of foreign-linked business interests that publicly supported the incoming administration. In the years that followed, a political action committee tied to his U.S. operations contributed to Trump’s re-election effort and more than $289,000 to Republican candidates and committees during the Trump presidency. Signaling a clear engagement with GOP power structures and Trump’s network of influence.

The overlap does not end with donations to the Trump campaign. Salinas Pliego has also surfaced in the corporate intelligence world, where his legal disputes have intersected with firms connected to Israeli intelligence. Reporting from Intelligence Online indicates that during a high-stakes financial conflict with businessman Val Sklarov, hiring Black Cube, a company founded by former members of Israel’s security services. Black Cube is already familiar in U.S. political circles. In 2017 and 2018, multiple investigations by major outlets revealed that aides to Donald Trump or actors aligned with his policy goals had contracted with Black Cube in connection with efforts to undermine the Iran nuclear agreement. The firm was reported to have targeted former Obama administration officials Ben Rhodes and Colin Kahl, looking for compromising personal or financial information that could be used to discredit them.

Several of Salinas’s public statements have echoed core Trump Republican messaging, including skepticism of state regulation, denunciations of “socialist” policies, and advocacy for market-driven reforms. During the Trump presidency, he publicly defended U.S. trade pressure on Mexico and praised Trump’s economic approach. His media and corporate messaging often mirror themes common in right-wing circles, emphasizing limited government oversight and hostility toward regulations that affect telecommunications, banking, and large-scale retail lending.

In 2025, Salinas launched a right-wing political initiative in Mexico that shared stylistic similarities with global far-right regressive movements tied to Russia, Israel, and Trump. His call for a citizen-led movement against “crime and corruption” drew heavily on the rhetoric of “taking back the country,” a phrase central to the former U.S. president’s political identity. While not publicly affiliated with any U.S. political organization, his messaging and political posture place him squarely within the ideological and influence orbit of contemporary regressive populism. Salinas’s corporate empire depends on a regulatory environment that favors private industry, helps him evade taxes, and limits federal regulations that protect ordinary people.

Taxing the oligarch: Mexico vs Corruption.

The long-running tax conflict between Ricardo Salinas Pliego and the Mexican government reached a decisive moment in 2025 under President Sheinbaum. After more than a decade of disputes, a federal tribunal in June ordered Grupo Elektra to pay 2,000 million pesos in overdue taxes, rejecting the company’s appeals and confirming the SAT’s assessment. Administrations before Claudia Sheinbaum had attempted to collect, but Salinas’s legal teams repeatedly stalled the process through appeals, constitutional protections (amparos), and challenges that kept the cases tied up in the courts. The standoff became a symbol of a broader problem in Mexico’s political economy: the difficulty of compelling untouchable oligarchs to comply with tax obligations that ordinary companies and citizens cannot escape. Salinas had long been seen as one of the most protected businessmen in the country, benefiting from political access and relationships that allowed him to delay or dilute enforcement efforts.

That changed under President Sheinbaum. Her administration inherited years of unresolved tax disputes involving Mexico’s largest corporate groups, but unlike previous governments, she treated these liabilities not as political bargaining chips but as a cornerstone of her anti-corruption platform. Unlike earlier governments, Sheinbaum entered office with a mandate to show she was not beholden to private power. Taking decisive action in a high-profile case involving one of the richest and most politically connected figures in the country gave her administration immediate credibility. Her administration strengthened the SAT’s litigation capacity, publicly backed regulators, and encouraged prosecutors to accelerate long-delayed cases. Sheinbaum’s government expanded audit protocols for large corporations, tightened rules governing public procurement, and introduced stricter oversight of federal contracts. She pushed for clearer reporting standards within government agencies, increased transparency requirements for public spending, and supported measures to limit influence peddling within regulatory bodies. Her administration also backed judicial reforms aimed at reducing the abuse of amparos that had historically allowed wealthy defendants to delay or nullify enforcement actions.

In June 2025, a federal tribunal issued a firm and final ruling ordering Grupo Elektra to pay 2,000 million pesos in overdue corporate taxes. The judges dismissed Elektra’s final set of appeals and upheld the SAT’s position that the liabilities were legally sound and long overdue. The court also determined that no further protections or procedural delays were justified, meaning Elektra was forced to pay immediately. The decision was unprecedented, not because of the amount but because of who it targeted. The courts signaled that they would no longer serve as a safety valve for corporate power, and SAT officials described the ruling as a watershed moment for fiscal sovereignty. It marked the first time in modern Mexican history that one of the country’s most powerful business empires was forced to comply with a major tax judgment after more than a decade of resistance.

This judgment represents only a fraction of what is at stake. According to SAT data, companies tied to Salinas Pliego collectively owe over 63,000 million pesos in accumulated liabilities, including corporate income taxes, penalties, and interest involving Elektra, TV Azteca, and other subsidiaries. These are among the largest corporate tax debts in the country.

For Sheinbaum, the ruling served two purposes. It demonstrated the government’s commitment to legal equality and undermined the perception that major businessmen could negotiate away their obligations. It also provided political momentum for her anti-corruption agenda, reinforcing public confidence in institutions that had long been viewed as deferential to economic elites.

For Salinas, the implications were immediate. The ruling weakened his perception of invulnerability and impunity, increased his financial exposure, and raised the prospect that the rest of his accumulated liabilities could soon be enforced with equal force. It also intensified the political conflict between his corporate empire and the federal government, contributing to his increasingly aggressive posture in the media and online political networks. The defeat significantly increased Salinas’s financial exposure, as well as that of every other oligarch in Mexico, and reduced his ability to negotiate from a position of strength. His public response framed the rulings as political retaliation, even as officials emphasized that the cases reflect an effort to enforce tax law uniformly after decades of selective oversight. The ruling reflected a structural shift in the balance of power between the state and the corporate oligarchs who had shaped Mexico’s political economy for decades. Sheinbaum’s anti-corruption measures provided the institutional foundation. The Elektra ruling provided the precedent. And together they signaled that Mexico’s era of untouchable billionaires was beginning to crack.

