Seu Jorge is a community leader from Campo Iracema, a gang-controlled neighbourhood in the urban periphery of Fortaleza (Brazil).Footnote 1 He feels surveilled. During the time I spent volunteering with his social project, he made it clear that I was to be careful with my digital footprint—from my social media to the contents of my smartphone. The members of the local facção criminosa (criminal faction) were certainly paying attention, he emphasized:
You’ve definitely been surveilled while being here. For sure they have managed to look into your social media to figure out who you are. You can be certain they are watching.… Me, I am very careful. If someone shares anything that could be related to crime, something suspicious … I just delete it. I even take lots of precautions when adding someone from a community controlled by a rival faction [to Whatsapp or social media]. …You need to watch your back, because you never know if one day they will inspect your smartphoneFootnote 2
Far from being paranoid, Seu Jorge was not alone in being fearful. During the 13 months I spent conducting fieldwork in the urban periphery of Fortaleza, participants expressed similar concerns: digitally networked information has become a key element in the enforcement of rules of territorial belonging by the armed actors controlling the city’s margins. Both the criminal factions and the Polícia Militar (PM) used similar digitally mediated strategies, such as intelligence-sharing Whatsapp networks, to regulate territorial access and permanency in gang-controlled neighborhoods in the urban periphery of Fortaleza. As a young man living in an area adjacent to Campo Iracema explained,Footnote 3
Both police and the criminal factions may take a photo of you [and circulate the image in their Whatsapp groups], depending on how suspicious they are. Say someone committed a robbery nearby and you fit a certain profile [Black, young, tattoos…]—the police may approach you, take a photo, and share it to determine if you’re involved. The criminal factions do exactly the same thing! It has already happened here: someone came from another area also controlled by the Comando Vermelho, and when he arrived, the local faction members interrogated him about his reasons for being here. Then they photographed him and shared it in their groups to find out more about him. You see? It’s the exact same logic. I myself have been photographed both by the police and by the criminal factions, several times!
In this article, I argue that digital media are instrumental to how armed actors access intelligence in contested urban environments and, in turn, control territory. Since the 1990s, Latin America has suffered an intense wave of armed violence characterized by increasing homicide rates in socially disadvantaged urban areas (Davis Reference Davis2009). Scholars attribute this situation to growing territorial competition among criminal groups for the control of illicit markets (Yashar Reference Yashar2018), compounded by the militarization of police forces and their transformation into “engage-and-destroy” actors (Flores-Macías and Zarkin Reference Flores-Macías and Zarkin2021). This has given rise to clusters of “hybrid order” in urban peripheries across the region—areas in which authority is de facto divided and (often violently) negotiated between state and nonstate armed actors (Cruz Reference Cruz2022; Dewey, Míguez, and Saín Reference Dewey, Míguez and Saín2017). At the heart of that negotiation lies the capacity of criminal groups to control territory while “surrounded and intermittently penetrated by strong state power” (Lessing Reference Lessing2021, 855). Understanding the mechanisms of territorial control in such contexts is therefore key to theorizing armed violence and unpacking the current wave of conflict in the region.
Although existing research recognizes the importance of information gathering for armed actors in hybrid orders (Barnes Reference Barnes2022; Reference Barnes2025), the mechanisms that facilitate this practice remain unexplored. The literature instead draws on Kalyvas’s (Reference Kalyvas2006) seminal work on collaboration during civil war, which posits that personal denunciation is the primary method available to armed actors for extracting information. For Kalyvas (175), “consensual provision”—that is, the use of informers—is more effective than other strategies such as relying for information on so-called material indices (photographs, captured documents, etc.), which require “high levels of technical sophistication to obtain” and are “difficult to interpret.” I bring media sociology into the conversation, arguing that the digitization of armed actors’ informational environments requires a reevaluation of how material indices contribute to territorial consolidation within contested urban spaces.
The distinct opportunities enabled by digital platforms have been explored by media scholars through the concept of “affordances”; that is, the “possibilities for action” perceived by users in digital environments (Evans et al. Reference Evans, Pearce, Vitak and Treem2017, 36). Features such as discovering new information through queries (searchability) and rapidly sharing it to hundreds of users (replicability) are enabled by digital media affordances. I illustrate in this article how armed actors identify and exploit these affordances to gather essential strategic information for territorial control.
I advance my argument toward theory building by using a comparative ethnographic design (Simmons and Rush-Smith Reference Simmons and Smith2019), leveraging within-case variation across the digital information-gathering practices used by armed actors in contested marginalized communities of the urban periphery of Fortaleza. The analysis is based on a total of 15 months of qualitative fieldwork conducted between 2023 and 2025 in northeastern Brazil, including ethnographic observation in areas under hybrid order, 81 semi-structured interviews, netnographic observation of relevant digital channels, and digital open-source research techniques.
I found that both criminal factions and militarized police use three digitally mediated intelligence-gathering practices to control the urban periphery. First, armed actors conduct forced smartphone inspections, a practice that exploits the persistence of digital communication. Because data, such as text, images, and audio, are automatically stored on the device, smartphones are identification tools to assess territorial risk. Second, they articulate information-sharing networks via messaging apps. This practice leverages the replicability of digital content to facilitate territorial surveillance and real-time threat identification. Lastly, actors strategically monitor social media profiles, leveraging the searchability and visibility of digital content to identify enemy collaborators and exploit rival vulnerabilities.
The findings suggest a digitally networked approach to territorial control, in which access to networked digital information shapes how armed groups enforce rules governing who belongs within controlled communities. Following Jessop, Brenner, and Jones (Reference Jessop, Brenner and Jones2008, 396), digital networks become an “ordering principle” of territory. When compared with previous analog information-gathering practices deployed by armed actors in Fortaleza, this approach introduces effectiveness, flexibility, and efficiency gains in territorial control. The increased availability of personal information, paired with digital affordances such as visibility, replicability, and searchability, enables more effective and efficient discovery of territorial threats. Simultaneously, the use of many-to-many, multimodal, and real-time forms of communication through messaging apps allows for the efficient dissemination of security updates and more flexible territorial articulation. Beyond the specific case examined in the article, the findings suggest that structural transformations in information flows during the digital era fundamentally shape how armed actors access key information needed to identify and respond effectively to physical territorial threats.
The article is organized as follows. The next section presents the theoretical framework, connecting literature on hybrid order, civil wars, and media sociology. Then I address methodology, outlining the comparative ethnographic design, detailing data sources, and discussing practical and ethical considerations. The following section sets the context by providing details on the actors disputing territory in my field site and their drivers. Empirical material, outlining three digitally mediated information-gathering practices, is provided next. I then discuss the implications and limitations of my findings, emphasizing how such practices contribute to territorial control and introduce effectiveness, efficiency, and flexibility gains as compared to previously used analog methods. I conclude by describing the article’s contributions.
Theoretical Framework
Hybrid Order, Territorial Control, and the Role of Intelligence Gathering
The contested nature of local authority in marginalized urban communities across Latin America has become a central concern for political scientists (Barnes Reference Barnes2025; Duran-Martinez Reference Duran-Martinez2018; Lessing Reference Lessing2017; Trejo and Ley Reference Trejo and Ley2020). Scholars have described these environments as hybrid orders, areas where authority is de facto divided and (often violently) negotiated between state and nonstate armed actors (Cruz Reference Cruz2022; Dewey, Míguez, and Saín Reference Dewey, Míguez and Saín2017; Sanchez and Cruz Reference Sanchez and Cruz2024).Footnote 4 At the center of this issue are the capacity of criminal groups to exert territorial control in the urban margins and the state’s insistence on militarized intervention to regain dominion (Flores-Macías and Zarkin Reference Flores-Macías and Zarkin2021; Magaloni, Franco-Vivanco, and Melo Reference Magaloni, Franco-Vivanco and Melo2020).
The concept of territorial control has been primarily developed within civil wars scholarship (Rubin and Stewart Reference Rubin and Stewart2022), but it assumes different contours in hybrid orders. Crucially, armed actors in such settings—both criminal groups and militarized police forces—do not dispute territory to establish “exclusive [political] rule” (Kalyvas Reference Kalyvas2006, 111): they have different aims. For criminal groups, controlling urban peripheries serves an economic imperative: even though personal and symbolic ties to communities matter, the groups’ primary driver is the exploitation of localized illicit economies from drug trafficking to extortion (Arias Reference Arias2017, 20; Fontes Reference Fontes2016).
