This working paper applies formal ontology and spectral graph analysis to the network of relationships established at trial in United States v. Hernández (SDNY, 2024). The subject was convicted of narcotics conspiracy and weapons offenses on 8 March 2024, sentenced to 45 years, and pardoned by executive clemency in December 2025. This analysis is not concerned with the disposition of the criminal case, which has been adjudicated, nor with the political question of clemency. It is concerned with an epistemic question the trial did not directly address: given the network structure established by the courtroom record, what does that structure imply about the informational position of the defendant?
Using the Transnational Organized Crime and State Capture Ontology (TOCSC-O; Brattin, 2026a), an OWL 2 ontology developed by the author with W3C PROV-O provenance tracking, the author encodes the courtroom-documented network of persons, institutions, and relationships as a formal knowledge graph. Every asserted edge carries a per-claim reliability annotation. Applying standard measures from Fiedler (1973), Burt (1992), Shapley (1953), and the dark-network criminology literature (Morselli, 2009), the subject is identified as an articulation point of the network, with removal producing complete algebraic disconnection (Fiedler value → 0) and separation into seven components. The subject's position is statistically distinguishable from random (Monte Carlo p = 0.003, n = 1,000 randomized null graphs). Fifty-three percent of paths between state institutions and criminal actors in the documented network traverse the subject exclusively.
These structural properties, taken together, are argued to establish that the informational condition of ignorance regarding the network's operation was not attainable from the subject's documented position, within the class of network topologies represented by the courtroom record. This paper is the first published application of the TOCSC-O ontology, whose formal specification is documented in a companion technical report (Brattin, 2026a). Complete ontology implementation and reproducibility artifacts are proprietary to Trace Origin Research and made available for academic verification under NDA. The paper concludes with limitations, an explicit distinction between epistemic and legal claims, and directions for extension.
The trial record as a source of network data.
On 8 March 2024, a jury in the United States District Court for the Southern District of New York returned a unanimous verdict of guilty on three counts against the defendant: (i) conspiracy to import into the United States 500 grams or more of cocaine; (ii) using and carrying machineguns and destructive devices during and in relation to said conspiracy; and (iii) conspiracy to use and carry firearms during and in relation to said conspiracy (USDNY, 2024). Sentence was imposed on 26 June 2024 at 45 years' imprisonment. On 22 December 2025, executive clemency was issued, releasing the defendant from custody. The pardon did not vacate the conviction, and the trial record remains a matter of permanent public documentation.
The corpus of that trial record, together with the associated proceedings against co-defendants and cooperators (including United States v. Juan Antonio Hernández Alvarado, 2019, and United States v. Bonilla Valladares, 2024), constitutes the primary data source for the analysis that follows. The court-established facts include: (a) a documented delivery of cash by the leader of the Sinaloa organization to the defendant's brother in 2013 for onward transmission to the defendant's presidential campaign; (b) a physical exhibit consisting of a submachine gun bearing the defendant's name and presidential title, recovered from the co-defendant brother; (c) drug-trafficker ledgers naming the defendant by initial as a recipient of trafficking proceeds; and (d) the guilty pleas of the defendant's cousin and of his appointed National Police Chief to narcotics trafficking and, in the latter case, to murder in furtherance of trafficking.
This paper takes no position on the underlying criminal question, which has been adjudicated. It takes the trial record as an empirical corpus of documented relationships and asks what the structural properties of that corpus imply about the informational position of the central node. The distinction between the courtroom's question (whether the defendant knowingly conspired) and the network-analytic question (whether ignorance was structurally attainable from the documented position) is developed in §5.
TOCSC-O: an OWL 2 ontology for state-capture networks.
The Transnational Organized Crime and State Capture Ontology (TOCSC-O; Brattin, 2026a) is an OWL 2 DL ontology developed by the author for the formal representation of criminal networks embedded within state institutions. It is a contribution of this line of work rather than an application of pre-existing infrastructure: no comparable ontology integrating state-capture typology, dark-network structural roles, and per-claim provenance annotation is known to exist in the published semantic-web literature at the time of writing. TOCSC-O is aligned to the W3C Provenance Ontology (PROV-O) for per-claim attribution and reliability annotation, and to the SKOS vocabulary for the classification of criminal offense types across national penal codes. The core class hierarchy includes StateInstitution, CriminalActor, CooptedStateActor, EvidenceAssertion, and NetworkRole. Core object properties include cooptedVia, capturedVia, hasNetworkRole, and reliabilityRating. The high-level specification is documented in a companion technical report (Brattin, 2026a). The complete Turtle serialization, SHACL constraint set, reasoner configuration, and detection heuristics remain proprietary to Trace Origin LLC and are made available for academic verification under NDA. This paper is the first published case application.