The Oligarch and the Cartel

The legal pressure on Ricardo Salinas Pliego intensified further when two casinos owned by Grupo Salinas were suspended as part of a nationwide crackdown on financial operations linked to organized crime, including drug cartels. Mexican authorities announced in 2025 that 13 casinos across multiple states were being investigated for laundering large volumes of illicit proceeds generated by the country’s major cartels. Two of those establishments belonged to the Salinas conglomerate.

Casinos have long been a favored laundering mechanism for Mexican cartels, as well as other organized crime groups worldwide. Their cash-heavy business model allows criminal networks to inject illicit funds into the financial system with minimal detection. The most common methods include:

1. Structured Cash Buy-ins

Cartel operatives bring significant amounts of small-denomination cash into casinos, break it into chips, play minimally, then cash out. The money is reissued as “winnings” and appears legitimate once deposited into bank accounts.

2. Use of Intermediaries (Smurfs)

Multiple individuals make smaller, separate transactions to avoid triggering reporting thresholds. These intermediaries often rotate casinos, making surveillance more difficult.

3. Collusion With Casino Staff

Criminal groups bribe or threaten employees to bypass required identification checks or to falsify transaction records. Some casinos have been accused of maintaining parallel bookkeeping systems to facilitate money movements.

4. Cross-Border Financial Transfers

Cartels use casinos near the U.S. border to convert pesos into dollars, then move the funds through shell companies or fake vendors abroad, completing the laundering cycle.

5. Use of Virtual Betting Platforms

Some casinos operate online platforms that are lightly regulated, enabling anonymous high-volume transactions across jurisdictions.

These practices make the gaming industry one of the most strategically important laundering channels for major criminal groups, including the Sinaloa Cartel, the Jalisco New Generation Cartel (CJNG), and various regional factions. It is also one of the sectors where government oversight has historically been weakest.

The nationwide casino investigation marked the first time in over a decade that federal authorities aggressively targeted the financial infrastructure supporting cartel liquidity rather than solely pursuing high-profile traffickers. By focusing on casinos, regulators went after the “cleaning” stage of cartel finances, where illicit proceeds are transformed into spendable corporate assets.

For Grupo Salinas, the suspension of two of its gaming establishments was especially consequential, not because authorities accused the conglomerate of criminal intent, but because any proximity to illicit finance networks carries severe regulatory and reputational risks. Even indirect exposure forces companies to undergo thorough audits, intensified reporting requirements, and forensic accounting reviews that can uncover additional irregularities.

At the moment the casino investigation broke, Salinas was already entangled in multi-billion-peso tax disputes and facing heightened regulatory scrutiny across his telecom, banking, and retail-finance divisions. The suspension of his casinos added a new legal front and expanded the scope of state oversight into his business empire.

The regulatory challenges emerged as a significant threat to his corporate model, signaling a broader “rule-of-law offensive” aimed at establishing system-wide changes rather than isolated regulatory incidents. This approach reflects the structural reform effort, intending to strengthen legal compliance across sectors and diminish the influence of entrenched oligarchies. Regulators gained access to internal financial records that were previously shielded by legal challenges. Increased surveillance meant less room for aggressive accounting strategies or opaque financial movements. Heightened AML (anti-money laundering) compliance requirements forced Banco Azteca to red-flag transactions more aggressively, undermining some of the flexibility the group and cartels relied on. Insurance and credit rating agencies responded by intensifying scrutiny of Grupo Salinas’s risk profile. Political opponents leveraged the investigation, framing it as evidence that his empire operates in legal gray zones.

For an oligarch whose empire has flourished under a light regulatory touch, this was a direct challenge to his operating environment. The casino suspensions also showed a transformation in Mexico’s approach to both criminal finance and elite impunity. For the first time in years, regulators were willing to risk confrontation with major corporate groups to disrupt the financial pipelines on which cartels depend. And because Grupo Salinas is one of the most politically connected conglomerates in the country, the enforcement action was widely interpreted as a sign that the government was willing to target any actor, regardless of status, if their financial operations fell within the scope of the investigation.

In short, the casino crackdown did more than expose potential vulnerabilities in Salinas’s empire. It demonstrated that, under President Sheinbaum, corruption would face serious pushback.

Vicente Fox and the right-wing axis

Vicente Fox, who served as Mexico’s president from 2000 to 2006, positioned himself during his term and in the years since as a central node within the U.S.-aligned conservative right-wing bloc in Latin America. Long after leaving office, he embedded himself in a network of MAGA Republican donors, Miami-based conservative influence groups, and corporate lobbying circles opposed to left-leaning governments in the region. His alignment with U.S. geopolitical interests has enabled him to play, as some analysts call it, the “Mexican node” in U.S.-backed right-wing hemispheric strategy.

Fox’s involvement links the November 15 events to a broader hemispheric strategy: stopping left leaning governments and protecting U.S. corporate interests.

During Vicente Fox’s presidency, Mexico entered one of the closest periods of intelligence and security integration with the United States in modern history. Public records, declassified cables, court filings, and investigative reporting reveal a convergence between Fox-era security institutions, U.S. intelligence frameworks, and cartel dynamics that would later define an entire generation of Mexican security failures.

The fox and the eagle

A 2005 U.S. State Department cable released under FOIA shows that the Fox administration executed a series of coordinated narcotics operations with U.S. agencies. These operations demonstrated that Fox’s security apparatus was deeply embedded in U.S. intelligence-supported structures, including training, surveillance operations, and interdiction frameworks. Analyses by investigative organizations, including the ICIJ, describe how Fox’s national security system adopted U.S. intelligence methodologies during this period. The approach emphasized military-led operations against civilians, centralized intelligence analysis, and the strategic use of U.S. law-enforcement support. Mexican federal police and the AFI (Agencia Federal de Investigación) under his presidency were structured using doctrines, training, and logistical assistance tied to U.S. agencies.