Similarly, militarized police interventions in marginalized urban communities are driven by factors other than consolidating political rule. Although police crackdowns are typically framed as means of enforcing state authority, they are remarkably unsuccessful in doing so (Barnes Reference Barnes2022; Flores Macías Reference Flores-Macías2018). Scholars attribute the prevalence of this policy among Latin American governments to the fact that it serves goals other than gaining sovereignty in the urban margins. Police interventions can enforce institutionalized discrimination against oppressed communities (Alves Reference Alves2018); provide opportunities for illicit enrichment among state agents (Auyero and Sobering Reference Auyero and Sobering2019; Sanchez and Cruz Reference Sanchez and Cruz2024); and, importantly, have electoral value, ranging from voter preferences for punitiveness to misperceptions of its effectiveness (González Reference González2020; Holland Reference Holland2013; Tiscórnia and Pérez Betancour Reference Tiscornia and Bentancur2024).
The divergent motivations of criminal groups and militarized police have a crucial implication: territorial control in hybrid orders is not inherently zero-sum. As illustrated by Barnes (Reference Barnes2022), although rival criminal groups pose existential threats to one another, state actors, particularly police forces, do not. Militarized police crackdowns are often short-lived and fail to address the underlying cause of criminal consolidation: the demand for illicit goods (Barnes Reference Barnes2025, 63; Flom and Post Reference Flom and Post2016). Consequently, criminal groups often bribe or evade these crackdowns (Auyero and Sobering Reference Auyero and Sobering2019; Sanchez and Cruz Reference Sanchez and Cruz2024), only resorting to anti-state violence if the intervention seriously weakens their standing against a criminal rival (Barnes Reference Barnes2022). Thus, criminal organizations may tolerate a police presence as long as their operations remain uncompromised, and police may tolerate criminal activity for political gain and bribes, or just because it is safer to turn a blind eye (Denyer Willis Reference Denyer Willis2018; Sanchez and Cruz Reference Sanchez and Cruz2024).
Based on these discussions, I define territorial control in hybrid orders as the capacity to enforce rules governing who belongs within a bounded geographical area through the evaluation of threats and the selective projection of lethal force.Footnote 5 This definition draws from civil wars scholarship by recognizing territorial control as a domain of governance, particularly, over “in/out of place rules” (Rubin and Stewart Reference Rubin and Stewart2022, 18). However, because territorial access in hybrid orders is not zero-sum, the definition also recognizes that control does not require “preventing enemy movement” (18). Following Barnes (Reference Barnes2022), the enforcement of rules governing presence is instead dependent on the local security conditions. Territorial control relies on the capacity to anticipate and evaluate threats to those rules and to selectively deploy violence to enforce them.
To maintain territorial control, both militarized police forces and criminal groups thus rely heavily on fine-grained information. Existing research emphasizes the importance of intelligence gathering for armed actors in hybrid orders, yet the underlying mechanisms remain underexplored. Barnes (Reference Barnes2025) highlights how residents in gang-controlled communities shape local governance through the possibility of denunciation. Because people living in such areas possess strategic information, such as the location of gang hangouts, denunciation “can spell disaster,” enabling rivals to exploit defensive weaknesses or enabling police to conduct targeted interventions (65). Conversely, gathering fine-grained intelligence allows armed actors to anticipate rival attacks and make informed tactical decisions; for instance, whether to hide, bribe, or fight during police crackdowns.
Research on territorial control in contested urban environments frequently draws on Kalyvas’s (Reference Kalyvas2006) seminal work on civil war on this point (Barnes Reference Barnes2025, 65; Magaloni, Franco-Vivanco, and Melo Reference Magaloni, Franco-Vivanco and Melo2020, 563), reproducing the argument that denunciation is the main intelligence-gathering method available to armed actors. In the context of political insurgency studied by Kalyvas (Reference Kalyvas2006), consolidating territorial control requires effective violence, which in turn depends on quality information. The author identifies three main intelligence-gathering methods, arguing that “consensual provision” (by informants) is the most “common, and probably effective, way to access private information” (176). In contrast, he deems “violent extraction” (torture) unreliable, and “material indices” (such as photographs or captured documents) as requiring “high levels of technical sophistication to obtain,” being “difficult to interpret,” and thus offering “limited value in contested zones” (175).
The emergence of digital media as the primary means of social communication demands a critical reevaluation of the role of material indices in contested urban environments. Namely, I argue that digitalization fundamentally alters the accessibility and usefulness of such material traces. Digital media offer armed actors novel forms of information discovery and dissemination, enhancing their capacity to identify threats, project violence and thus, enforce in/out of place rules in hybrid orders. The following section draws on media sociology to theorize how digital “affordances” facilitate access to and the circulation of strategic information.
Digital Networks and the Affordances of Digital Platforms
The advent of digital technology has profoundly restructured the informational environment in which armed actors operate, which is now characterized by “horizontal networks of interactive communication” (Castells Reference Castells2007, 246). Social media and instant messaging platforms, in particular, have dramatically expanded the volume, accessibility, and shareability of personal information (Bennett and Pfetsch Reference Bennett and Pfetsch2018, 244; boyd Reference boyd and Self2010). In this context, digital networks increasingly function as an “ordering principle” of territory (Jessop, Brenner, and Jones Reference Jessop, Brenner and Jones2008) in which actors rely on networked information to navigate urban space. Just as protestors coordinate via social media or commuters use social navigation apps to circumvent traffic, digital platforms mediate how armed actors engage with urban environments, using novel mechanisms to gather strategic intelligence for territorial control.
Although the role of digital communication in armed conflict has received growing academic attention, its impact on intelligence gathering and territorial control remains underexplored. Scholars of criminal governance have emphasized the importance of written communication in shaping dynamics of territorial conflict (Johnson Reference Johnson2026; Johnson and Gillooly Reference Johnson and Gillooly2023), but the role of digital tools has still to be clarified. Within the field of political violence, research has primarily focused on how digital technologies enable armed groups to disseminate discourse and propaganda (Loken Reference Loken2021; Loyle and Bestvater Reference Loyle and Bestvater2019; Zeitzoff Reference Zeitzoff2017) and, to a lesser extent, how they support organizational capacity (Tønnesson, Min, and Aung Reference Tønnesson, Min and Aung2022). A notable exception is Gohdes (Reference Gohdes2020), who argues that the Syrian regime exploited social media usage to extract actionable intelligence, demonstrating that areas with internet access received more targeted repression during the war. This scholarship illustrates the importance of digital information gathering, although it does not clarify the specific mechanisms through which such digital data are extracted and operationalized by armed groups. Understanding such micro-processes is essential to unpacking how armed actors consolidate power at the local level.
In parallel, urban sociologists have documented how gang conflict increasingly extends into the “digital street” (Lane Reference Lane2019). This research explores the interplay between online and offline gang dynamics (Hsiao, Leverso, and Papachristos Reference Hsiao, Leverso and Papachristos2023; Leverso and Hsiao Reference Leverso and Hsiao2021; Patton et al. Reference Patton, Lane, Leonard, Macbeth and Lee2017), emphasizing conditions under which digital aggression escalates or de-escalates physical confrontations (Lane and Stuart Reference Lane and Stuart2022; Stuart Reference Stuart2020a). Although these studies offer granularity on the importance of digital networks in urban conflict, they do not address the issue of territorial control.
To fill this gap, this study adopts an affordance-based approach to examine how armed actors leverage information accessible in digital communication platforms for territorial control. Within communication scholarship, the concept of “affordances” refers to the “perceived actual or imagined properties of digital media … that enable and constrain specific uses of the platform” (Ronzhyn, Cardenal, and Rubio Reference Ronzhyn, Cardenal and Rubio2023, 3178). This concept links user objectives and technological features, highlighting the unique “possibilities for action” (Evans et al. Reference Evans, Pearce, Vitak and Treem2017, 36) that distinguish digital networks from traditional media. For instance, searchability allows for efficient information discovery using automated queries, whereas replicability enables the instantaneous dissemination of data. By emphasizing the social possibilities enabled by the architecture of digital platforms (boyd Reference boyd2014, 14), affordance theory provides a robust framework for unpacking how armed actors use these technologies in hybrid orders.
This study focuses on the four core affordances of digital media platforms identified by boyd (Reference boyd and Self2010; Reference boyd2014): persistence, visibility, searchability, and replicability. I illustrate how armed actors exploit these affordances to access critical material indices, such as images, chat logs, and GPS data. Accessing this digitally networked information, in turn, facilitates the identification of territorial threats and the projection of force over physical space, increasing the effectiveness of the enforcement of rules of territorial belonging. Table 1 provides a stylized version of the argument, defining each of these affordances and outlining their strategic value for territorial control in my field site.Footnote 6
Digital Affordances and Their Role in Territorial Control by Armed Groups in Fortaleza
Table 1 Long description
The table consists of five columns: Affordance, Mechanism, Role, Operationalization, and Outcome.
