June 6, 2011
Lessons to be Learned from an Ambush in Mexico
By Scott Stewart
afternoon of May 27, a convoy transporting a large number of heavily armed gunmen was ambushed
on Mexican Highway 15 near Ruiz, Nayarit state, on Mexico’s Pacific coast. When authorities responded they found 28 dead
gunmen and another four wounded, one of whom would later die, bringing the death toll to 29. This is a significant number
of dead for one incident, even in Mexico.
to Nayarit state Attorney General Oscar Herrera Lopez, the gunmen ambushed were members of Los Zetas, a Mexican drug cartel.
Herrera noted that most of the victims were from Mexico’s Gulf coast, but there were also some Guatemalans mixed into
the group, including one of the wounded survivors. While Los Zetas are predominately based on the Gulf coast, they have been
working to provide armed support to allied groups, such as the Cartel Pacifico Sur (CPS), a faction of the former Beltran
Leyva Organization that is currently battling the Sinaloa Federation and other cartels for control of the lucrative smuggling
routes along the Pacific coast. In much the same way, Sinaloa is working with the Gulf cartel to go after Los Zetas in Mexico’s
northeast while protecting and expanding its home turf. If the victims in the Ruiz ambush were Zetas, then the Sinaloa Federation
was likely the organization that planned and executed this very successful ambush.
from the scene show that the purported Zetas convoy consisted of several pickup trucks and sport utility vehicles (two of
which were armored). The front right wheel on one of the armored vehicles, a Ford Expedition, had been completely blown off.
With no evidence of a crater in the road indicating that the damage had been caused by a mine or improvised explosive device
(IED), it would appear that the vehicle was struck and disabled by a well-placed shot from something like a rocket-propelled
grenade (RPG) or M72 LAW rocket, both of which have been seen in cartel arsenals. Photos also show at least one heavy-duty
cattle-style truck with an open cargo compartment that appears to have been used as a troop transport. Many of the victims
died in the vehicles they were traveling in, including a large group in the back of the cattle truck, indicating that they
did not have time to react and dismount before being killed.
many other incidents we have examined, such as the ambush by CPS and Los Zetas against a Sinaloa Federation convoy on July
1, 2010, near Tubutama, Sonora state, the vehicles involved in this incident did not appear to bear any markings identifying
them as belonging to any one cartel. In the Tubutama incident, the vehicles were all marked with large, highly visible “X”s
on the front, back and side windows to denote that they were Sinaloa vehicles.
of the victims were wearing matching uniforms (what appear to be the current U.S. Marine Corps camouflage pattern) and black
boots. Many also wore matching black ballistic vests and what appear to be U.S.-style Kevlar helmets painted black. From the
photos, it appears that the victims were carrying a variety of AR-15-variant rifles. Despite the thousands of spent shell
casings recovered from the scene, authorities reportedly found only six rifles and one pistol. This would seem to indicate
that the ambush team swept the site and grabbed most of the weapons that may have been carried by the victims.
may not have been the only things grabbed. A convoy of this size could have been dispatched by Los Zetas and CPS on a military
raid into hostile Sinaloa territory, but there is also a possibility that the gunmen were guarding a significant shipment
of CPS narcotics passing through hostile territory. If that was the case, the reason for the ambush may have been not only
to kill the gunmen but also to steal a large shipment, which would hurt the CPS and could be resold by Sinaloa for a substantial
the objective of the ambush was simply to trap and kill a Zetas military team conducting a raid or to steal a high-value load
of narcotics, a look at this incident from a protective intelligence point of view provides many lessons for security professionals
operating in Mexico and elsewhere.
Lesson One: Size Isn’t Everything
that most of the 29 dead and three wounded gunmen were Zetas, and that most of the 14 vehicles recovered at the scene also
belonged to the convoy that was attacked, it would appear that the group believed it was big enough to travel without being
attacked. But, as the old saying goes, pride goeth before destruction.
environment where drug cartels can mass dozens of gunmen and arm them with powerful weapons like machine guns, .50-caliber
sniper rifles, grenades and RPGs, there is no such thing as a force that is too big to be ambushed. And that is not even accounting
for ambushes involving explosives. As evidenced by events in places like Iraq and Afghanistan, even convoys of heavily armored
military vehicles can be ambushed using large IEDs and smaller, sophisticated explosive devices like explosively formed projectiles.
are people in both the private and public sectors who cling to the erroneous assumption that the mere presence of armed bodyguards
provides absolute security. But this is simply not true, and such a misconception often proves deadly. Indeed, there are very
few protective details in all of Mexico that employ more than two dozen agents for a motorcade movement — most are smaller
and less well-equipped than the Zetas force that was destroyed May 27. Most protective details do not wear heavy raid vests
and Kevlar helmets. This means that government and private-sector protective details in Mexico cannot depend on their size
alone to protect them from attack — especially if the attackers are given free rein to conduct surveillance and plan
environment where the threat is so acute, security managers must rely on more than just big men carrying guns. The real counter to such a threat is a protective detail that practices a heightened state of situational awareness and employs a robust surveillance-detection/countersurveillance program coupled with careful route and schedule analysis.