These institutional ties created an intelligence-sharing ecosystem that operated far beyond simple cooperation. It blended U.S. and Mexican priorities in ways that blurred lines between domestic and foreign intelligence work, and established operational channels that would later be implicated with the cartels it allegedly sought to combat.

Fox and the Sinaloa cartel

A 2024 intelligence assessment, The Sinaloa Cartel: An Intel Analyst’s Guide, concludes that the Sinaloa Cartel “established strong connections with Mexico’s elite, particularly within the National Action Party (PAN) administrations of Vicente Fox and Felipe Calderón.” During these years, federal enforcement created a disproportionate advantage for Sinaloa: operations focused heavily on dismantling its rivals, while institutional appointments and intelligence-sharing practices consistently favored the cartel’s interests.

Open-source intelligence (OSINT) databases, federal operational logs, court filings, and major investigative reports from the early 2000s consistently reveal a measurable asymmetry where federal agencies under Fox disproportionately disrupted the operations of the Gulf Cartel, Tijuana Cartel, and Beltrán Leyva factions, while Sinaloa territories experienced lower strategic pressure. This enforcement asymmetry allowed Sinaloa to consolidate territory, expand its networks, and emerge as the most powerful criminal organization in the Western Hemisphere.

Mapping of federal operations during the early 2000s reveals that most large-scale crackdowns occurred in rival strongholds such as Tamaulipas, Baja California, Coahuila, and Nuevo León. In contrast, regions under Sinaloa’s control, including Sinaloa state, Durango, and Sonora, saw operational failures, aborted raids, and repeated instances of cartel leaders escaping minutes before federal forces arrived. Journalistic investigations at the time attributed these failures to “orders from above” and intelligence leaks within the federal apparatus.

Fox’s unwavering public defense of Genaro García Luna, later convicted in the United States for accepting millions in bribes to protect the Sinaloa Cartel, further deepened suspicion. Even after a U.S. federal jury convicted García Luna for accepting millions of dollars in bribes from the Sinaloa Cartel in exchange for protection, Fox insisted that his former security chief “did a very good job.” His remarks were widely criticized, not only because of the overwhelming evidence presented in court, but also because the crimes for which García Luna was convicted began during the Fox administration.

Testimony from traffickers, former police officials, and federal agents described how García Luna transmitted intelligence to the cartel, authorized the redirection of federal operations, facilitated the safe passage of drug shipments, and undermined investigations that threatened Sinaloa’s interests. This conduct began in 2001 during the Fox administration when García Luna was appointed director of the Federal Investigation Agency, known as the AFI. As AFI director, he oversaw national investigative functions that resembled a centralized intelligence service. The trial revealed that during this period, García Luna began leaking federal plans, misdirecting units, and shaping enforcement priorities in ways that gave Sinaloa unique protection. Crimes that continued well into Felipe Calderón’s presidency.

Many of the senior officials and political operators active during the early 2000s were part of overlapping networks within PAN, the federal intelligence bureaucracy, and private security consultancies. Several of these networks promoted the modernization of Mexican policing through closer integration with United States intelligence agencies, a strategy that centralized enormous authority within AFI. García Luna’s command structure was enabled by this concentration of power, and Fox continued to back this approach even after evidence emerged that the institution had been compromised at the highest levels.

Although no court has accused Vicente Fox personally of colluding with the cartel, his political and institutional decisions placed García Luna in a position that allowed Sinaloa to expand its influence. His public endorsement of García Luna after the conviction reinforced an image of a former president defending the architect of one of the most damaging corruption schemes in the hemisphere. The Fox administration represents a turning point in which state institutions began to align structurally and operationally with a criminal organization whose reach eventually extended across Mexico and far beyond its borders.

U.S. Intelligence, the CIA, and the origins of Sinaloa Cartel’s protection networks

The political environment that Vicente Fox inherited in 2000 cannot be understood without examining the deeper history of U.S. intelligence agencies’ contact with the early structures of what would become the Sinaloa Cartel. During the Contra War in the 1980s, U.S. covert operations in Central America and the evolving structure of Mexico’s drug trafficking organizations converged. Multiple investigative reporters, including those publishing in the San Jose Mercury News, The Washington Post, and later summarized through FOIA releases housed in the National Security Archive, documented that U.S. intelligence agencies were using drug routes associated with the Guadalajara Cartel, the predecessor to the Sinaloa cartel.

Much of this activity passed through Honduras, Costa Rica, and El Salvador, where U.S. intelligence operatives and private intermediaries were moving weapons to Contra forces while seeking clandestine and/or illegal sources of funding to bypass Congressional restrictions. The Guadalajara Cartel expanded its aviation operations. The cartel maintained fleets of small aircraft, established secret landing strips across northern Mexico and Central America, and developed pilot networks capable of covering long-range routes from Colombia to the United States. U.S. intelligence priorities in Central America allowed selected drug trafficking channels de facto freedom of movement because they intersected with covert geopolitical objectives.

The 1985 killing of DEA agent Enrique “Kiki” Camarena sharply increased scrutiny of the Guadalajara Cartel’s operations. Camarena had uncovered evidence of industrial-scale drug production on cartel-controlled ranches, and his kidnapping and murder, linked by U.S. investigators to Guadalajara Cartel figures and corrupt officials, triggered a diplomatic crisis. Witnesses later reported that traffickers believed they operated with partial cover because their routes overlapped with areas of U.S. covert activity. The claims were never officially proven, and the U.S. denies involvement. Meanwhile, in parallel, the Iran-Contra operation was taking place, in which officials in the Reagan administration illegally sold weapons to Iran and used the proceeds to fund the Contra rebels in Nicaragua after Congress had banned such support.

A U.S. congressional investigation led by Senator John Kerry concluded that elements of the Contra movement and several of the air crews supporting it were directly involved in drug trafficking. Investigators found that U.S. officials were aware of these activities and understood that the Contras’ resupply network offered what one witness called “a perfect cover” for drug flights moving through Central America and into Mexico. Two declassified CIA reports acknowledged that the agency continued working with individuals connected to the Contras who were already known to be involved in drug trafficking. The documents showed that CIA officers received multiple allegations of drug flights linked to these networks, but did not pursue the claims with urgency or elevate them through formal reporting channels. They also revealed that several CIA contractors and assets had past or ongoing drug involvement, yet were allowed to remain embedded.