* Persistence: The mechanism involves bits allowing content to be automatically stored on devices or servers. Its role is intelligence discovery. Operationalization occurs by inspecting a person's smartphone contents like image galleries or W h a t s A p p conversations. The outcome is the identification of affiliation or collaboration with an armed actor.
* Visibility: The mechanism allows users to observe interactions between others. Its role is intelligence discovery. Operationalization involves analyzing digital interactions such as image locations or social media comments. Outcomes include identifying affiliations, locating rivals, and strategic attack planning.
* Searchability: The mechanism allows information retrieval through queries, keywords, tags, or links. Its role is intelligence discovery. Operationalization uses platform features like search boxes, hashtags, or geotags. Outcomes include identifying affiliations, locating rivals, and strategic attack planning.
* Replicability: The mechanism allows bits to be duplicated infinitely and distributed rapidly. Its role is intelligence dissemination. Operationalization involves disseminating updates in real time with thousands of members. Outcomes include enhanced territorial surveillance and identification of affiliation or collaboration with an armed actor.
Source: Adapted from boyd (Reference boyd and Self2010; Reference boyd2014) and the author’s own analysis.
Research Design and Methodology
This article adopts a comparative ethnographic design, identifying and comparing digitally mediated information-gathering practices deployed by armed actors within a single site: the urban periphery of Fortaleza (Brazil).Footnote 7 The data were collected during 15 months of fieldwork in the Brazilian Northeast (August 2023–August 2024 and April– June 2025). The fieldwork focused on the digital media practices of armed actors in contested urban communities—that is, what police and criminal groups do with digital media platforms (Couldry Reference Couldry2004; Postill Reference Postill2024)—and how these practices were consequential to the local dynamics of hybrid order.Footnote 8
Comparative ethnographic approaches, whether across multiple sites or multiple practices within a single site, are recognized as being well suited for developing theoretical insights in political science (Simmons and Rush Smith Reference Simmons and Smith2019), particularly in studies of contention and violence (Barnes Reference Barnes2022; Fu and Simmons Reference Fu and Simmons2021). When used in political science contexts, the term “ethnographic” refers not only to a data collection method—the “immersion in the place and lives of people under study” (Wedeen Reference Wedeen2010, 257)—but also to a particular “sensibility” regarding “how people make sense of their worlds” that informs the whole comparative design (Simmons and Rush-Smith Reference Simmons, Smith, Simmons and Smith2021, 233). This article fits within what Fu, Nielsen, and Schatz (Reference Fu, Nielsen and Schatz2026, 380) characterize as “ethnography-plus,” in which participant observation is used alongside other methods to improve theory and concept development.
My analysis draws on two complementary levels of data. Participatory immersion in a single community under hybrid order (Campo Iracema) provides situated knowledge of how territorial control operates on the ground, whereas broader city-level data collection—including 81 semi-structured interviews, netnographic and open-source research, and document analysis—complements these grounded observations at a larger scale. The argument emerges from the interplay between these two levels, rather than from a single community or method, allowing me to extend the analysis across Fortaleza’s urban periphery.
Most of my participant observation took place in Campo Iracema, a marginalized urban community under hybrid order of approximately 4,000 inhabitants located in the periphery of Fortaleza. This was a productive community for immersion because it exhibited two common features of areas under hybrid order in the city: active or latent territorial threats from rival criminal groupsFootnote 9 and violent police enforcement. During the time of my fieldwork, Campo Iracema remained tightly controlled by a criminal faction (Comando Vermelho) that endured a latent territorial threat from a neighboring community controlled by Tudo Neutro rivals, which resulted in sporadic shootings and regular militarized police intervention. That made it a “typical case” (Gerring Reference Gerring2006, 91) of the dynamics I sought to theorize.
From November 2023 to August 2024, I volunteered with a local social project in Campo Iracema, which facilitated weekly access to the area. Although the complex security situation prevented me from living there, visiting regularly allowed me to build trust with residents and become immersed in the area’s territorial dynamics. Field activities initially focused on the social project, and then I gradually sought broader access by attending community meetings, participating in local events, and spending time informally on residents’ doorsteps. Throughout, I was clear about my identity and goals, introducing myself as a university researcher interested in understanding the impacts of violence in the community. I also collected ethnographic data during planned visits to other marginalized urban communities and through “accidental ethnography” (Levitan, Carr-Chellman, and Carr-Chellman Reference Levitan, Carr-Chellman and Carr-Chellman2020)—unplanned observations that occurred informally; for instance, while visiting friends in areas under hybrid order. All relevant observations were recorded in fieldnotes shortly after each visit.
To situate my ethnographic data at a broader scale, I conducted 81 semi-structured interviews with people familiar with digital media’s role in urban territorial conflicts across the region. Table 2 summarizes the profiles of the interviewees (a detailed list is in table A1 in the supplementary appendix). My selection strategy prioritized theoretical depth over representativeness (Charmaz Reference Charmaz2014, 4), and because of the topic’s sensitivity, I relied exclusively on snowball sampling (Sukarieh and Tannock Reference Sukarieh and Tannock2013). This method, as well as security concerns, limited the number of formal interviews with criminal faction members compared to other interviewee profiles.
Overview of Interviewee Profiles
Table 2 Long description
The table consists of two columns titled Profile and Number.
* Police: 27
* Residents of areas under hybrid order: 17
* Experts including journalists and researchers: 16
* Legal operators including prosecutors and members of police misconduct boards: 8
* Activists: 6
* Imprisoned former criminal faction members: 4
* Administrators of key digital media channels: 3
* Total: 81
Despite this imbalance, my analysis of criminal strategies remained robust through triangulation with two complementary sources. First, informal conversations with local faction members during ethnographic fieldwork provided contextual insights into their operational logics. Second, residents of faction-controlled areas—the second-largest group in my sample—shared intimate knowledge of their dynamics. Because they were frequent targets of digital surveillance by armed groups and had close social ties to faction members, these residents provided a good vantage point on criminal digital strategies.
Interviews were conducted in Portuguese (which I speak fluently), mainly in locations chosen by the participants, after careful consideration of security.Footnote 10 All participants were fully informed about the aims of my research and their right to end the interview at any time. I only recorded interviews when participants felt comfortable; otherwise, I took detailed notes. Recordings and pseudonymized transcripts were securely stored in password-protected network storage immediately afterward.
In addition to physical fieldwork, I identified and analyzed digital communication channels using a “digital street” approach (Lane Reference Lane2019): engaging simultaneously in digital and physical modes of data collection to capture the flow of interactions between online and offline spaces. These channels fell into two categories: public (e.g., propagandistic social media accounts affiliated to armed actors, Telegram groups sharing security updates on territorial conflicts); and restricted (e.g. internal WhatsApp groups of criminal groups and PM channels).Footnote 11 The different ethical and security implications of these environments required distinct strategies.
In public channels, I followed a “netnographic” approach: taking these digital spaces as sites of observation and investing hundreds of hours in understanding the kind of content shared, how users reacted to it, and occasionally, interviewing the channels’ administrators (Kozinets Reference Kozinets2002). While doing so, I also applied open-source research techniques—for instance, advanced search queries and reverse-image searchers (Koettl, Murray, and Dubberley Reference Koettl, Murray, Dubberley, Dubberley, Koenig and Murray2019)—to verify relevant content and link it to specific events. Following established ethical guidelines on digital research, I did not seek informed consent to observe interactions in public channels (LSE 2022; Townsend and Wallace Reference Townsend and Wallace2016), except while interacting with administrators, when I clearly disclosed my identity and goals.
Because of ethical and security concerns, I did not seek direct access to restricted channels such as internal WhatsApp groups of police and criminal groups. Still, I was able to gain insights into those groups through two indirect methods. First, several interviewees—including investigative police officers, former members of criminal groups, and residents of areas under hybrid order—provided detailed descriptions of these communication channels and their internal logics. Second, through my local network, I accessed 23 police intelligence reports and judicial files that documented the use of WhatsApp groups and social media by criminal organizations.
Armed Territorial Competition in Fortaleza’s Urban Periphery
This section outlines the context, key actors, and underlying drivers of territorial competition in Fortaleza. Crucially, it emphasizes how the identification of threats and the projection of violence in the city’s fragmented urban landscape require access to fine-grained information. The first subsection offers an overview of the conflict affecting the region, and the second zooms into the specific logics driving both PM and criminal factions to engage in territorial competition.
