Click here to read our latest report “Transmisogyny, Colonialism and Online Anti‐Trans Activism Following Violent Extremist Attacks in the US and EU”

Friend of the Locals, Enemy of the State: The Social Media Presence of Comando Vermelho

Friend of the Locals, Enemy of the State: The Social Media Presence of Comando Vermelho
17th June 2024 Lucas Almeida
In Insights

*Disclaimer: To uphold transparency about the posts reflected in this Insight, some posts and accounts presented here were current as of June 2024 while others were recorded earlier for the author’s thesis work and have since been removed by X’s moderation team. Additionally, the author discussed some accounts and signals in an invited talk to X’s (formerly Twitter) Dangerous Organizations Team in July 2022.


Modern terrorism, or the use of violence against civilians for intimidation towards political goals, is particularly enmeshed with criminal groups in Latin America. It has been noted that such groups have deep social ties with populations and are extremely effective in gathering support by either cooptation or intimidation, residing in the grey zone of criminal insurgency.

Despite their level of threat, such entities have been considerably understudied in terrorism literature on their online presence. Most of the studies looked into Mexican Cartels, finding complex behaviour that again hybridises intimidation, wealth, power, religion and political statements. Brazilian groups are entirely missing from the corpus of analyses, despite being old, powerful, and capable of challenging the local government, particularly in Rio de Janeiro. The world-famous city has more than 55% of its territory subject to some armed control by criminal insurgents, and locals are subject to both chronic and acute violence.

This Insight presents the use of social media by Comando Vermelho, one of the most dangerous organised crime banners in Latin America. Despite a gap in academic literature on this subject, there is substantial activity by affiliated individuals on X and other platforms. True to their late 70’s roots in the hybridisation of leftist guerrilla with bank robbing gangs, the members not only showcase selling drugs and brandishing rifles, but announce new rules to locals, display their charitable deeds, glorify the lost soldiers and engage in anti-government discourse. The findings here are the preliminary work for the author’s forthcoming PhD dissertation in Network Science at Northeastern University, which provides a large-scale analysis of the social media presence of criminal insurgent factions of Rio de Janeiro, including mapping the connections and long-term correlations with real violence.

Figure 1: CV member poses with a scenic view.

Comando Vermelho

Comando Vermelho – CV(Red Command) is one of the most powerful transnational criminal organisations in the southern hemisphere and has its birthplace in Rio, born from the cross-pollination of Marxist guerrilla ideas with common criminals. In the 70’s, the group’s goal was ostensively to provide mutual protection and fight for better incarceration conditions against, as they saw, an oppressive system. Starting in the 80’s, it was able to leverage the relative lawlessness of the favelas (slums) into a safe haven for selling drugs to more affluent citizens. The two major consequences of that territorial control were first, the escalation of violence to defend the turf against police or rivals, with the use of high calibre weapons and irregular warfare methods, going beyond in intensity than any major region in the country. The second long-term consequence was the embeddedness of CV’s criminal group identity with that of locals, even those not involved in crime, partially due to the governance functions performed by the faction. The general perspective of local bosses was that content civilians would make drug sales smoother, with some of the profits being reinvested in the community in the form of social actions, community pools, or simply buying from small businesses. They often use the phrase Amigo do Morador- Inimigo do Estado (Friend to the locals, enemy to the State) to synthesize the intended approach. The tradeoff of noncompliance (or the perception of noncompliance) is usually brutal and, in the case of collaboration with the police, lethal.

While initially paradoxical, the publicity of such actors in social media follows a long-established practice of cultural propaganda, since the early 90’s bosses sponsor funk anthems that glorify the lifestyle and the group itself, being intimately attached to its turf. Initially played in public parties and distributed via illegal CDs, since at least the early 2000’s there were official sites and sharing of criminal anthems online. Such activity on YouTube is also well established, with multiple propaganda videos reaching millions of views and being accessible from  2006 to the present day. Dedicated social media platforms have been fertile ground for that same propaganda, with reports of individual profile activity in local and international press.