Between 2001 and 2005, Genaro García Luna directed the Federal Investigation Agency under President Vicente Fox, a period that U.S. prosecutors later identified as the origin point of his protection scheme for the Sinaloa Cartel. Testimony in the New York trial revealed that during these early years, García Luna began leaking operational intelligence to Sinaloa, redirecting federal actions away from cartel strongholds and using his authority inside AFI to weaken rival groups. These activities, according to witnesses and documentary evidence, formed the structural foundation of Sinaloa’s rise and were directly linked to institutional decisions made during Fox’s presidency.

The first public indication that Sinaloa’s influence extended into United States intelligence operations came in 2011 when Vicente Zambada Niebla, the son of Ismael “El Mayo” Zambada, testified in federal court that Sinaloa operatives had been providing information to U.S. agents in exchange for assurances that they would not be arrested. Prosecutors denied any formal immunity agreement, but their denial did not fully erase the implication that a functional relationship had existed. Zambada’s testimony suggested that Sinaloa had been treated as a source of intelligence rather than a primary target, which aligned with enforcement patterns that analysts had observed for years.

In 2012, the picture sharpened further. A major investigative report documented evidence that between 2000 and 2012, the United States government, under both the Bush and Obama administrations, had tolerated Sinaloa’s trafficking activities because the organization supplied actionable intelligence on its rivals. The reporting indicated that billions of dollars in narcotics had crossed the border during this period while U.S. agencies focused disproportionately on dismantling competing cartels. The findings were never formally refuted, and they became a cornerstone of the public record because they matched the disproportionate enforcement pressure observed in Mexico under Fox and Calderón.

By 2023, the allegations gained legal confirmation when García Luna was convicted in the United States of colluding with the Sinaloa Cartel. The conviction validated years of claims that his protection network began during his time in the Fox administration. During the trial, the prosecution demonstrated that his corruption spanned multiple presidencies but originated inside the agency Fox had created and placed under his command. The verdict linked the institutional choices of the early 2000s to the cartel’s later dominance.

In 2024, the dynamic changed again. Two senior Sinaloa figures, Ismael “El Mayo” Zambada and Joaquín Guzmán López, pleaded guilty in a United States court and began cooperating extensively with federal investigators. Their cooperation was viewed as an inflection point because both men possessed detailed knowledge of political protection networks on both sides of the border. Analysts believed their testimony could reshape the understanding of how deeply the cartel had penetrated security institutions since the Fox years.

The pattern reached an unprecedented level of political volatility in 2025 when Mexican security officials disclosed that Donald Trump had quietly permitted seventeen Sinaloa family members to enter the United States. The revelation suggested a clandestine accommodation between the Trump administration and the cartel at a time when the United States was presenting itself as tough on organized crime. President Claudia Sheinbaum publicly demanded an explanation from D.C. The disclosure reinforced the sense that the Sinaloa Cartel had benefited from political and intelligence decisions in both countries for more than two decades.

Sheinbaum’s anti-corruption agenda directly threatens Fox-aligned networks

Vicente Fox’s opposition to President Claudia Sheinbaum is not the result of a single disagreement. It is the product of structural, political, and personal forces that place Sheinbaum’s administration in direct conflict with the networks Fox helped build and benefited from. Sheinbaum has intensified oversight of institutions that, during the Fox and Calderón years, operated with considerable autonomy and limited supervision or regulation, allowing rampant corruption and cartel collaboration.

Sheinbaum’s government has supported tax enforcement against major corporations, expanded scrutiny of security agencies, and backed investigations into corruption that began decades earlier. These actions have placed pressure on political, business, and intelligence networks linked to the PAN era. For Fox, whose presidency established the broken institutional foundations that empowered criminal figures like Genaro García Luna, this new scrutiny threatens his political legacy and the credibility of the security model he promoted. Sheinbaum’s reforms implicitly challenge the narrative that the PAN governments represented a clean break from the old order.

Fox’s administration was deeply aligned with U.S. national security priorities. This alignment did not reflect ideological sympathy. It produced tangible economic and political gains for U.S. corporate interests, U.S. security agencies, and the Mexican elite networks that surrounded Fox. Under Fox and Calderón, Mexico became one of D.C’s most reliable security clients. Through the Mérida Initiative and related Pentagon and DHS programs, the United States appropriated more than 3 billion dollars in equipment, surveillance systems, software, aircraft, border technology, and training for Mexican forces. Most of that money returned to U.S. contractors in the form of multi-year supply, maintenance, and upgrade contracts. Mexico purchased U.S. surveillance platforms, command-and-control centers, detection systems, and counter-narcotics hardware, locking Mexican institutions into long-term dependence on U.S. vendors. The expected value of future renewals and expansions amounted to billions more over the coming decade.

Sheinbaum’s shift toward tighter oversight and reduced reliance on foreign security providers endangers this revenue stream. If Mexico withdraws from the U.S. security umbrella, U.S. corporate contractors stand to lose billions of dollars in contracts, renewals, and upgrades across the U.S.–Mexico security space.

Fox promoted privatization and market liberalization that favored U.S. corporate sectors, including finance, telecommunications, energy, and retail. Fox’s reforms loosened regulations across finance, telecommunications, energy, and retail. This produced rapid expansion for US and other foreign corporations seeking entry into Mexico’s consumer markets. U.S. banks gained easier access to credit markets and retail banking. Energy companies benefited from deregulated investment rules. Telecommunications and tech firms expanded their digital and data infrastructure under friendlier regulatory conditions. Retail giants gained the ability to scale into Mexico’s expanding urban markets with minimal friction. These openings did not simply create short-term profits. They generated long-term financial architectures in which entire business ecosystems became dependent on U.S. capital flows, U.S. technologies, and U.S. market access.