Every asserted edge in the case-derived knowledge graph carries a reliability annotation drawn from one of three levels: Verified court for facts entered as evidence at trial and reflected in the sentencing record; Corroborated for facts reported in multiple independent open sources and consistent with the courtroom record; and Model-derived for conclusions that follow from the graph structure rather than from any single documented edge. The visual distinction is preserved throughout the analysis below. No inference of the third type is treated as equivalent to a court finding.
The analytical layer applies standard techniques from three literatures. Dark-network criminology (Morselli, 2009) provides the framing for the analysis of covert networks embedded within legitimate institutional settings. The Co-opted State Reconfiguration framework (Garay-Salamanca & Salcedo-Albarán, 2011) provides the classificatory vocabulary for stages of institutional capture. Spectral graph theory (Fiedler, 1973) provides the algebraic-connectivity measures used to characterize the subject's position. Additional measurements draw on Burt (1992) for brokerage and structural holes, Shapley (1953) for game-theoretic centrality, and Barabási (2016) for network resilience.
Ontology and query stack (technical appendix)
The ontology is expressed in OWL 2 DL and serialized as Turtle
(tocsc.ttl). SHACL shapes constrain admissible values
for reliability ratings and network-role classifications. Every
network claim in this paper reduces to a SPARQL query against the
instance graph. Measurements were computed using NetworkX 3.2
against Erdős-Rényi null graphs matched on node count and edge
density (n = 1,000). The full ontology, seeded instance graph,
query set, and null-model computation notebook are proprietary
infrastructure of Trace Origin LLC and are made available
for academic verification under NDA (Trace Origin LLC, 2026).
Example: the query identifying articulation points.
PREFIX tocsc: <http://traceoriginresearch.com/ontology/tocsc#>
PREFIX sna: <http://traceoriginresearch.com/ontology/sna#>
SELECT ?actor ?betweenness ?isArticulation
WHERE {
?actor sna:betweennessCentrality ?betweenness ;
sna:isArticulationPoint ?isArticulation .
FILTER (?isArticulation = true)
}
ORDER BY DESC(?betweenness)
Court-established relationships as edges.
The instance graph is constructed exclusively from relationships attested in the trial record and its associated proceedings. Nodes represent persons and institutions. Edges represent relationships of kinship, appointment, financial transfer, or operational coordination, each sourced to a specific document in the case file. This section presents two figures illustrating the nature of the documented relationships. Both figures represent facts entered as evidence at trial and are annotated Verified court.
3.1 A documented financial pathway
The trial record establishes a two-hop path from the leadership of a major transnational trafficking organization to the defendant's electoral campaign, via the defendant's brother as a documented intermediary (USDNY, 2019; USDNY, 2024). The path is not inferential. It was established at trial through witness testimony admitted as evidence and reflected in the sentencing memoranda of both proceedings.
3.2 A documented physical exhibit
The following exhibit was recovered from the defendant's brother and entered as evidence at trial. Its inscription is a matter of photographic record in the case file.
Juan Orlando Hernández
Presidente de la República
The exhibit is analytically relevant not for its evidentiary role at trial (which the jury has already adjudicated) but as a datum regarding the visibility of the defendant's identity within the network's operational surface. An engraved dedication is not a clandestine communication. It is an assertion of association, preserved in metal.
The subject as an articulation point of the state-criminal graph.
An articulation point in a connected graph is a node whose removal disconnects the graph into two or more components (Barabási, 2016). Applied to the case-derived instance graph, the subject satisfies this property: simulated removal fragments the network into seven connected components. The Fiedler value (the second-smallest eigenvalue of the graph Laplacian) drops to zero on removal, which is the formal definition of complete disconnection (Fiedler, 1973). The subject's articulation-point status is not sensitive to reasonable variations in edge inclusion criteria within the reliability tiers described in §2.
