Security Weekly: Dissecting a Mexican Cartel Bombing in Monterrey October 27, 2011

Early Oct. 20, a small sedan apparently filled with cartel gunmen rapidly pulled in front of a military vehicle, drawing the military patrol into a car chase in downtown Monterrey, Mexico. After a brief pursuit, the vehicle carrying the cartel gunmen turned at an intersection. As the military vehicle slowed to negotiate the turn, an improvised explosive device (IED) concealed in a parked car at the intersection detonated. The incident appears to have been intended to lure the military patrol into a designated attack zone. While the ambush did not kill any soldiers, it did cause them to break off their chase.

Though this IED ambush is interesting in itself for a number of reasons, we would like to use it as a lens to explore a deeper topic, namely, how STRATFOR analyzes a tactical incident like this.

Why We Look at an Incident

Hundreds of violent incidents take place every day worldwide, from fuel depot explosions in Sirte, Libya, to shootings in southern Thailand to grenade attacks in Nairobi, Kenya — just a few of the things that happened on a single day this week. Indeed, a typical day sees dozens of incidents in Mexico alone, from shootings and beheadings to kidnappings and cargo theft. Unless one has a method to triage such incidents, they quickly can overwhelm an analyst, dragging him or her down into the weeds struggling to understand the tactical details of every one. This can result in information overload. The details of so many incidents simply overwhelm the analyst’s ability to understand them and place them in a context that allows them to be compared to, and perhaps linked with, other incidents.

STRATFOR’s methodology for placing items in context begins with our interrelated array of net assessments and forecasts. Net assessments are high-level overviews of the significant issues driving the current behavior of nations, regions and other significant international actors. Forecasts can be drawn from these baseline assessments to predict how these actors will behave, and how that behavior will impact regional dynamics. In this way, net assessments and forecasts provide a strategic framework of understanding that can be used to help create assessments and forecasts for tactical-level items.

In the case of Mexico, we have long considered the country’s criminal cartels significant tactical-level actors, and we have established an analytical framework for understanding them. We publish this framework in the form of our annual cartel report. The higher-level framework generally shapes such tactical-level analyses, but at times the analyses can also contradict and challenge the higher-level assessments. We also maintain a regular flow of tactical analyses such as the weekly Mexico Security Memo, which serves to explain how events in Mexico fit into our analytical framework. The items we select as bullets for the second section of the Mexico Security Memo are significant and further the analytical narrative of what is happening in Mexico but do not require deeper analysis. This helps our readers cut through the clutter of the reporting from Mexico by focusing on what we find important. We also strive to eliminate the bias so prevalent in today’s media landscape. Our readers frequently tell us they find this analytical winnowing process quite valuable.

Based upon this tactical framework, we then establish intelligence guidance. This lays out tripwire events that our analysts, regional open-source monitoring team and even our on-the-ground sources are to watch for that either support or refute our forecast. (In STRATFOR’s corporate culture, challenging an assessment or forecast is one of the most important things an employee can do. This ensures we stay intellectually honest and on target. There is nothing more analytically damaging than an analyst who falls in love with his own assessment, or a team of analysts who buy into groupthink.)

When an event, or a combination of events, occurs that does not fit the analytical framework, the framework must undergo a rigorous review to ensure it remains valid. If the framework is found to be flawed, we determine if it needs to be adjusted or scrapped. Due to the rapid shifts we have seen on the ground in Mexico in the past two years in terms of arrests and deaths of major cartel leaders and the emergence of factional infighting and even new cartel groups, we have found it necessary to adjust our framework cartel report more than just annually. In 2011, for example, we have felt compelled to update the framework quarterly.

And this brings us back to our IED attack in Monterrey. When we learn of such an event, we immediately apply our analytical framework to it in an effort to determine if and how it fits. In this case, we have certainly seen previous IED attacks in Mexico and even grenade attacks in Monterrey, but not an IED attack in Monterrey, so this is clearly a geographic anomaly. While we don’t really have a new capability, or a new actor — Los Zetas were implicated in a command-detonated IED attack in January in Tula, Hidalgo state — we do have a new location in Monterrey. We also have a new tactic in using a vehicle chase to lure a military vehicle into an IED ambush. Past IED ambushes in Juarez and Tula have involved leaving a cadaver in a vehicle and reporting it to the authorities.

Some early reports of the Monterrey incident also indicated that the attack involved a vehicle-borne improvised explosive device (VBIED). If true, this would contradict our assessment that the Mexican cartels have refrained from employing large IEDs in their attacks.

Also, according to our analytical framework and the intelligence guidance we have established, Monterrey is a critical Zeta stronghold. We already have asked our tactical analysts to keep a close eye on activity there and the patterns and trends represented by that activity for indications that Los Zetas might be losing control of the city or that other cartels are establishing control there.

Because of all these factors, the Monterrey attack clearly demanded close examination.