Urban Violence in the Brazilian Northeast: The Case of Fortaleza
The last decade has seen a meteoric increase of lethal violence in Brazil’s northeast region.Footnote 12 Fortaleza, the capital of Ceará State and the largest city in the Northeast, has been no exception, consistently making it to the top of homicide statistics since the early 2010s.Footnote 13 This violence has been driven by an intense territorial war among criminal groups and exacerbated by iron-fist militarized policing, resulting in the division of the urban periphery into multiple, localized hybrid regimes (Paiva Reference Paiva2019). As a result, Fortaleza and cities like it have become divided by invisible, yet deadly, borders that require constant surveillance to maintain.
Existing research attributes this surge in lethal violence to the expansion into the region of Brazil’s two primary criminal organizations: the Comando Vermelho (CV) and the Primeiro Comando da Capital (PCC). Originating in southeast Brazil (Rio de Janeiro and São Paulo, respectively), these groups consolidated an institutional model for crime that has spread through the country, the so-called facção criminosa (criminal faction; Paes Manso and Nunes Dias Reference Paes Manso and Dias2018). Although historically allied, the CV and the PCC started a war for territorial expansion in the mid-2010s. This conflict sparked a nationwide competition for hegemony, with both groups aggressively pursuing new sources of profit across the country. The Northeast became a prized territory in this scramble and therefore one of the epicenters of violent contestation.Footnote 14
In Fortaleza, nearly all armed conflict occurs in what my participants referred to as the periferia (periphery), particularly within comunidades (communities). The “periphery” is a flexible social category that describes all the areas of the city where people encounter socioeconomic adversity (Ivo Reference Ivo2010). Within these, comunidades are informal settlements made by the urban poor: although comunidades are always in the periphery, not all the periphery is made up of informal housing. To illustrate the level of spatialization of violence, approximately 85% of all registered homicides between 2015 and 2024 happened in areas considered “peripheral” (SUPESP 2024).Footnote 15
During the time of my fieldwork, four criminal factions disputed urban territory in Fortaleza. The earlier two factions were the PCC and the CV, which started “baptizing” new members in Ceará State in 2013 (De Melo-Nascimento and Lima-Siqueira Reference De Melo-Nascimento and Lima-Siqueira2022, 134). Most new members were part of preexisting local street gangs and drug-trafficking groups; they were offered important benefits, such as access to better drugs and weapons, in exchange for joining (Paiva Reference Paiva2019). Their local knowhow and old rivalries were incorporated into the organizational logics of the criminal factions, producing two important results: increased violent territorial competition and the formation of new criminal factions through in-fighting. Two successful splinter groups thus emerged: the Guardiões do Estado (GDE), founded by dissident local PCC members in 2016, and the Tudo Neutro or Massa (TDN), a break-off group from the CV created in 2021.
The Logics of Violence in Fortaleza’s Urban Periphery
The progressive deterioration of public security in Fortaleza has produced an extremely fragmented urban space, creating what some residents call the questão territorial (the territorial issue). This refers to pervasive territorial violence related to two types of armed actors. On the one hand, the facções maintain a violent form of governance aimed at controlling territory and keeping enemies away, effectively fragmenting the periphery into multiple enclaves (Paiva Reference Paiva2019). On the other hand, the Policia Militar (PM) has been granted an increasingly aggressive role, with elite intervention units assuming regular patrol duties and gaining greater autonomy and firepower (Lins Reference Lins2020, 52–53).Footnote 16 Both actors rely on fine-grained information to identify threats and project violence over the city’s urban margins.
Table 3 summarizes the factors driving each group to control comunidades in Fortaleza, distinguishing between material and symbolic incentives. Criminal factions use violence to defend their turf, expand their territories, and enforce internal social order, establishing strict rules of behavior to prevent collaboration with police or rival factions. Their territorial aims are primarily economic, because most of their revenue sources, ranging from drug trafficking to vote-buying schemes, depend on territorial control. However, personal networks and symbolic attachments between faction members and their communities also play a role in territorial competition (Barnes Reference Barnes2022, 30). This role is particularly salient during territorial takeovers, when residents with direct ties to members of the losing side, particularly their friends and family, frequently face expulsion or even death from new incumbents (Silva and Monteiro Reference Filho, Oliveira and Mariano2020).
Drivers of Territorial Competition among Armed Actors in Fortaleza
Table 3 Long description
The table consists of two main rows representing armed actors and two columns representing types of incentives.
Row 1: Criminal factions.
* Material incentives: Drug trafficking, extortion of local businesses, and collusion with public authorities such as vote-buying schemes.
* Ideational incentives: Symbolic value of turf and protection of kin and community from rival groups.
Row 2: Military Police.
* Material incentives: Institutional rewards for drug and weapon seizures, career advancement, and collusion with criminal factions for financial gain.
* Ideational incentives: Street-hunter mentality and recognition by peers and superiors for bravery in the field.
The PM use violence as part of two distinct logics: waging an ideological war against crime and profiting from crime, whether legally or not. Their professional ethos was aptly captured by a Civil Police officer during an interviewFootnote 17: “Military Police officers are street hunters. They operate trying to protect themselves in the streets while arresting as many criminal faction members as possible.”
As he put it, PM officers follow a “hunting logic,” conducting intense surveillance of urban peripheries in search of criminals. Institutionally, their central mission is enforcing social order, retaking areas controlled by bandidos (thugs), and clearing the streets of vagabundos (low-lifes). As elsewhere in Brazil, Ceará’s PM has a long-standing reputation for authoritarian and discriminatory practices against Black, Brown, and socially disadvantaged citizens (Alves Reference Alves2018; Ramos et al. Reference Ramos, Allencar, da Silva, Ribeiro, Neves, Barreira and Moura2023; Sá and Santiago Neto Reference Sá and de Santiago Neto2011). As a result, comunidades become the primary sites for violent police operations. Detaining or killing alleged criminals and seizing illicit goods are regarded within the PM as markers of bravery and competence, and thus contribute to professional prestige and career advancement.Footnote 18
PM officers, particularly those in the lower ranks, operate in a dangerous environment, both killing and being killed at high rates.Footnote 19 Because of this danger, they receive economic incentives to participate in the “street hunt.” Ceará’s government offers direct rewards for drugs and weapons seizure, including salary bonuses and paid leave (Governo do Ceará Reference do Ceará2024). This creates a perverse incentive, in which seizing illicit goods eclipses other goals such as protecting citizens.
Illicit profit is also a driver of territorial control, with collusion between criminal factions and members of the PM being pervasive in Fortaleza (e.g., G1 2024b). Because PM officers are pressured to seize illicit goods, some resort to making informal arrangements with local traffickers to meet statistical targets, thereby facilitating corruption dynamics.Footnote 20 Police intervention teams with access to an area and good information about the local traffickers can negotiate extortion payments: they may seize only a portion of the identified drugs or weapons and even resell them later to rival groups.Footnote 21
In sum, both criminal factions and PM have strong incentives for establishing territorial control within urban peripheries. To enforce in/out of place rules in comunidades, both categories of actors require access to fine-grained intelligence. Criminal groups need information to identify rivals, vet potential enemy collaborators, and project violence, for instance, by coordinating strategically during territorial invasions. Military Police officers require information to find targets for seizures and plan strategic interventions into gang territory. It is precisely at this juncture—where the imperative to control who belongs within a comunidade meets the difficulty of doing so in a major city—that digital media platforms become a helpful tool in territorial control. The following section describes how the affordances of digital communication platforms provide diverse opportunities for such strategic information gathering.
Networked Intelligence Gathering
Based on cumulative insights from my fieldnotes, semi-structured interviews, and data obtained through digital research, this section outlines three digitally mediated information-gathering practices deployed by criminal factions and the Military Police in Fortaleza. It presents how the inspection of smartphones allows armed actors to identify immediate threats by breaching restricted digital data, how instant messaging apps enable real-time strategic information sharing, and the possibilities of monitoring rivals offered by visible social media content.
Smartphone Inspections
Smartphones have emerged as an instrument of control in Fortaleza’s urban periphery. Given the suspicion and fear characterizing contested comunidades, forcefully inspecting smartphone contents has become a common strategy to assess whether someone presents a territorial threat. This practice is made possible by the persistence of digital communication (boyd Reference boyd2014): restricted digital content, such as WhatsApp messages, GPS data, and photo galleries, is automatically stored and archived on smartphones.
As a common local saying warns, you need to know “how to enter, and how to leave”Footnote 22 the urban periphery. Given the persistent threat of faction attacks and police raids, those perceived as desconhecidos (strangers) are met with immediate suspicion. PM officers and criminal faction members frequently intercept and question those considered suspicious, particularly young Black or Brown men who fit the social stereotype of the faccionado (criminal faction member). These encounters frequently involve an abordagem or baculejo: a stop-and-frisk practice often including the forced inspection of the suspect’s personal smartphone contents for incriminating digital evidence.