For Mexican elites within Fox’s network, this alignment cemented their status as preferred partners for foreign investment. They became the local intermediaries through which U.S. capital entered the country. Their businesses grew through joint ventures, supply contracts, franchising, financing agreements, and partnerships with American corporations. They could secure credit, technology, and foreign investment on terms that small and medium Mexican companies could not access. Their political power increased in parallel because they were viewed in Washington and New York as “reliable, modernizing partners.”

Sheinbaum’s government threatens this system. Her administration has stepped up regulatory enforcement, tightened oversight on concessions, challenged monopolistic practices, and ended the assumption that U.S. capital should automatically shape Mexico’s economic direction. In sectors such as energy, water, infrastructure, and telecommunications, her government has imposed constraints that disrupt the frictionless access U.S. corporations enjoyed for 2 decades. Even modest shifts in public policy reduce the ability of elite corporate groups to extract value from privatization and deregulation. For them, the fear is not losing past profit but losing the future trajectory of wealth built on that model. These elites, both U.S. and Mexican, recognize that if Sheinbaum succeeds, the long arc of Fox-era liberalization will be weakened. Regulatory scrutiny will tighten, corporate tax enforcement will expand, and state authority will be reasserted in strategic sectors. That would reduce the influence of the oligarchs who benefited from the previous era and constrain U.S. corporations’ capacity to shape Mexico’s economy.

This is the primary reason for their opposition to the government. It is not ideological or solely about cartel violence; rather, it concerns preserving their ability to maintain systems of corruption and extract national wealth.

Claudio X. González and the Mexican right-wing’s shadow Infrastructure

González’s influence rests on a set of flagship institutions. Mexicans Against Corruption and Impunity, formally presented as an independent anti-corruption watchdog, has operated as a vehicle for shaping public opinion through selectively framed investigations that often target officials aligned with left-leaning administrations. Sí Por México was created as a national coordination platform that brought together hundreds of civil society groups, business associations, and media partners, providing a unified structure for opposition messaging and campaign alignment. Unidos, his electoral advocacy arm, focuses on voter mobilization, candidate support, and message discipline within the center-right coalition, supplying the organizational capacity that traditional parties have struggled to maintain.

Beneath these organizations sits a donor architecture that draws from Mexico’s most influential business families, elite chambers, and international foundations. Families linked to Grupo BAL, Grupo México, and other industrial conglomerates participate through business councils that coordinate closely with González’s platforms. These domestic networks are reinforced by cross-border philanthropic foundations, such as programs funded through the National Endowment for Democracy, USAID-linked civil society grants, and Open Society–affiliated initiatives that support investigative and governance projects intertwined with González’s ecosystem. International policy institutions, including the Atlantic Council and the Wilson Center’s Mexico Institute, regularly host his collaborators and amplify their framing of Mexican politics in foreign policy circles. This combination of domestic oligarchic support and international institutional backing gives González’s operations a depth of funding and legitimacy unmatched by any other opposition figure.

Through these structures, González’s network conducts operations that resemble modern political influence architecture rather than traditional NGO work. It pushes coordinated messages across television, print outlets, digital platforms, and social media. It amplifies narratives through aligned journalists and foreign-based advocacy groups that frame Mexico’s left as economically destabilizing or institutionally threatening. It employs psychological messaging targeted at undecided voters, supported by sentiment analysis, narrative reinforcement, and strategic fear appeals calibrated to economic insecurity and crime. These operations are strengthened by partnerships with U.S. conservative networks, political consultants, and communications firms specializing in influence management, reputation engineering, and counter-disinformation technologies.

What makes the González network particularly significant is that it provides the Mexican right with the organizational continuity that PRI and PAN can no longer supply. As the traditional parties have fragmented and lost public credibility, González has built the administrative framework, messaging discipline, and donor coordination necessary to sustain a long-term opposition strategy. His network links business chambers, major industrial families, media owners, legal strategists, and foreign policy actors under the appearance of nonpartisan civic engagement, even though the objectives consistently align with conservative political and economic interests.

These organizations also grant the opposition a level of institutional legitimacy that political parties cannot offer. Because they operate under the banner of civil society and transparency, they can intervene in public debates, coordinate pressure campaigns, and mobilize protests without the partisan stigma that burdens PRI and PAN. This creates channels through which foreign policy institutions, donor networks, and cross-border advocacy groups can shape Mexico’s political landscape under the guise of supporting governance and democratic accountability.

González’s opposition to President Claudia Sheinbaum emerges from this structural context. Her administration challenges the economic and regulatory model that sustains his network. She has expanded tax enforcement, increased scrutiny of monopolistic business practices, and strengthened oversight in energy, telecommunications, and strategic industries. These measures directly threaten the financial interests of the elite donors who underwrite González’s political machinery. She has also narrowed the channels through which foreign institutions, U.S.-aligned policy centers, and international consultants influence Mexican policy. This undermines the transnational support systems that amplify González’s agenda.

Sheinbaum’s strong popular mandate and continuity with Morena’s political project block González’s strategic ambition to rebuild a viable center-right bloc capable of returning to national power. For an opposition whose traditional parties are electorally weakened, weakening the administration’s public legitimacy becomes a political necessity. His organizations, therefore, frame Sheinbaum as ineffective on security, hostile to investment, and dangerous to Mexico’s institutional order, regardless of the policy evidence.

In effect, Claudio X. González functions as the operational and ideological bridge between Mexico’s old political elite, the business oligarchy, and the international right. He provides the infrastructure that enables these actors to coordinate without leaving a direct fingerprint. He provides the narrative, the logistics, and the institutional cover for initiatives that the traditional right cannot publicly lead. In moments of political crisis, he becomes the strategic nucleus around which protest coordination, media framing, legal warfare, and international pressure converge.

This is why his role in the November 15 mobilization is significant. His networks give structure to opposition activity that would otherwise lack popular momentum, and they allow elite political and economic actors to channel unrest into a cohesive national strategy aimed at weakening a government that threatens the economic and political order on which they depend.