How We Look at an Incident

Once we decide to dig into an incident and rip it apart analytically, we task our analysts and regional open-source monitors to find everything they can about the incident. At the same time, we reach out to our network of contacts to see what they can tell us. If we have employees in the city or region we will rely heavily on them, but when we do not, we contact all the relevant sources we have in an area. Depending on the location, we will also talk to our contacts in relevant foreign governments with an interest in the incident. Of course, like open-source reports, information we receive from contacts must be carefully vetted for bias and factual accuracy.

As information begins to flow in following an incident, there are almost always conflicting reports that must be reconciled. In the Monterrey case, we had reports from sources such as the Mexican newspaper El Universal saying the IED had been hidden in a vehicle parked beside the road, while The Associated Press ran a story noting that the car being pursued exploded. In some cases, news stories can even seemingly contradict themselves. In the above-mentioned AP story, the author noted that the vehicle containing the IED almost completely disintegrated, but then added that the bombing caused no other damage. It is rare that an IED large enough to disintegrate a car would cause no other damage. We have found that most journalists do not have much experience dealing with explosives or IEDs, as their reporting often reflects.

Photo courtesy of El Universal

Scene of the Oct. 20 improvised explosive device ambush in Monterrey
Such conflicting accounts highlight the importance of photographs and video when analyzing an attack. Photos and videos are no substitute for investigating the scene firsthand, but traveling to a crime scene takes time and money. Moreover, gaining the kind of crime scene access STRATFOR employees enjoyed when they worked for a government is tough. That said, an incredible amount of information can be gleaned from some decent photos and videos of a crime scene.

In the Monterrey attack, the first thing the photos and video showed us is that the vehicle containing the explosive device had not completely disintegrated. In fact, the chassis of the vehicle was mostly intact. It also appeared that the fire that followed the explosion rather than the explosion itself caused much of the damage to the vehicle. The explosive damage done to the vehicle indicated that the main charge of the IED was relatively small, most likely less than 5 pounds of military-grade high explosive. Some media reports said a fragmentation grenade thrown from the vehicle being pursued caused the explosion, but the damage to the car appeared quite a bit greater than would be expected from a hand grenade. Also, no apparent fragmentation pattern consistent with what a grenade would cause was visible in the metal of the car or on the smooth, painted walls of the auto repair shop the car had been parked near.

The lack of fragmentation damage also made it apparent that the bombmaker had not added shrapnel such as ball bearings, nails or nuts and bolts to enhance the device’s destructiveness. Also, while the repair shop’s garage door did have a hole punched through it, the hole appears to have resulted from part of the car having been propelled through it. The door does not display any significant damage or disfiguration from the blast effect. The painted walls do not either, though they do show some signs from the high heat of the explosion and resulting vehicle fire. This is another indication that the blast was fairly small. Finally, that the bulk of the significant damage to the car is in the rear end of the vehicle makes it appear that the small IED had been placed either in the vehicle’s trunk or perhaps on the vehicle’s backseat.

After analyzing such photos and video, our tactical analysts contact other experienced blast investigators and bomb technicians to get their impressions and ensure that their analysis is not off track. Like doctors, investigators frequently chat with other knowledgeable investigators to confirm their diagnoses.

Of course, the process described above is how things happen in an ideal situation. Frequently, reality intrudes on the ideal and the process can get quite messy— especially in the middle of a large ongoing situation like the 2008 Mumbai attacks. Taming the chaos that tends to reign during such a situation is difficult, and we sometimes have to skip or repeat steps of the process depending on the circumstances. We run a postmortem critique after each of these crisis events to determine what we did well and what we need to do better as we strive for excellence.

Piecing It All Together

When we looked at all the pieces of the Monterrey incident, we were able to determine that due to the location and execution of the incident, Los Zetas most likely were behind the attack. It was also clear that the device was a well-constructed, command-detonated IED and that the Mexican troops were drawn into a carefully executed ambush. From the size and construction of the device, however, it would appear the operational planner of the ambush did not intend to kill the soldiers. Had that been the objective, more explosives would have been used in the IED. (Commercial explosives are cheap and plentiful in Mexico.) Alternatively, the same smaller quantity of explosives could have been fashioned into an improvised claymore mine-type device intended to hurl shrapnel at the military patrol — something likely well within the skill set of a bombmaker capable of building and employing an effective command-detonated IED.

The small explosive charge and lack of fragmentation, then, indicates the ambush was intended more to send a message than to cause a massacre. The Mexican cartels have a history of kidnapping, torturing, and murdering Mexican military personnel, so they normally are not squeamish about killing them. This brings us back to our analysis regarding the cartels’ use of IEDs, and our conclusion that the Mexican cartels have intentionally chosen to limit the size of explosive devices they employ in Mexico.

This incident may also be consistent with our analysis that Los Zetas are feeling pressured by the increased military presence in Mexico’s northeast. The message this incident may have been intended to convey is that the military needs to back off. At the very least, at the very lowest tactical level, it will certainly give the Mexican military second thoughts the next time they consider pursuing apparent cartel vehicles in Zeta territory.

Dissecting a Mexican Cartel Bombing in Monterrey is republished with permission of STRATFOR.