Smartphone inspection by criminal faction members starts with the identification of a person considered suspicious, often pointed out by lookouts. In Campo Iracema, local gang members are stationed in strategic areas to control the flow of people through the territory, such as access alleyways and drug-selling spots. Residents also flag suspicious movement to gang members, often through WhatsApp groups, because police interventions or rival group invasions are not good news for anyone.Footnote 23 Suspicious people who enter the area, particularly at night, are frequently intercepted by faction members who question them about their identity and reasons for visiting.Footnote 24
Those unable to convince gang members of their innocence—they may contradict themselves or appear nervous—are forcibly detained and made to unlock their smartphone. Then, a process of identification starts, in which criminal faction members inspect the restricted contents of the phone, including its photo gallery and various apps, and then interrogate those they intercepted about them. The objective is to determine whether the person is affiliated to a rival faction or violates established rules of territorial belonging in any way—for instance, by residing in an area controlled by an enemy faction—in which case the individual could be an informant. As a former faction member recounted, incriminating content included images of drugs or weapons, which would confirm their criminal involvement, or evidence of connections to rivals, such as photos with known enemies, symbols of another criminal faction, or conversations with police.Footnote 25
Smartphone inspections are conducted not only to deny enemies access to territory but also to identify potential defectors, particularly after a territorial breach. For instance, following a series of targeted killings in bordering rival territories, the PM organized a raid in Campo Iracema to apprehend one of the suspects. An intervention team invaded the houses of several neighbours, who were interrogated about local criminal faction members. As one affected resident told me, the police interrogation put them under suspicion of caguetagem (snitching to the police) which led to them being questioned by local faction members the following day. One neighbor, who was strongly suspected of having given information to the police, was forced to surrender his phone to a local faction member so he could search for evidence of defection.Footnote 26
The PM also engage in a similar process of smartphone inspection. Although they are legally required to gain judicial authorization to access smartphone contents, due process is not always respected during the street hunt. For PM patrols, real-time access to smartphones can provide valuable data leading to seizure and arrests; thus, asking for a judicial warrant is often not done. As one officer from a PM intervention unit explained, this practice follows a clear internal logicFootnote 27:
So, I’d stop someone suspicious and say, “Give me your phone, unlock it.” The guy unlocks it. I go and check his phone, and there you see … oh, a conversation: “Bring the drugs to such street, such place, like this, like that…” Then we come up with a strategy to catch the person who’s waiting. We arrive, arrest everyone, and take them to the station.
The identification strategy outlined by this officer is identical to that deployed by criminal factions. His unit would target suspicious people, stop and frisk them, forcibly detain them, and ask them to surrender their phones for an inspection. Then, they would exploit the permanency of networked information in digital communication platforms—in this case, text and images shared through WhatsApp chats that cannot be publicly accessed—to find incriminating evidence and plan further territorial interventions; for instance, launching a surprise raid at a drug-selling point.
Information-Sharing Networks
In addition to discovering new information on social media, armed actors employ instant messaging apps and social media platforms to strategically share intelligence. The replicability of digital information allows costless duplication and dissemination of content in real time, which are exploited with at least two purposes: monitoring territory and identifying potential threats.
WhatsApp has become particularly relevant for armed actors disputing territory in Fortaleza. Criminal factions use WhatsApp groups for real-time coordination between members located in different streets, neighborhoods, and cities and both inside and outside prisons. These groups serve various goals, including managing members’ contributions to communal funds and, crucially, monitoring controlled areas.Footnote 28 Similarly, militarized police forces use WhatsApp groups—referred to as grupos de policiais (police groups)Footnote 29—to quickly share information about incidents and images of suspicious individuals. These groups function as informal databases—cataloging people, places, and behaviors deemed “suspicious.”
To facilitate territorial surveillance, armed actors may create WhatsApp groups of informant networks and receive real-time security updates. These groups then monitor the perimeter of controlled areas and raise alerts about suspicious activities. A former PM officer described the sophistication of such networks in FortalezaFootnote 30:
In [neighborhood] these guys created a true criminal intelligence network through WhatsApp groups. They had multiple lookouts positioned throughout different points in the city.… He [a lookout] didn’t handle drugs, he didn’t sell, he didn’t carry weapons…. If you were to register him, he was just sitting there with his phone in his hand, apparently doing nothing. But what was his role? He’d report.
Later in the conversation, the same officer shared a specific case to illustrate the reach of this surveillance system. Two teenagers had been kidnapped and taken to a hideout to be interrogated and executed. One managed to escape and informed the police, and the officer’s team was mobilized to rescue the other teen. When the team arrived at the area of dense vegetation where the survivor said the hideout was located, he told me,
When we got close to the bush, as we were entering, the girl came out running. I approached her and asked, “Did you manage to escape?” She said, “No, they let me go … because they knew you were coming.”… We found the hideout, the shack… everything, but the guys had managed to escape. When I returned to the station, she told me, “They have a WhatsApp group where, as soon as a police car leaves the station… there’s a lookout on the corner. He reports, ‘The police car just left the station, heading downtown.’… At one point, the group reported, “It’s heading towards [neighborhood].”… That’s when they released the girl because they knew it was going to be trouble if we came in.
In addition to monitoring restricted WhatsApp groups, criminal factions also exploit public social media accounts on platforms such as Instagram, TikTok, and KwaiFootnote 31 to disseminate decretos (“death sentences”).Footnote 32 These are, effectively, digital kill orders featuring photos of wanted rivals or defectors that serve at least two important functions: (1) they inform local criminal faction members and residents of controlled areas that such individuals should be captured or killed, and (2) they solicit information on their whereabouts from sympathizers elsewhere. For instance, during an active turf war between rival factions in two adjacent neighborhoods, Instagram accounts linked to both sides were created. Following a series of drive-by shootings that killed several people, including the girlfriend of a faction member, one account began requesting followers to share images of the suspects and their romantic partners. Hours later, the same account thanked followers for their tips and posted decretos for the alleged partners of the attackers.Footnote 33 Figure 1 shows two anonymized examples of “death sentences” shared by an Instagram account linked to Massa–TDN during a territorial confrontation with CV.
Anonymized Examples of Digital “Death Sentences” Shared by an Instagram Account Associated with a Criminal Faction, Massa–TDN
On the left, a photo of a rival CV member is accompanied by the following captions: “Decreed by the brothers, kill him on sight.” “I know who my real brothers are” [followed by the Massa–TDN symbol]. “CVass [a derogatory term for CV members] are sewer rats.”
On the right, another photo shows a former Massa–TDN member who defected to CV, with the following captions: “Your time is coming, fucking asshole. We’re going to find you, CVass.”
“[NAME] FUCKING TRAITOR’ ‘SENTENCED BY THE NEUTRAL CRIMINALS [slang for Massa–TDN] OF CEARÁ” (followed by the Massa–TDN symbol.
Source: Instagram. Anonymization by the author.
Figure 1 Long description
A two-panel layout of social media posts.
Left Panel:
At the top, white text boxes contain the phrases Decreed by the brothers and kill him on sight. Below this is a large black circle anonymizing a person's face. In the center, a text box reads I know who my real brothers are, followed by a white flag emoji and a red angry face emoji. Below that, yellow text reads LOVE IS ONLY FROM MOTHER. In the bottom left corner, a smaller inset photo shows a man in a green shirt with the text TRAITOR SCUMBAG. At the bottom right, a text box reads C V ass are sewer rats.
Right Panel:
At the top, a text box reads Your time is coming, fucking asshole. We are going to find you, C V ass. The center features a large black square anonymizing a face. Above the square, white text reads TRAITOR SCUMBAG! with an angry face emoji. Below the square, white text reads SENTENCED BY THE NEUTRAL CRIMINALS OF CEARÁ! followed by a hand pointing emoji and a white flag emoji. Both panels include standard Instagram interface elements like the reply bar and heart icons at the bottom.