PRI and PAN’s Operational Cadres

While the protest was marketed across social platforms as a spontaneous Gen Z uprising, the demographic reality on the ground revealed a very different architecture. The march was dominated not by young people but by older adults, many of them long affiliated with PRI and PAN and having participated in partisan mobilizations for decades. Their presence was not incidental. It reflected the deliberate activation of traditional party machinery that has historically supplied the street-level manpower for Mexico’s conservative political operations.

Field observations in Puebla and other participating cities showed a consistent pattern. The majority of attendees were middle-aged or elderly, many wearing party colors, carrying signage consistent with PRI–PAN campaign aesthetics or marching in groups organized through local party committees. Several attendees had participated in earlier partisan demonstrations, and some arrived in caravans coordinated by municipal structures historically controlled by PRI or PAN. The optics were unmistakable. What digital propaganda presented as a youth revolt was, in reality, an event populated by the same demographic cohorts mobilized in every conservative march over the last two decades.

This was not merely an organic turnout. PRI and PAN possess extensive territorial machinery built around neighborhood committees, municipal operators, patronage networks, and sectoral organizations. These structures can mobilize large groups quickly, particularly older voters who maintain long-standing ties to the parties through unions, social programs, business associations, or local political relationships. When social media campaigns engineered by González-linked networks required bodies in the street to legitimize the narrative of a nationwide youth rebellion, PRI and PAN provided the physical turnout necessary to anchor an otherwise synthetic digital operation.

In this sense, PRI and PAN serve as the street-level manpower for the operation. Their territorial bases deliver presence, numbers, and visual legitimacy. They fill plazas, marches, and camera frames, giving influencers, bot networks, and media partners the footage needed to portray a movement with national force. The digital architecture constructs the narrative, but the PRI–PAN base provides the bodies that make that narrative appear real. Online, the movement claims to be leaderless, youthful, and anti-establishment. Offline, it is powered by the same aging partisan infrastructure that built Mexico’s old political order. The illusion of a Gen Z rebellion depends entirely on PRI and PAN’s ability to supply the human infrastructure that digital fabrication alone cannot produce.

The Regime Change Operation

Right Wing Influencers and Paid Amplifiers

The most visible layer of the November 15 mobilization consisted of social media influencers, lifestyle personalities, and digitally cultivated “Gen Z spokespeople.” Their function was aesthetic rather than strategic. They provided human camouflage, masking the operation’s political architecture by presenting a curated image of youthful spontaneity. Their follower networks extended the movement’s algorithmic reach, allowing coordinated slogans and edited protest clips to spread rapidly across platforms. Through stylized visuals, music cues, fashion signaling, and slang tailored to younger audiences, they generated the cultural gloss needed to make the initiative appear socially embedded and contemporary. They also set the emotional tone of the campaign, delivering calibrated frustration or indignation that resonated with online engagement metrics.

Despite their visibility, these actors did not lead or organize the effort. They did not design the messaging architecture, coordinate logistics, or shape political strategy. Their role was promotional and performative. In practice, they operated as brand ambassadors for a project engineered elsewhere. Much of their reach was supplemented by inauthentic activity, including amplification from coordinated troll farms, synthetic engagement clusters, and foreign-operated botnets. These digital assets inflated the appearance of a youth-driven grassroots uprising even when the physical turnout contradicted that narrative.

External clues confirmed the presence of inauthentic coordination. Large numbers of accounts amplifying protest content were created in tight chronological windows, displayed repetitive phrasing, or posted identical videos within minutes of each other. Many used foreign IP proxies or recycled footage from unrelated protests in Latin America and Asia. These patterns matched established signatures of outsourced influence farms operating from abroad. Their purpose was not persuasion but simulation, creating the illusion of broad domestic momentum where little existed organically.

U.S. Digital Influence Networks

The operational fingerprints of the November 15 protests closely match those of documented U.S.-aligned digital influence campaigns deployed across Latin America over the last decade. The tactic relies on constructing the impression of domestic revolt through foreign botnets, AI-generated content, automated engagement, and coordinated diaspora influencers. The pattern echoes Cuba’s July 2021 #SOS surge, Ecuador’s anti-Correa destabilization operations, the Venezuelan agitation cycles, and the online media offensive surrounding Bolivia’s 2019 crisis. In each case, digital simulations of mass unrest preceded or accompanied political pressure campaigns.

Sheinbaum’s disclosure that approximately eight million foreign-linked bots boosted protest messaging fits squarely within this established model. The objective is not to convey truth but to generate a manufactured sense of urgency and inevitability.

Miami-Based Anti–Latin American Left Operations

For decades, Miami has operated as the strategic hub for U.S.-backed anti-left media, political operatives, and diaspora influence operations targeting Latin America. The ecosystem includes exiled officials with historic ties to U.S. security agencies, corporate-funded media personalities, professional agitators, and digital marketing firms contracted for political warfare. These networks have shaped major destabilization campaigns from Cuba to Bolivia, supplying narrative framing, platform coordination, and English-language amplification for international audiences. Their expansion into Mexico is not anomalous. It is the logical extension of a regional influence model designed to counter governments perceived as deviating from U.S. policy preferences.

The United States does not rely on military intervention when information warfare and economic pressure can achieve the same strategic outcomes. Several corporate sectors have significant material interests in reshaping Mexico’s political direction. Major technology firms planning to build AI data centers rely heavily on permissive water and energy regimes. U.S.-based energy corporations view Morena’s nationalistic policies as a direct threat to profit margins. Water-intensive multinationals fear regulatory reforms that would limit extraction or impose higher compliance costs. The U.S. defense industry, tied to border militarization contracts, depends on Mexico remaining inside a cooperative security architecture that prioritizes U.S. technologies and American contractor dominance. These interests converge around the goal of a more pliable Mexican government aligned with U.S. market priorities.