Reading the Signs

It is clear that affiliated individuals are not trying to hide their membership in such groups as CV. In fact, it is quite the opposite; being proud of one’s faction is a central tenet of the ideology. The example profile below from X is a soldado (soldier), a member with a high enough ranking to be trusted with weapons, illustrating the wealth of information provided willingly by themselves.

Figure 2: Example of a soldier’s profile.

  1. Red Flag 🚩 – Probably the most common symbol used to show affiliation to Red Command
  2. Bee 🐝 – Shows the individual is under the command of Abelha (bee), the top local head of CV.
  3. Bear 🐻 – Shows he is a member of the Tropa do Urso (Bear Troop), a “special operations” division of CV with the most experienced shooters that takes territory from rivals and confronts the police.
  4. The username makes reference to the FAL rifle, of restricted use to military and a “status” weapons among outlaws. The use of 22 also refers to CV number code (2).
  5. Tropa do Mel (Honey Troop) reinforces his direct affiliation with Abelha and not under any sub bosses.
  6. Photo location mentions Complexo da Penha, one of Rio’s largest favelas and main headquarters of CV in the city.Also notice the face being covered by a sticker. Some profiles do that , while others are more brazen.

Criminal Life

The most common use of the profiles is cyberbanging, the demonstration of a criminal lifestyle and its benefits, such as weapons, drugs, money, cars, and parties. Among many uses, the intimidation of rivals and sometimes the police is clear. No item is more of a status symbol among the outlaw community than weapons, with Rifles being particularly coveted. Their extremely high prices on the black market (circa 10.000 USD in 2019) mean they have to be acquired by the faction and entrusted to affiliates that are known to be reliable and experienced, making them proud to showcase them. Similarly, acquiring a rifle from a rival faction is particularly prized and also showcased as a trophy of victory, as in Figure 3.

Figure 3: Member displays rifle captured from rivals with the caption: “We love the gift, one more for the boss’s collection.”

Figure 4: Member displays a new lot of marijuana; notice the standardised packaging and branding.

Figure 5: Member displays his date while being armed with a rifle. Notice the effort to cover only his face.

It should be mentioned that the personal and the “professional” are normally mixed for users. Romantic phrases and motivational memes are often found side by side with the outlaw content and reinforce the normalisation of that way of life. This phenomenon is highly correlated with the user’s ranking and role in the gang, with leaders being more likely to post positively on their perceived community impact.

Pseudo Governance

Figure 6: CV members display charity donations given to the community on Children’s Day and show the “peace” of their domains from high ground.

It is known that these groups not only control the illegal activity on each favela, but multiple other aspects of civilian lives in what is known as criminal governance.  There were examples during COVID-19 of efforts to enforce social distancing. One of the most surprising uses of social media by CV is the employment of profiles that aim to pass public messaging to the local communities. As they embrace the propaganda of protectors and rulers, some pages become an official ‘voice’ of the faction for each locale. This is similar to the Narco-Messages displayed publicly by cartels across Mexico with goals of competition, intimidation and morale-boosting. A clear example of such efforts is Figure 7, which sets “safety rules” for cars entering a territory. The message tone is polite, using common phrasing of customer services, and asks locals for understanding and collaboration.

Figure 7: Governance Compliance

Translation: Warning🚩🐻 I thank the collaboration of all. I come to inform you for everyone’s convenience that, when entering the favela’s surroundings, please signal with your hazard lights, hall lights on, low beams and windows down. We are not here to harm or delay anyone, everyone collaborating everything will work out. this applies to residents and Uber ass: red command 💪🐻🇧🇭🚩

There are more ominous examples, particularly when dealing with rivals and police. As noticed, symbology is highly important for criminal groups. It is known, for example, that in the areas controlled by CV, individuals should avoid mentions of the number 3 as it is the main abbreviation of its rival, Third Pure Comand (TCP), which also does a three-finger hand sign. In Figure 8, a CV profile gives a warning that anyone doing that sign will be treated not as a civilian but as a bandit. It is done as a quote tweet from an official TCP profile. What is hinted at by the reply is that some might be doing that hand sign but are not true members of the rivals.

Figure 8: Governance Warning

Translation:  Whoever makes the sign of a faction knows what they are doing… We hope that everyone is a man to accept the sign they make, without their crying mother giving an interview that he was a student and a worker… A stick that hits chico hits francisco, they’re going to get hit like (rival faction)!  Then they don’t say that the gypsy didn’t warn you.