The Military Police deploy very similar surveillance practices. In addition to the official police radio system, PM patrols monitor both “police groups” and so-called information portals: social media accounts and Telegram groups with thousands of members used to share security updates.Footnote 34 As a PM officer explained,
Information spreads fast these days. In fact, sometimes when we are on patrol, we become aware of a homicide even before the Operations Center does, because it has already been posted on WhatsApp and spread through the groups. Yesterday, there was an attack at a football pitch. I was on duty, and before the crime was even reported [through the Police Communications Center], social media was already showing the kids who had been shot. Footnote 35
Furthermore, given the difficulty of securing informants in areas controlled by criminal factions, some PM officers create so-called bizú (police jargon for “tip-off”) Instagram accounts. These are unofficial police accounts created to receive anonymous tips through direct messages or a linked form. Posts often are in the form of Instagram Stories, which disappear within 24 hours, showing weapons, gear, surrendered suspects, or crime scenes, always paired with requests for anonymous tips in specific areas. Some of these accounts reach micro-celebrity status, gaining thousands of followers and thereby expanding the pool of potential informants. Figure 2 shows two examples of Instagram Stories shared by PM bizú accounts.
Anonymized Examples of Instagram Stories Shared by Military Police `bizú’ Accounts
On the left, a user displays an automatic rifle with this caption,
“Going hunting—share information and we’ll make it happen!” accompanied by a link to an anonymous tip form.
On the right, an anonymized photo of a surrendered young man is shown with the caption, “Send tips and the ghosts [slang for tactical PM units] will take them out of circulation,” along with another anonymous form and a reference to a specific area (Caucaia) of the metropolitan area of Fortaleza where they operate.
Source: Instagram; anonymization by the author, except for the emoji on the right side.
Figure 2 Long description
The image consists of two vertical panels.
Left Panel:
A black and white photo taken from inside a vehicle. In the foreground, a person holds an automatic rifle pointed toward the window. A black text box at the bottom contains the Portuguese text Na caça, manda a informação que fazemos acontecer! Below this is a white button with a blue link icon and the text Scret.me.
Right Panel:
A color photo of a shirtless young man sitting against a white wall with his legs spread. His face is obscured by a large yellow shushing face emoji. At the top, a black text box reads manda o bizu que os fantasmas vão tirar de circulação followed by a purple devil emoji. In the center, a white button with a blue link icon reads Denuncia anonima. Below that, a smaller black tag reads TODA CAUCAIA followed by a lightning bolt and a black flag emoji.
Another key function of information-sharing networks in enabling territorial control is identifying potential threats, which often occurs during stop-and-frisk incidents. During those detentions, armed actors not only inspect smartphones but also take photos and videos of suspects and share them within internal WhatsApp groups to check for identification. As a resident of Campo Iracema explained,
People in the movement [slang for criminal faction] have a group. If they catch you inside the community and notice that you’re not from here … they’ll want to know who you are. They’ll film you and send it to the group. “Do any of you know this person?’ And soon comes the reply—“Oh no, he’s with [so and so] it’s all good.” Footnote 36
As explained by another resident of Campo Iracema, when the interrogators have a strong suspicion that the suspect is violating the rules of belonging, this practice of taking and sharing photos of the subject is normally done alongside phone inspections.Footnote 37 An imprisoned ex-criminal faction member further clarified that these photos are not usually taken in the streets; instead suspects are taken to more discreet locations, where their interrogation is recorded and then shared with other members for potential insights.Footnote 38 I encountered at least two such videos circulating in public Telegram groups after leaking from internal criminal faction groups. In the videos, one that was recorded in a house and the other in an area of dense vegetation, young men are being questioned about their whereabouts, including their neighborhood, allegiance to any criminal organization, reasons for being there, and importantly, whether they had been imprisoned before.
The PM uses a similar method to determine the identity of suspects and maximize the chances of detention. Knowing whether a person has had previous run-ins with the law increases the likelihood that stop-and-frisking will result in a successful arrest. Thus, it is common for PM officers to circulate images of known offenders and unknown “suspicious” individuals among police groups to find out more about them. A PM officer explained to me,
I’ll give you an example. These two guys were stopped by a patrol car. The officer has never seen these people but finds them suspicious. Then, he takes a picture and shares it in the group. “Does anyone know these guys?” Then someone replies, “I know him, his name is such and such.” or “I don’t know him.” Our group has about 300 police officers, and someone will look them up [in the police internal database]. They might know them, “Look, he’s already been arrested for this and that”; or maybe not. If so, when there are 300 officers and none of them know these guys, then they’re free of any suspicion. Footnote 39
A community leader from an area near Campo Iracema shared a similar story.Footnote 40 A resident who used to volunteer for a local social project began to be constantly harassed by PM patrols. The situation reached a point where police were routinely stopping and frisking the volunteer for no obvious reason. The project leader eventually reached out to one of the commanders of the local PM battalion, who discovered the issue. A photo of the volunteer, who was thought to be a local faction member, was being circulated in police WhatsApp groups. This volunteer used to live with two relatives, one of whom was affiliated with a criminal faction. At one point, the police broke into their house, found a weapon belonging to the relative, and arrested him. However, during the intervention, they took pictures of everyone else in the house, which were then shared in a PM internal group and framed as faction members. This volunteer had, thus, been erroneously categorized as a criminal and so was a target for the seizure of drugs and weapons.
Social Media Monitoring
The volume and accessibility of personal information have dramatically increased with the popularization of social media platforms. Armed actors in Fortaleza exploit two affordances of digital media—searchability and visibility—to tap into these publicly accessible information networks and gather actionable intelligence. Searchability enables them to retrieve relevant information efficiently, using platform features such as hyperlinks and search boxes. Visibility, in turn, allows them to observe user activity and interactions beyond their immediate network—from people tagged in a photo to those who comment on a post. Together, these affordances are leveraged to identify and exploit enemy vulnerabilities, as well as to monitor potential defectors within their communities.
Perhaps counterintuitively, young street-level faction members are highly active on social media. Criminal factions are prolific content producers, generating materials ranging from videos threatening rivals or celebrating territorial takeovers to the aforementioned decretos. Although a comprehensive explanation of such social media behavior is beyond the scope of this article, existing research on gangs in the United States frames their postings as digital extensions of street conflict, which are essential for perpetuating intergroup rivalries and asserting gang identity (Patton et al. Reference Patton, Lane, Leonard, Macbeth and Lee2017; Stuart Reference Stuart2020a). In Fortaleza, these digital productions also appear to play a critical role in instilling fear-induced compliance within controlled comunidades, signaling strength to residents and criminal rivals. However, such visibility also entails significant costs: it is exploited by rivals planning attacks and by the police seeking arrests.
Visible, open-source information, such as social media posts, is commonly exploited to locate and attack enemies in moments of vulnerability. For instance, two faction members were killed in a neighboring area after broadcasting an “Instagram Live” video.Footnote 41 According to a community leader, members of a rival group had managed to infiltrate a local criminal faction member’s personal account using a fake profile. One evening, the victims streamed a live video from a local bar where they were partying. The rival group realized there might be less security in that area and used this real-time information to locate and attack the group in a drive-by shooting.Footnote 42
Similar practices are used not only to target enemies but also to surveil residents of comunidades who may be breaking rules of territorial belonging; for instance, by collaborating with rivals. The expulsion of residents with family or social ties to rival groups is also common in comunidades across the city,Footnote 43 and social media often provide valuable information for identifying these connections. For instance, a resident of Campo Iracema told me he avoids posting photos of relatives who live outside CV-controlled areas. His concern was that others in the neighborhood might question his trustworthiness, suspecting him of passing information to them.Footnote 44 In an earlier conversation, I was told of a teenager who had been expelled from the area after faction members discovered she was dating someone living in rival-controlled territory—a punishment that likely served as a warning to others against maintaining ties across territorial lines.Footnote 45
Several specialized police units in Ceará are tasked with identifying and monitoring criminal activity on social media. Such monitoring is done not only by the Civil Police, which oversees criminal investigation, but also by Military Police patrols, whose remit is, in theory, restricted to maintaining public safety. Local PM battalions have increasingly developed capabilities for investigation and digital surveillance in Fortaleza, although those functions are legally outside the PM’s competences.Footnote 46
According to a member of one such intelligence unit, their job is now to infiltrate criminal faction members’ social media accounts and identify drugs, weapons, and other strategic information. This information is then used to plan police interventions, increasing the likelihood of seizures and arrests.Footnote 47 As described by the interviewee, Military Police officers create fake profiles to access content shared by faction members or individuals in their social networks. For instance, he had recently identified weapons visible in the background of an Instagram Live broadcast hosted by faction members and used this information to plan a police raid. Thus, their methods closely resemble those used by criminal factions.
Discussion: Networked Territorial Control
The previous section illustrated how both criminal factions and the Military Police systematically exploit digital media affordances to discover and disseminate actionable intelligence. Through three digitally mediated practices—smartphone inspections, information-sharing networks, and digital media monitoring—armed actors access strategic material indices (captured data such as images, documents, or video; Kalyvas, Reference Kalyvas2006, 175) that they then leverage for territorial control. For instance, discovering a stranger’s ties to a known rival by gaining access to an incriminating image in his smartphone gallery allows criminal factions to identify a territorial threat; in this case, a potential enemy collaborator. Similarly, monitoring the social media activity of a faction member allows the Military Police to project force over territory by organizing strategic interventions based on gathered data.
