OSINT, Wiretaps and Encrypted Apps: How El Chapo Fell (and How OSINT Would Catch Him Today)

Wiretaps can tell us what drug criminals say. OSINT Industries exposes who’s really doing the talking.

Brooklyn, 2019: the trial of Joaquín “El Chapo” Guzmán. Occurring just before encrypted apps and identity-based OSINT took off, US prosecutors were facing the world’s most slippery drug trafficker at a pivotal moment.

Guzmán had always been careful to physically insulate himself from the inner workings of the Sinaloa Cartel. He rarely handled his own product or counted his own money. Still, his organisation couldn’t function without constant communication between those at the top and an army of logistics managers, financiers, couriers and security chiefs. It didn’t matter that  the paranoid Guzmán was rarely chatting on the phone himself, using dozens of burners in rotation. U.S. and Mexican police had obtained court orders to tap the cells and landlines of everybody else; or at least, specific subjects senior in ‘La Federacion’. 

These wiretaps were prosecution lawyers’ best hope. This trial would be about listening patiently as a cartel spoke to itself. 

“Mr Guzman told me to always be very careful because the American government could be listening to our conversations.” – A government witness to the El Chapo trial at Brooklyn Federal Court. [Source: news.au]

Recorded voices of international drug traffickers and their accomplices filled the courtroom. Nobody said ‘heroin’ or ‘methamphetamine’. Their code words - “tickets,” “shirts”, “wine” - were translated by DEA agents to demonstrate how “preparing food for delivery” ended in the seizure of hundreds of kilograms of pure cocaine. Written transcripts provided to jurors laid out suspects coordinating shipments of hard drugs in near-unbelievable quantities from Colombia through Mexico to an arranged border crossing for the United States. 

Discussions about prices, purity, delivery times. Quantities priced by kilo from dozens to hundreds. Deadlines for movement due to law enforcement pressure or rival cartel hits.

Prosecutors matched these conversations to concrete evidence like financial records and physical seizures, following a tried-and-tested structure: “see them plan it, watch it happen”. Soon, the court reverberated with the rare nasally Sinaloan tones of the big man himself,  haggling guerillas down from $2,100 to $2,000 per-kilo of cocaine. Jurors heard El Chapo arrange for the drugs to be shipped to an Ecuadorian warehouse with the help of corrupt army officers in Guayaquil. They also heard him ask his girlfriend for a new pair of pants (size 32/30), shoes (Mexican size 7) and black mustache dye.

The great irony being, El Chapo himself was a fervent phone-tapper. Guzman surveilled his 50 closest compadres with a near-compulsive listening habit: “el señor need[ed] his fix.”

“El Chapo told [me] to say, if asked, that he was listening to music. What he was doing was listening to phone calls…” – Cristian Rodriguez, FBI informant and former Sinaloa Cartel tech support. [Source: LATimes]

Guzmán’s symbolic role, the myth of El Chapo, crumbled under his own words. Wire data destroyed the argument that the boss was a hands-off manager. Call charts built timelines and patterning consistent with a more active role in an empire of slaughter that smuggled more drugs into the U.S. than any other organisation in history. It’s increasingly difficult to argue yourself as a figurehead when intercepted conversations show your rage when product was lost or couriers failed; when jurors hear your voice making decisions about risk and timing, or dealing out violence at arm’s length.

By the time closing arguments began, jurors had spent weeks hearing the Sinaloa Cartel talk. Guzmán was found guilty on all major counts, and currently enjoys life plus 30 in ADX Florence, the highest-security federal prison in the U.S. 

“Guzman Loera’s bloody reign atop the Sinaloa Cartel has come to an end, and the myth that he could not be brought to justice has been laid to rest…” – Former East District New York United States Attorney Richard Donoghue. [Source: USAO EDNY]

The El Chapo case was built by listening and connecting. It marked the end of the ‘kingpin’ fantasy, but also the end of the wiretap-first era: the last stand before platform-heavy, encryption-centric OSINT-friendly crime. If the Sinaloa Cartel got started just a few years later, nobody would be making landline calls. Communication would take place on EncroChat, Sky ECC or ANOM (Operation Trojan Shield); at least on Signal and Telegram, in short-lived groups with disappearing messages and sneakier device-churn schemes than El Chapo’s simple rotating burners. 