Finally, the digital audience is not restricted to locals and rivals, with communication targetting peers from the group or fulfilling an administrative goal. The figure below displays a public recruitment call by which the CV chapter of that region was calling the crias (offspring – what they call those born and raised inside a neighbourhood) that have been away from the group and did not engage in treachery or joined a rival, that they are welcome to join back. The call was retweeted by other CV pages in an effort to gain a broader reach.

Figure 9: Governance Recruitment

Translation: 🚩2️⃣💪 intelligent management 🚩 ,I come to communicate to all the crias in the city that are away from the city of engenheiro pedreira, that want to return to their origin 🚩2️⃣ and that remained in purity to come, because CV 🚩2️⃣ will receive all of you with open arms, everyone just needs make contact with the +..

Terrorism Rapport

One of the recurrent debates regarding such groups is the extent to which they can be placed in the terrorism or insurgency spectrum, given their lack of an ultimate political goal. However, recent legislation proposed in Brazil has designated CV firmly as a terrorist entity. Some of its members seem to agree and directly borrow references to Islamic terrorism. Note that it should not be inferred that such proximity is any particular religious connection, but as a way to place themselves as enemies of the state and acquire shock value.

Figure 10: Multiple identifiers of terrorist rapport, including a photo of Osama Bin Laden, the use of the “Taliban” username, and the self-identification as “enemy of the state.”

The “fallen soldier” style of social media posts is common, where a peer of the group who has perished in conflict with the police or rivals is extolled with a montage. This is quite similar to the modus operandi of jihadist martyrdom glorification and goes beyond the individualistic narrative of criminal groups. Some of the most famous criminal anthems have lists of “comrades” lost in the war.

Figure 11: Fallen Soldier Examples, displaying memorial videos of comrades dancing, shooting, and engaging in other activities. The audio track usually mentions their loyalty to the group and willingness to fight to death.


Figure 12: Visualization of 900 profiles of CV members collected in 2021 in the X social network and their friendship ties. Notice the colours show distinct geographical communities that nevertheless are highly connected with each other.

Latin America harbours the largest concentration of homicides outside of conflict zones, and criminal insurgent groups have a disproportionate contribution to that violence. Much of their resilience is owed to the social capital ties with locals, and we lack a good understanding of the mechanisms used to maintain that status. As shown by this Insight, these groups are not only violent, but the threat of terror against civilians or the government is ever-present. The ascent of social media for their communication gives an unprecedented opportunity to map and analyse such shadow actors that have been broadly cast aside in the debate of global extremism. More research and collaboration between platforms and academia is urgently needed to bring our understanding to the same level as other threat actors.

In this context, it is important to suggest that specific moderation guidelines be set for grey-zone community pages. While they might have violent content and serve as propaganda venues, they are also crucial vessels of information for civilians to navigate a perilous reality, and thus, information on dynamic situations and areas to avoid can be the difference between life and death. The loss of such reliable channels due to suspension or banning is more harmful for those not involved than to outlaws themselves. While the total number of profiles and pages is unknown, preliminary analysis in 2021 by the author of Figure 12 shows a robust presence organised mostly around geographical boundaries of different favelas, suggesting that the primary affiliation of individuals is to the turf instead of the group’s flag.

Finally, this opens a promising avenue for harm reduction strategies for a population that is notoriously hard to reach and even more difficult to engage with. The publicity of some of these groups raises the possibility of using existing online Ad delivery infrastructure to target de-radicalisation and disengagement interventions. Given the possibility that recruitment is the most effective leverage point to contain cartels and similar threats, this intervention pathway merits serious consideration and evaluation.

Lucas Almeida is a Network Science PhD candidate at Northeastern University.  He holds a Masters in Complex Systems Modelling from the University of São Paulo and a Bachelor’s in Political Science from the University of Brasilia, as well as having experience as a Policy Analyst in the Brazilian Parliament before moving to academia. His research merges data science methods with domain knowledge to map dark networks, as well as understanding problems in other highly connected phenomena.