The cops were the target. The board was not.
Juárez spent years with cartels hunting its own police. CNN, February 2012: eight officers killed in two weeks, banners demanding the chief resign, the force sleeping in hotels under 24-hour guard. Dallas Morning News, April 2013: hundreds applying again once the city started to claw the department back. One officer said they had been “hunted like animals.”
That war is already in the papers. What is not: the 911 board that tells those officers where to go — call class, street, colonia, timestamps, operator labels, caller name and phone — was left on a public ArcGIS FeatureServer. No login. No token. Anyone who could type a URL could read the city’s emergency nervous system. Nobody wants to talk about that part.
Found at — the raw ArcGIS REST surface
This is the source. Anyone with a browser could open it. That is the finding.
| What | URL |
|---|---|
| CERI host | https://ceri.juarez.gob.mx/ |
| ArcGIS REST directory | https://ceri.juarez.gob.mx/server/rest/services |
| JSON catalog | https://ceri.juarez.gob.mx/server/rest/services?f=json |
| FeatureServer (CargaLlamadasEmergencia) | https://ceri.juarez.gob.mx/server/rest/services/CargaLlamadasEmergencia/FeatureServer |
| Layer 0 · LlamadasEmergencia | https://ceri.juarez.gob.mx/server/rest/services/CargaLlamadasEmergencia/FeatureServer/0 |
| Count query (example) | FeatureServer/0/query?where=1=1&returnCountOnly=true&f=json |
The drop
HTTP archive, torrent, and checksums live on the ODINT data server. Same ZIP in all three places.
ZIP SHA-256 e93bfabc0cab88ef46f4fc188189b4e1aa047f3de8bc973ae32d8131067ac2ff
Database SHA-256 02045f609aa99715d04a4ce593975d9abf6fd4010e1b584254077aed51f30e09
DVD volume JUAREZ_CAD_20260916
What sat on that FeatureServer
Not a tourist map. A live-adjacent emergency call feed — the board operators use to track 911-style demand — published as GIS features. Layer name: LlamadasEmergencia. Service: CargaLlamadasEmergencia.
Public attributes included call class, street and colonia, dispatch timestamps, operator labels, free-text comments, and in many rows caller name and phone.
No encryption was broken. No operator was phished. No stolen dump was purchased. The server answered anonymous HTTP.
| Type | Count | Plain English |
|---|---|---|
| LLAMADA MUDA | ~2.45M | Silent / no voice |
| LLAMADA INCOMPLETA | ~1.50M | Incomplete call |
| OTRAS LLAMADAS IMPROCEDENTES | ~1.31M | Improper / non-proceedable |
| Violencia contra la mujer | ~201,000 | Violence against women |
| Detonación de arma de fuego | ~18,956 | Gunfire |
| Homicidio | ~6,652 | Homicide-type calls |
Caller names, phones, and addresses stay off this page. Those fields exist in the source layer and therefore in the research SQLite. Aggregates are the public story.
Method
OSINT methodology
No sealed law-enforcement system was accessed. Only publicly reachable ArcGIS REST services and the resulting research capture. No authentication was bypassed. No credentials were tested. Capture started 8 July 2026. Historical backfill marked complete. Latest included poll: 2026-09-16T04:54:06.546064 UTC. Oldest recorded incident: 2019-01-22. Newest: 2026-09-15.