many people, including police and executive protection personnel, either lack or fail to employ good observation skills. These
skills are every bit as important as marksmanship (if not more) but are rarely taught or put into practice. Additionally,
even if a protection agent observes something unusual, in many cases there is no system in place to record these observations
and no efficient way to communicate them or to compare them to the observations of others. There is often no process to investigate
such observations in an attempt to determine if they are indicators of something sinister.
to provide effective security in such a high-threat environment, routes and traveling times must be varied, surveillance must
be looked for and those conducting surveillance must not be afforded the opportunity to operate at will. In many cases it
is also far more prudent to maintain a low profile and fade into the background rather than utilize a high-profile protective
detail that screams “I have money.” Suspicious events must be catalogued and investigated. Emphasis must also
be placed on attack recognition and driver training to provide every possibility of spotting a pending attack and avoiding
it before it can be successfully launched. Proper training also includes immediate action drills in the event of an attack and practicing what to do in the event of an ambush.
is always faster than reaction. And even a highly skilled protection team can be defeated if the attacker gains the tactical
element of surprise — especially if coupled with overwhelming firepower. If assailants are able to freely conduct surveillance
and plan an attack, they can look for and exploit vulnerabilities, and this leads us to lesson two.
Lesson Two: Armored Vehicles Are Vulnerable
Armored vehicles are no guarantee of protection in and of themselves. In fact, like the presence of armed bodyguards, the use of armored vehicles can actually lead to a false
sense of security if those using them do not employ the other measures noted above.
are given the opportunity to thoroughly assess the protective security program, they will plan ways to defeat the security
measures in place, such as the use of an armored vehicle. If they choose to attack a heavy target like the Los Zetas convoy,
they will do so with adequate resources to overcome those security measures. If there are protective agents, the attackers
will plan to neutralize them first. If there is an armored vehicle, they will find ways to defeat the armor — something
easily accomplished with the RPGs, LAW rockets and .50-caliber weapons found in the arsenals of Mexican cartels. The photographs
and video of the armored Ford Excursion that was disabled by having its front right wheel blown off in the Ruiz ambush remind
us of this. Even the run-flat tires installed on many armored vehicles will not do much good if the entire wheel has been
blown off by an anti-tank weapon.
vehicles are designed to protect occupants from an initial attack and to give them a chance to escape from the attack zone.
It is important to remember that even the heaviest armored vehicles on the market do not provide a mobile safe-haven in which
one can merely sit at the attack site and wait out an attack. If assailants know their target is using an armored vehicle,
they will bring sufficient firepower to bear to achieve their goals. This means that if the driver freezes or allows his vehicle
to somehow get trapped and does not “get off the X,” as the attack site is known in the protection business, the assailants can essentially do whatever
also important to recognize that high-profile armored vehicles are valued by the cartels, and the types of vehicles usually
armored generally tend to be the types of vehicles the cartels target for theft. This means that the vehicle you are riding
in can make you a target for criminals.
armored vehicles are valuable additions to the security toolbox, their utility is greatly reduced if they are not being operated
by a properly trained driver. Good tactical driving skills, heightened situational awareness and attack recognition are the
elements that permit a driver to get the vehicle off the X and to safety.
Lesson Three: Protect Your Schedule
for an organization as large and sophisticated as the Sinaloa Federation, planning and executing an operation like the Ruiz
ambush took considerable time and thought. An ambush site needed to be selected and gunmen needed to be identified, assembled,
armed, briefed and placed into position. Planning that type of major military operation also requires good, actionable intelligence.
The planner needed to know the size of the Zetas convoy, the types of vehicles it had and its route and time of travel.
fact that Los Zetas felt comfortable running that large a convoy in broad daylight demonstrates that they might have taken
some precautionary measures, such as deploying scouts ahead of the convoy to spot checkpoints being maintained by Mexican
authorities or a competing cartel. It is highly likely that they consulted with their compromised Mexican government sources
in the area to make sure that they had the latest intelligence about the deployment of government forces along the route.
the route of the Zetas convoy must have been betrayed in some way. This could have been due to a pattern they had established
and maintained for such convoys, or perhaps even a human source inside the CPS, Los Zetas or the Mexican government. There
was also an unconfirmed media report that Los Zetas may have had a base camp near the area where the ambush occurred. If that
is true, and if the Sinaloa Federation learned the location of the camp, they could have planned the ambush accordingly —
just as criminals can use the known location of a target’s home or office to plan an attack.
assailant has a protectee’s schedule, it not only helps in planning an attack but it also greatly reduces the need of
the assailant to conduct surveillance — and potentially expose himself to detection. For security managers, this is
a reminder not only that routes and times must be varied but that schedules must be carefully protected from compromise.
the Ruiz ambush involved cartel-on-cartel violence, security managers in the private and public sectors would be well-served
to heed the lessons outlined above to help protect their personnel who find themselves in the middle of Mexico’s cartel
"Protective Intelligence Lessons from an Ambush in Mexico," by Scott Stewart, Jun. 2, 2011 is republished with permission of STRATFOR.