Mexico’s digitally engineered uprising bears hallmarks of transnational influence operations by firms specializing in political data and astroturf mobilization. These firms operate by shaping sentiment through automated amplification, influencer-driven persuasion, and AI-generated propaganda assets. Their objective is to create public pressure environments that appear organic but are in fact manufactured. The November 15 digital surge, with its scripted influencer content, synchronized posting waves, and artificially inflated trends, reflects these techniques.

Foreign bot farms and AI content networks

Analysts tracking the protest noted substantial activity from bot farms operating outside Mexico. These networks replicated known behavioral patterns from regions with a history of outsourcing political influence, including sudden spikes in account creation, uniform slogan repetition, and mass reuse of AI-generated protest visuals. Their purpose was to saturate Mexico’s information space, overwhelm authentic discourse, and manufacture a sense of consensus. The effect was to distort perception, making a digitally fabricated campaign appear national in scope.

The November 15 mobilization unfolded in a sequence characteristic of hybrid operations that fuse domestic actors with foreign influence infrastructure. The narrative was seeded digitally through outside bot networks that launched a synthetic Gen Z revolt across social platforms. Domestic billionaires, particularly those with major media holdings, amplified this messaging until it penetrated mainstream coverage. Influencers and micro-celebrities acted as the human facade, giving the operation recognizable faces that concealed its artificial origin. PRI and PAN supplied the actual bodies on the ground, mobilizing older loyalists who provided the physical presence needed for cameras and digital manipulation. Finally, U.S.-aligned influence networks framed the unrest for international audiences as democratic and spontaneous, reinforcing the storyline needed to build policy pressure.

The result was a coordinated political simulation. Digital assets produced the illusion, media power normalized it, influencers performed it, partisan structures embodied it, and foreign policy ecosystems legitimized it.

Digital regime change

The purpose of the November 15 campaign was not limited to a day of protest. It was aimed at political destabilization through perception engineering. The actors behind it sought to weaken Morena’s domestic legitimacy, fracture political cohesion, and reposition Mexico within a U.S.-aligned regulatory and security framework. Their broader objective is to reestablish PRI–PAN influence over state institutions, secure corporate access to strategic sectors such as water, energy, and AI infrastructure, and create the political conditions for deeper external involvement.

This is not conventional regime change. It is regime change pursued through a digital proxy, built from simulations of public unrest, algorithmic manipulation, and coordinated geopolitical messaging.

What Mexico Is Doing to Combat the Operation

Mexico has begun to mount a coordinated response to the November 15 destabilization effort, combining digital investigation, institutional containment, and strategic communication to prevent a synthetic narrative from shaping political reality. The government’s first priority has been digital forensics. Teams within Infodemia and associated federal cyber units are analyzing the 8 million bot accounts identified by President Sheinbaum, tracing their activity across IP clusters, examining synchronized posting patterns, and identifying their foreign origin points. This work is intended to expose the artificial nature of the online revolt and to gather evidence for public and diplomatic use. By revealing the presence of external digital interference, Mexico is attempting to discredit the narrative foundation of the mobilization before it can become entrenched.

At the same time, federal authorities have acted to prevent the protest from escalating into a physical confrontation that could be leveraged online for dramatic effect. Security forces secured the National Palace and controlled access points around sensitive government buildings, reducing the likelihood of clashes that could be used as propaganda by the operation’s orchestrators. This approach reflects an understanding that hybrid destabilization campaigns rely heavily on symbolic imagery and televised confrontation, and that denying these visuals can neutralize much of their intended impact.

Mexico’s institutional response has also focused on controlling the spread of disinformation. Infodemia and allied agencies have intensified monitoring of media narratives, identifying coordinated talking points and publicly revealing patterns of manipulation. These agencies have begun naming domestic political elites and media owners responsible for amplifying fabricated stories, shifting the conversation from anonymous digital chaos to identifiable human actors with political motives. This is a deliberate strategy to erode the movement’s perceived legitimacy by showing who benefits from its existence.

Alongside digital and media countermeasures, the government has begun building a diplomatic record of foreign interference. Although much of this work is not yet public, officials have signaled that evidence of bot farms, foreign-run amplification networks, and diaspora-linked agitation will be raised directly with international partners and platforms. This approach seeks to deter future operations by establishing that Mexico is documenting interference in real time and is prepared to escalate the issue if necessary.

Mexico’s response also includes a strategic narrative component. Senior officials, including President Sheinbaum, have framed the events not as a spontaneous uprising but as a coordinated attempt by domestic elites and foreign actors to manipulate public sentiment. By defining the narrative early and consistently, the government is attempting to preempt opposition networks’ claims to moral or democratic legitimacy. This narrative defense is as central as the technical measures because hybrid destabilization campaigns rely on controlling the interpretive frame through which the public understands political events.

Finally, the government has begun tightening regulatory and institutional frameworks that historically allowed elite networks and foreign actors to exert disproportionate influence over Mexico’s political environment. This includes closer oversight of foreign investment in strategic sectors, stricter rules on digital political advertising, and broader scrutiny of organizations whose funding structures intersect with foreign policy agendas. These reforms are intended to close the structural openings that made a synthetic movement possible in the first place.

Taken together, Mexico’s actions reflect a shift from reactive crisis management to a more strategic posture aimed at preventing digital simulations and cross-border political operations from shaping national decision-making. The government is not simply responding to a single protest but is working to reinforce the informational, institutional, and political defenses necessary to safeguard the country from future attempts at externally assisted destabilization.

To prevent future destabilization efforts, Mexico must reinforce its response to cartel violence and address the structural conditions that allowed hostile networks to weaponize public frustration. This requires strengthening federal and state coordination against organized crime, improving intelligence collection across municipal jurisdictions, and expanding oversight of financial and logistical supply chains that enable cartel operations. It also requires transparent public communication, clearer reporting on security outcomes, and visible accountability measures against officials and corporatists who enable criminal infiltration. By tightening institutional controls, responding rapidly to community-level insecurity, and engaging the public through direct, credible information channels, the government can reduce the vulnerability of legitimate grievances to external manipulation and diminish the risk of future incitement to insurrection in hybrid warfare.