Yet, EncroChat and the like show phone numbers are still the key to cracking a cartel.  A phone number is an identity anchor. No matter how well-obscured, an OSINT-informed wire analyst can enrich a target number on a platform like OSINT Industries, linking it across encrypted apps, crypto exchanges, delivery services, social platforms and burner emails. This metadata alone can delineate hierarchies in a wire case: who creates groups, whose activity spikes before shipments, which accounts persist after known members get taken out.

Wiretaps worked in the El Chapo case because investigators already knew which phones mattered. Getting to this point is faster with OSINT, and now - with encrypted apps holding back a majority of communication data - there’s not even an explicit need to hear what’s said. If you can build a clear network and criminal identity, content becomes secondary. The question in wire cases is no longer just “what are they saying?”. With OSINT Industries, law enforcement can ask “who is saying it, when, where and why, even when we can’t hear them.”

Here’s how OSINT is part of the future for wire cases - and could have (perhaps) sped El Chapo’s course to that Brooklyn courtroom.

Meet Sarah G*, an OSINT-Powered Analyst on Narcotics Wire Cases.

“Sometimes OSINT is the only way I can ID someone.” – Sarah G., Criminal Intelligence Analyst. [Source: OSINT Industries]

Sarah G. is a Criminal Intelligence Analyst for a major state-level agency in a border state. She works on wire cases, including those based around narcotics trafficking. Wiretap work is considered highly intrusive, so it’s usually a last resort, limited in time and scope to only the most major cases. In short, Sarah brings the fight serious organized and international crime.

A certain legal process defines wire cases like those Sarah works on. If police suspect a drug operation is taking place, but they need stronger or better proof, a judge will deliver a tightly-regulated wiretap warrant. If approved, analysts like Sarah can monitor and investigate specific numbers or accounts, taken from “tolls along distribution routes, pen registers and phone dumps” alongside traditional “wire intercepts”. Here, law enforcement look for evidence of drug crimes being arranged. Sarah’s “biggest role… is in identifying phone numbers that our target talks to”. Namely, she works identifying “customers, distributors and sources of supply”: the accomplices, buyers, producers, co-conspirators and cartel compadres that help drugs make their way into America. 

OSINT Industries makes her job easier. OSINT for narcotics investigations can not only help Sarah identify targets, but shift the onus for suspecting a target from content to identity. A phone number search can expose an encrypted Signal account, and an encrypted Signal account a WhatsApp account; then a WhatsApp account reveals a profile picture and a real-life identity. In fact, the reverse can also be done, working backwards to find a well-concealed phone number. From an identity, OSINT Industries can also reveal associates, movements and payments. 

Best of all, when the time comes for court, the defense has less to stand on. They can no longer attack evidence as intrusive when it’s publicly available data. OSINT can establish identity, association, and intent with no intrusion necessary.

Sarah’s agency found out about OSINT Industries when “a coworker met a representative at a conference and shared the tool with all of us”. Now, she’s reached out to share her own successes.

Before the Tap: One Phone Number to a Full OSINT Identity

“OSINT Industries means a lot. It helps me to dive deeper into who these suspects are in their real lives… That’s more than a police report or insurance claim can tell me.” – Sarah G., Criminal Intelligence Analyst. [Source: OSINT Industries]

Certain data is most useful when investigating wire case suspects. The first step is to obtain a number. The second is a phone search on our platform. When Sarah searches a suspected narcotics criminal on OSINT Industries, she looks for the following:

• Messaging apps registered to the number
• Profile photos, usernames, bios
• Social media accounts (especially with identifying or incriminating photos or posts)
• Business listings or delivery accounts
• Forum posts
• Crypto services and wallets
• Payment apps like Zelle or Venmo
• Dating apps or other personal ads

From one number, it’s possible to build a full identity - before anybody gets tapped. Sarah looks when accounts were created and how they change over time. Much like El Chapo’s codes, certain emojis or phrases can indicate the sale or movement of drugs. Has the suspect re-used usernames or images cross-platform? If so, this link could be valuable towards a positive ID or arrest.