If we read them together, these practices suggest that structural transformations in social communication introduced by digitalization are shaping how armed actors access intelligence in hybrid orders and, in turn, how they enforce “in/out of place rules” in the urban periphery (Rubin and Stewart Reference Rubin and Stewart2022,18). They point to the emergence of a digitally networked approach to territorial control, in which access to and circulation of networked digital information become an “ordering principle” (Jessop, Brenner, and Jones Reference Jessop, Brenner and Jones2008, 396) of the way armed groups enforce rules of belonging in urban communities. Put differently, the affordances of digital media platforms—persistence, replicability, searchability, and visibility—bridge the architectural properties of digital environments with the strategic goals of armed actors, which increasingly rely on digitally networked information to identify territorial threats and project violence over geographical space.
Digital media affordances provide novel forms of information discovery and dissemination. The “possibilities for action” (Evans et al. Reference Evans, Pearce, Vitak and Treem2017, 36) they enable decrease the “technical sophistication” and “complexity of interpretation” of “material indices” in intelligence gathering (Kalyvas Reference Kalyvas2006, 175). Traditional methods such as physical informants are unlikely to become obsolete but instead may be increasingly used alongside digital tools; for instance, using encrypted messaging apps to receive tips from collaborators in rival territory. Although the ethnographic evidence presented here does not permit a quantitative assessment of performance between digital and analog information-gathering methods, the results point to a qualitative shift in how material indices are exploited, indicating that armed actors find these useful for territorial consolidation. Crucially, as outlined in table 4, the popularization of digital information-gathering methods in Fortaleza has brought effectiveness, efficiency, and flexibility gains to territorial control as compared to earlier analog approaches.
Digital Intelligence-Gathering Practices in Fortaleza as Compared with Previous Analog Equivalents
Table 4 Long description
The table consists of four columns and three rows of data.
Row 1:
- Practice: Smartphone inspection.
- Analog alternatives: Analyzing personal traits and documents.
- Advantages: Visibility and Interactive discovery.
- Gains on territorial control: Effectiveness. Personal identification becomes more feasible and reliable through the verification of digital traces.
Row 2:
- Practice: Information-sharing networks.
- Analog alternatives: Traditional phone calls, Radio systems, and Visual signals such as fireworks.
- Advantages: Many-to-many and Multimodal.
- Gains on territorial control: Flexibility through real-time coordination based on digital intelligence, and Efficiency as fewer resources are required to disseminate intelligence across a broad membership.
Row 3:
- Practice: Social media monitoring.
- Analog alternatives: Wiretapping and Physical surveillance.
- Advantages: Less technical sophistication, Less physically intensive, Automated queries, and Interactive discovery.
- Gains on territorial control: Efficiency. Fewer resources required to identify threats such as enemy collaborators and gather actionable intelligence like target locations.
The proliferation of digital platforms has significantly enhanced the effectiveness of threat assessment by increasing the accessibility of personal information. Before widespread digitalization, identifying potential rivals relied primarily on physical cues. Interviewees noted that neighbourhood gangs historically signaled affiliation through specific brands, colors, or tattoo designs. A civil policeman, for instance, recalled using intelligence reports on tattoos associated with criminal organizations during suspect evaluations.Footnote 48 However, such methods were extremely unreliable, because physical identifiers can be concealed, altered, or just be absent. For example, criminal organizations like the Salvadoran maras—popularly known for their expressive use of tattoos—simply stopped using them as an adaptation to heavy state repression (Martínez and Martínez Reference Martínez and José Martínez D´Aubuisson2019). In contrast, a smartphone provides far more granular and persistent data, including vast image galleries and thousands of messages across multiple apps. Importantly, this information is networked, meaning it is linked to other “nodes” that facilitate interactive discovery. A text-based WhatsApp conversation may lead to a profile photo revealing an association with a known rival, whereas a gallery image can automatically disclose its precise capture location through embedded GPS metadata.
Digital networks also provide enhanced flexibility in how armed actors project force, enabling more dynamic, information-driven coordination. Before smartphones and instant messaging became ubiquitous, criminal factions relied on regular phone calls to organize strategically (Biondi Reference Biondi2018). These actors also used physical warning signals, particularly through the figure of the fogueteiros: lookouts responsible for alerting the group of territorial breaches by launching fireworks. Radio communication technologies were also popular, particularly for the Military Police. The affordances of digital communication introduced significant advantages, offering what an imprisoned former criminal faction leader described as more “fluidity.”Footnote 49 Whereas phones and radios are largely limited to two-way audio communication, and physical signals require a dense network of human lookouts, instant messaging supports multimodal, many-to-many communication. This allows simultaneous information exchange—from images of suspects to GPS location—among hundreds of members, enabling a more responsive territorial strategy where the physical deployment of personnel is shaped by real-time digital intelligence updates. The flexibility gains of such an approach were clear in two interrelated empirical observations: the use of fogueteiros has practically disappeared from Fortaleza in favor of WhatsApp-based territorial monitoring,Footnote 50 and the digital shift has hindered traditional policing techniques, because faction members are increasingly able to anticipate checkpoints and territorial interventions by monitoring patrol locations in real time.Footnote 51
Finally, digital media affordances provide efficiency in the enforcement of in/out of place rules by lowering the cost of intelligence discovery and dissemination. On the one hand, the replicability of digital data makes sharing information across a broad membership less labor-intensive. This shift is evident in how criminal factions have turned to WhatsApp groups as primary means for internal organization: they handle everything from collecting membership fees to deliberating on punishments for transgressions.Footnote 52 On the other hand, exploiting the increased availability of personal information on social media through affordances such as visibility and searchability facilitates the gathering of strategic intelligence. This represents a significant evolution from traditional methods like technologically complex wiretaps or labor-intensive physical surveillance. Police interviewees echoed this shift, noting that investigations are moving from a reliance on personal witnesses toward a primacy of digital proof.Footnote 53
These findings have some limitations. Importantly, the intersection of hybrid order and digital platforms raises several transversal questions that demand further exploration, although they are beyond this article’s scope. One is the paradox of motivation: Why do armed actors produce digital content that may eventually be weaponized against them? Another, relatedly, is the issue of adaptation: How do those living under hybrid order navigate such pervasive digital surveillance? These issues create significant tension, because digital technologies offer important benefits even in these contested spaces—from efficiently signaling strength to rivals to staying connected with relatives across ‘enemy’ territoryFootnote 54—yet simultaneously create profound vulnerabilities.
Although not the focus of my fieldwork, I came across various strategies used to resist digital surveillance. These ranged from criminal factions studying expert depositions in judicial reports to understand and counter police digital investigation methodsFootnote 55 to residents constructing “digital alibis” by photographing themselves in various city locales during their commutes to gain plausible deniability regarding their home territory if subjected to a forced smartphone inspection.Footnote 56 Such adaptative strategies and their impact in the effectiveness of digital surveillance deserve focused attention in future research.
The ethnographic nature of this research involves contextual elements that should be considered when applying my insights to other settings; each element also presents potential avenues for future research. First, the research was conducted in an area with high rates of internet penetration and smartphone ownership, including among the urban poor. As Gohdes (Reference Gohdes2020) has shown, the utility of digital platforms as surveillance tools decreases significantly in areas with limited connectivity.
Second, even in areas with connectivity levels similar to Fortaleza, these results are shaped by a specific media environment. The availability of different digital platforms and varying sociocultural repertoires among armed actors may make different affordances more significant. Furthermore, diverse media regulatory environments, such as those concerning data privacy or internet censorship, as well as other factors like algorithmic filtering and AI tools, can significantly alter the opportunities and constraints armed actors face while navigating digital networks.
Lastly, as previously specified, this research focuses on urban communities under active or latent territorial threat, where information gathering is essential to identify threats and project force. In contexts where a single criminal group exercises unrivaled control, digital information gathering may be less salient or used in distinct ways. In short, although the broader mechanism identified here—the affordances of digital platforms—may be applicable to armed actors’ territorial strategies elsewhere, its specific manifestations will likely vary according to the local context.