• AFP Factual. 2025. “Imágenes falsas o manipuladas asociadas a protestas en México.” AFP Factual, November 2025.
• Animal Político. 2025. “Videos manipulados y contenido reciclado circularon durante la protesta del 15 de noviembre.” Animal Político, November 2025.
• Associated Press. 2025. “Mexican Authorities Identify Foreign Botnet Activity Around Anti-Government Protests.” AP News, November 2025.
• BBC Monitoring. 2025. “Manipulated protest clips circulated during Mexico unrest.” BBC Monitoring, November 2025.
• Comisión Nacional de Búsqueda (CNB). 2024–2025. Registro Nacional de Personas Desaparecidas y No Localizadas. Mexico City: CNB.
• DFRLab (Digital Forensics Research Lab). 2025. “Coordinated Posting Behavior in Mexico’s November Digital Mobilization.” Atlantic Council.
• DFRLab (Digital Forensics Research Lab). 2021–2024. Regional Influence Operations in Latin America. Washington, DC: Atlantic Council.
• El Financiero. 2025. “Tribunal ordena pago definitivo de impuestos a Elektra.” El Financiero, June 2025.
• El País. 2023. “Cómo operaba la red de protección del Cártel de Sinaloa según el juicio de García Luna.” El País, February 2023.
• El País. 2025. “Una red de cuentas automatizadas impulsó las protestas del 15 de noviembre, según análisis técnico oficial.” El País, November 2025.
• El País. 2025. “Gobierno de México pide explicaciones a EE.UU. por ingreso de familiares del Cártel de Sinaloa.” El País, February 2025.
• El Universal. 2025. “Participantes en la marcha del 15 de noviembre eran mayormente estructuras PRI–PAN.” El Universal, November 2025.
• El Universal. 2025. “Aumentan hallazgos de fosas clandestinas en 2025.” El Universal, January 2025.
• Excélsior. 2025. “Gobierno suspende 13 casinos por posibles vínculos con lavado.” Excélsior, May 2025.
• Gobierno de México. 2025. Plan de Respuesta Institucional a Interferencia Digital. Mexico City: Federal Government of Mexico.
• Gobierno de México. 2025. Conferencia Matutina, statements by President Claudia Sheinbaum regarding botnets and foreign-linked accounts. Mexico City: Federal Government of Mexico.
• ICIJ (International Consortium of Investigative Journalists). 2012. NarcoFiles: The Global Drug War. Washington, DC: ICIJ.
• INEGI. 2024. Encuesta Nacional de Victimización y Percepción sobre Seguridad Pública (ENVIPE). Mexico City: INEGI.
• Intelligence Online. 2020–2024. Reports on Black Cube’s corporate clients and activity in Mexico and the United States. Intelligence Online.
• La Jornada. 2025. “Marcha del Ángel al Zócalo: mayoría de asistentes no coincide con la narrativa de ‘Generación Z’.” La Jornada, November 2025.
• La Jornada. 2025. “Gobierno refuerza perímetro del Palacio Nacional ante posible operación de provocación.” La Jornada, November 2025.
• Milenio. 2025. “Reportan disturbios en Guadalajara, Monterrey y Puebla durante movilizaciones del 15 de noviembre.” Milenio, November 2025.
• New York Times. 2023. “Genaro García Luna Took Millions in Bribes From the Sinaloa Cartel, Jury Finds.” New York Times, February 2023.
• Oxford Internet Institute. 2022. Industrialized Disinformation: Global Assessment of Digital Influence Operations. Oxford: Oxford University.
• Proceso. 2023. “Hallazgos del juicio de García Luna y protección al Cártel de Sinaloa.” Proceso, February 2023.
• Proceso. 2025. “Los 63 mil millones de pesos reclamados por el SAT a Grupo Salinas.” Proceso, April 2025.
• Proceso. 2025. “Más fosas clandestinas descubiertas en 2025.” Proceso, January 2025.
• ProPublica. 2020–2023. Series on DEA cooperation and Sinaloa Cartel intelligence exchanges. New York: ProPublica.
• Reforma. 2025. “Enfrentamientos en el Zócalo dejan 100 policías heridos y 20 detenidos, confirma SSC.” Reforma, November 2025.
• Reuters. 2025. “Fact Check: Videos Shared During Mexico’s November Protests Were From Unrelated Events.” Reuters, November 2025.
• Reuters. 2025. “Mexico Seeks Clarification From Trump Administration Over Sinaloa Family Entries.” Reuters, February 2025.
• SAT (Servicio de Administración Tributaria). 2023–2025. Resoluciones y litigios fiscales de Grupo Salinas y Elektra. Mexico City: SAT.
• SCJN (Suprema Corte de Justicia de la Nación). 2025. “Sentencia definitiva contra Grupo Elektra por adeudos fiscales.” Mexico City: SCJN.
• Secretariado Ejecutivo del Sistema Nacional de Seguridad Pública (SESNSP). 2024–2025. Incidencia Delictiva Nacional. Mexico City: SESNSP.
• Stanford Internet Observatory. 2023. “Diaspora-Based Political Amplification Campaigns in the Americas.” Stanford University.
• U.S. Department of Justice. 2023. United States v. Genaro García Luna. Eastern District of New York, trial records.
• U.S. Department of State. 2005. Mexico–U.S. Narcotics Cooperation., FOIA-released cables. Washington, DC.
• UNODC (United Nations Office on Drugs and Crime). 2023. Global Homicide Study. Vienna: UNODC.
• Washington Post. 2017. “Foreign-Linked Companies Among Donors to Trump’s Inauguration.” Washington Post, April 2017.
• Wilson Center, Mexico Institute. 2018–2024. Public programs and publications on Mexican opposition networks and civil society. Washington, DC: Wilson Center.
• Zambada Niebla Case Files. 2011. United States v. Vicente Zambada Niebla, U.S. District Court filings.