Serious players’ use of encrypted platforms like Signal, WhatsApp, Telegram, Wickr, Threema and more makes it unlikely that they’ve talked business in the clear. Still, even if Sarah can’t get the talk about moving methamphetamine (or mustache dye), metadata and identifiers can be enough, particularly when combined with financial or surveillance records. Post-arrest, it’s also possible to unlock devices, and retroactively confirm OSINT findings. 

Sarah described a “months-long” narcotics wiretap investigation in fall of 2024, in which she “leaned heavily on OSINT Industries.” The investigation is too sensitive to describe in detail. However, our platform’s OSINT phone number enrichment was vital in giving investigators confidence about who they were really dealing with. If it were not for OSINT, it would have been far more difficult to secure not only identifications, but arrests of those involved in drug trafficking that takes thousands of American lives a year.

Fifty Phones a Day: How OSINT Streamlines Narcotics Wiretap Cases

Phone numbers are the anchor identity across everything required to run a large-scale drugs operation, from burner phones themselves to payment services. Most social media platforms, now often storefronts for narcotics empires, require a phone number to sign up - or even to recover an account if a forgetful dealer slips up on his password. OSINT and SOCMINT are natural choices to take these digital natives on. Now, Sarah uses OSINT industries in most wire cases, “anytime I have a phone number I am trying to ID, and even for known phone numbers when I’m trying to find social media.”

“Some days on the wiretap, I would have a list of 50 new phones to search every single day. This tool helped to bring together a lot of different searches and streamline things for me.” – Sarah G., Criminal Intelligence Analyst. [Source: OSINT Industries]

Sarah gave an inside look into identifications in wire cases before OSINT: they “took a lot longer”. Accurint was her agency’s previous sole source for identity searches, so analysts were limited to licensed, aggregated, and proprietary data like death records and vehicle registrations. She remembers having to “pull up WhatsApp and Cash App separately on my phone to search numbers”, limited to what she could access through front-end manual searches. Her agency “would never get any Telegram info”, she describes, “since nobody had a way to search it”. 

OSINT Industries collapses hours of manual OSINT searching into a single workflow that exposes the social and messaging ecosystems where drug networks now actually function. That’s what gets drug criminals caught. 

Beyond El Chapo: OSINT and the New Frontlines of Narcotics Enforcement

America’s drug fight has left that Brooklyn courtroom. Looking forward, two new concepts exemplify why OSINT for narcotics investigations will feature in every wire case - and more - from now on.

The first is the narco-influencer. The rise of not only social media drug sales, but processes of recruitment and glamorization via cartel imagery on TikTok, X, and Instagram make SOCMINT a necessity. The glamorised, youth-oriented culture that modern dealers exploit to recruit and normalise their power, blurring the lines between entertainment and terror, means traffickers can unwittingly leave huge footprints. From cartel intelligence to county lines, this is an international shift that only OSINT can address.

The second: narcoterrorism. Last year, the Trump administration designated the Sinaloa Cartel and its factions like Los Chapitos - alongside groups like CJNG, MS-13 and Tren de Aragua - as Foreign Terrorist Organizations under U.S. law. What was once organised crime prosecuted through traditional wiretaps is increasingly framed as a nexus of drug trafficking and terror-like violence that destabilises communities.

The idea of narcoterrorism remains politically charged and legally unsettled, but it changes things for law enforcement regardless. What matters for investigators is not the label, but the cartel intelligence challenge itself; less like the Brooklyn courtroom that listened to El Chapo’s wiretaps and more like a broader national security campaign. A higher-profile crime means more license to tap. What’s more, OSINT for narcotics investigations is now as much a key feature of the modern War on Drugs as the wiretap itself. During the controversial removal of Nicolas Maduro, makeshift Situation Room screens at Mar-A-Lago showed major secretaries gathering intel by searching “osint” on Twitter (X). Perhaps to make a real impact, the War on Narcoterrorism should be taking place online - not on the Caribbean seas.

In Sarah’s wire cases, OSINT and OSINT Industries mean her team can determine which voices matter before a single call is heard, or even without hearing a thing. The real fight has begun long before the audio rolls. As drug operations have evolved from Y2K kingpins like El Chapo, the response has too.

El Chapo was undone by what he said. Tomorrow’s El Chapo will be undone by who they are.