Conclusion
This study has shown how digital communication platforms have become instrumental to the exercise of territorial control by armed groups in contested urban peripheries. Analyzing the case of Fortaleza in Northeastern Brazil, it illustrates how both militarized police and so-called criminal factions leverage the affordances of digital media platforms to gather strategic intelligence in areas under hybrid order: marginalized urban communities where social order is negotiated between state and nonstate armed actors. Through a comparative ethnographic design involving participant observation, semi-structured interviews, netnography, and open-source research techniques, I identified three digitally mediated information-gathering practices: the inspection of smartphones, the creation of information-sharing networks, and the surveillance of rivals through social media. Analyzed together using an affordances-based approach (boyd Reference boyd2014), these reveal the emergence of a digitally networked model of territorial control, in which accessing information in digital platforms become key to how armed groups enforce rules governing who belongs within a bounded geographical area.
The article makes four central contributions. First, it intervenes in the literature on criminal violence and policing in Latin America by illustrating the importance of digital networks in contemporary forms of urban conflict. Specifically, it extends existing research on territorial control in criminal governance (Barnes Reference Barnes2022; Lessing Reference Lessing2015; Magaloni, Franco-Vivanco, and Melo Reference Magaloni, Franco-Vivanco and Melo2020), providing a mechanism to explain how criminal groups manage to establish control in areas “surrounded and intermittently penetrated by strong state power” (Lessing Reference Lessing2021, 855). As argued, digital affordances enable effective and efficient intelligence discovery and flexible territorial coordination, facilitating the identification of rival threats and the implementation of strategic decisions regarding whether to hide, bribe, or fight during police operations. Moreover, this study contributes to the discussion on hybrid order (Dewey, Míguez, and Saín Reference Dewey, Míguez and Saín2017; Sanchez and Cruz Reference Sanchez and Cruz2024), showing how militarized police engages in a combination of legal and extralegal digitally mediated information-gathering practices that mirror those used by criminal groups—therefore blurring conventional distinctions between state and nonstate governance.
Second, this research bridges scholarship on urban conflict with research on civil wars, building on seminal work on information gathering and territorial control by political insurgents (Gohdes Reference Gohdes2020; Kalyvas Reference Kalyvas2006). The findings suggest that although scholarship has traditionally prioritized informants as the main source of intelligence for armed actors disputing territory (175), digitalization has rendered “material indices” (e.g., captured images and documents) easier to access and, thus, increasingly useful. This insight could be especially relevant for researchers exploring rebel governance in territories formally under state authority, as such settings approximate best the conditions of hybrid order (Uribe and van Baalen Reference Uribe and van Baalen2024, 27). For instance, future research could productively explore how digital tools enable the construction of informant networks across frontlines and how this shapes violence patterns.
Third, the findings may also be of interest for researchers of state violence, particularly those exploring surveillance in contexts of authoritarianism and repressive policing. Extant scholarship has demonstrated how high-capacity autocracies successfully implement sophisticated digital surveillance tools to repress opponents (Xu Reference Xu2021). Even in formally democratic contexts, enforcement agencies—ranging from border authorities to local police—increasingly use digital footprints to categorize and target marginalized groups (Mahmoudi and Denyer Willis Reference Mahmoudi and Willis2025). The approach presented here can provide granularity into ground-level strategies deployed by state agents in such settings. For example, pro-government paramilitaries in Venezuela conduct forced smartphone inspections in street checkpoints aimed at identifying dissidents (Carroll and de los Ángeles Graterol Reference Carroll and de los Ángeles Graterol2026), and ICE agents in the United States monitor personal social media profiles to coordinate targeted deportation raids (Bennett Reference Bennett2025). Ultimately, as central governments increasingly acquire high-tech surveillance tools, the everyday practices of street-level bureaucracies may also rely on low-tech techniques that are best illuminated through immersive affordance-based approaches.
Lastly, this article contributes to the growing body of literature examining the impacts of digitalization on socially disadvantaged communities (Nemer Reference Nemer2022; Stuart, Reference Stuart2020b). Although traditional development discourse has framed digitalization through the lens of a quantitative North–South divide in access (ITU 2021), more recent scholarship has emphasized the importance of qualitative differences in the uses and consequences of digital technologies (Stuart Reference Stuart2020b, 21). In particular, Nemer (Reference Nemer2022) showed how residents of Vitória’s (Brazil) urban periphery appropriated digital technologies to resist multiple forms of social oppression from navigating precarious job markets to maintaining contact with family members living in gang-controlled territories. This article presents the other side of the coin, emphasizing how digital platforms can also reinforce and intensify existing dynamics of armed control.
Acknowledgments
My deepest thanks go to the many participants whose real names I cannot disclose but who graciously opened doors—often, of their homes—to support my fieldwork, especially Claudio, Seu Jorge, and Suianne. I would like to express my heartfelt gratitude to Graham Denyer Willis for his generous supervision and to Rebecca Tapscott for her constant support. I am also thankful to the vibrant research community that guided me on my first arrival to the Northeast, particularly Jania Perla Diógenes de Aquino, Luiz Fabio Silva Paiva, Thiago Nascimento, Lucas Barbosa, Marcondes Brito da Costa, Thiago Lopez Brandão, Roberto Barbosa de Moura, Fernando de Jesus Rodrigues, and everyone else in the LEV-UFC. This article has also benefited from the thoughtful feedback of Philip Luke Johnson, Nicholas Barnes, Daniel Barker Flores, Pedro Mendes Loureiro, Bruna Angotti, Promise Ejiofor, Ana Lucía Pelaez Echeverría, Lila Gaudêncio, Ana Rojo Fierro, Rafael Andres Shimabukuro Cabrera, Andrés Sevilla Gaitan, and the three anonymous reviewers. Earlier drafts were presented at the 2024 Congress of the LEV-UFC, and the 2025 Conflict and Change PhD Workshop at University College London. Extra thanks to those who made Cambridge and Fortaleza a home for me over the past years, particularly Mayra, Juan, Pedro, Priya and Harriet.
This research was generously supported by La Caixa Foundation (Grant No. B005741) and the Cambridge Trust.
Appendix
Detailed information on interviewees
Table A1. Long description
The table contains 81 entries organized into six columns: No., Date, Gender, Category, Sub-category, and Area.
* The dates range from October 2023 to June 2025.
* Gender distribution includes Male, Female, Non-binary, and a group entry.
* Categories include Experts, Police, Areas under hybrid order, Legal system, Activist, Admin social media group, Criminal faction, and Civil Society.
* Sub-categories specify roles such as Journalist, Military Police, Civil Police, Community leader, Researcher, Government, Lawyer, Resident, Prosecutor, Police misconduct board, Information channel, Prison Police, P F, and former criminal faction leaders from C V and P C C.
* Geographic areas listed are Fortaleza, Campo Iracema, Picos, Teresina, Maceió, São Luis, Salvador, and Recife.
Key entries include:
* Entry 1: 11/10/2023, Male, Experts, Journalist, Fortaleza.
* Entry 3: 16/10/2023, Male, Police, Military Police, Fortaleza.
* Entry 40: 17/06/2024, Male, Criminal faction, Former leader - C V, Maceió.
* Entry 67: 05/05/2025, Non-binary, Areas under hybrid order, Resident, Fortaleza.
* Entry 75: 27/05/2025, Male, Police, P F, Fortaleza.
* Entry 80: 26/06/2025, Male, Criminal faction, Former leader - P C C, Maceió.
Categories of digital media channels associated to armed actors
Table A2. Long description
The table consists of five columns and five primary rows of data.
1. Information Channels (Grupos de informações, plantões de notícias): Platforms include Instagram, Telegram, and Whatsapp. Affiliation is none, though monitored by police. Access is public via Instagram links. Content shared includes media of crime scenes, suspect information, recovered goods, drug/weapon seizures, and local business publicity.
2. Police Groups (Grupos de policiais): Platforms include Whatsapp, Telegram, and Signal. Affiliation is Police. Access is restricted to public security members by invitation. Content shared includes suspect information, crime scene media, and photos of recovered goods.
3. Tip-Off Profiles (contas de bizú): Platform is Instagram. Affiliation is Police. Access is public. Content shared includes requests for anonymous tips, crime scene media, police interventions, and displays of weapons or tactical gear.
4. Criminal Faction-Affiliated Accounts (contas de facionado, contas de torcedor de facção): Platforms include Instagram, Tiktok, and Kwai. Affiliation is Criminal factions. Access is public. Content shared includes Decretos (targeted rivals), propagandistic memes/music, Salves (public directives), and displays of territorial violence.
5. Criminal Faction Groups (grupos de facção): Platforms include Whatsapp, Telegram, and Signal. Affiliation is Criminal factions. Access is restricted to members, often stratified by hierarchy. Content shared includes real-time movement updates, internal administration (funds/registration), media of murdered rivals, propaganda, Decretos, and internal Salves regarding truces or prison rules.
Open access