The subject's position is further distinguishable from what would emerge from random placement in a network of the same size and density. Against a Monte Carlo null model of 1,000 Erdős-Rényi random graphs matched on node count and edge density, the subject's betweenness centrality corresponds to z = 4.14, p = 0.003. By betweenness the subject ranks second in the network; by degree, first. Table 1 summarizes the principal structural measurements.
| Measure | Framework | Value | Rank (percentile) |
|---|---|---|---|
| Algebraic connectivity loss on removal | Fiedler (1973) | 100% | |
| Connected components on removal | Barabási (2016) | 7 | |
| Paths requiring subject exclusively | Exhaustive enumeration | 53% | |
| Monte Carlo null-model significance | Erdős-Rényi (n = 1,000) | p = 0.003 | |
| Shapley-value centrality | Shapley (1953) | 96.5% | |
| Burt constraint (structural holes) | Burt (1992) | 0.15 |
These measurements converge on a single characterization: the subject occupies the sole bridge between the criminal and state-institutional subgraphs. This is a property of the documented network, not of the subject's mental state. The consequences for informational access are developed in §5.
Four propositions.
We now consider what the structural properties in §4 imply for the informational condition of the subject. The claim advanced here is epistemic, not legal. The question is not whether the subject in fact knew of the network's operations, which has been adjudicated by the trier of fact. The question is whether the informational condition of ignorance is attainable from the network position the documented record establishes. Four propositions are developed.
By the algebraic-connectivity measure of Fiedler (1973), the subject is an articulation point of the case-derived graph. Fifty-three percent of paths between state institutions and criminal actors in the documented network pass through the subject's node and have no alternative route. Under the model of information flow standard in dark-network analysis (Morselli, 2009), the traffic on such paths reaches the intermediary node. There is no topological structure in the graph consistent with such traffic passing without transit through the bridging node.
Fiedler (1973); Morselli (2009). Full derivation in §4 and Table 1.The court-established network reveals a highly non-random distribution of relationships across the operational core. The subject's brother received a life sentence in a separate 2019 proceeding for trafficking 185 metric tons of cocaine. A first cousin pleaded guilty to related offenses and occupied a position within the National Police that afforded operational access. Under standard criminological treatments of kinship as organizational infrastructure (Morselli, 2009, ch. 6), the concentration of criminal-network roles within a single kinship group of a public officeholder is not a pattern consistent with lack of awareness on the part of the officeholder.
USDNY (2019); USDNY (2020); Morselli (2009).The individual appointed by the subject to head the Honduran National Police subsequently pleaded guilty in United States federal court to protection of narcotics shipments and to murder in furtherance of trafficking. The appointment was made by the subject, the individual was retained across multiple years despite documented operational activity, and the appointee's proximity to the subject's kinship group is a matter of the trial record. Under the Co-opted State Reconfiguration framework (Garay-Salamanca & Salcedo-Albarán, 2011), this pattern is diagnostic of capture stage 3 (institutional reconfiguration), which by definition requires operational coordination between the appointing authority and the appointee.
USDNY (2024, Bonilla); Garay-Salamanca & Salcedo-Albarán (2011).Trafficker ledgers introduced at trial contain entries attributing receipts of proceeds to the subject by initial. The ledger's author was subsequently killed under circumstances contemporaneously associated with the trial of the subject's brother, as were two additional persons in a position to give sworn testimony regarding the ledger's contents, all within a single week. The pattern of witness elimination is on the case record and does not require this analysis to interpret it. What follows from P1 through P4 jointly is that the informational structure surrounding the subject contained direct, physical, and repeated attributions of trafficking proceeds to the subject's own identity, from within the operational core of the network the subject bridged to the state.
USDNY (2019, 2024) sentencing memoranda; Honduran press coverage 2019.The four propositions above jointly support the following: within the class of network topologies consistent with the courtroom record, the informational condition of ignorance was not attainable from the subject's documented position. This is not a claim about the subject's moral culpability, which is a matter of law and has been adjudicated. It is not a claim about the subject's subjective mental state, which is not directly observable. It is a claim about the informational properties of a network position, and the inference is defeasible in the strict sense that discovery of new documented edges could alter the analysis. The reproducibility notebook permits recomputation against any revised graph and is made available for academic verification under NDA.
Eighteen-year documented conspiracy period.
The DOJ indictment establishes a conspiracy period from 2004 to 2022. Events on the trial record and in contemporaneous public documentation are summarized below.
Methodological contribution and application.
The methodological contribution advanced by this paper is not primarily a claim about the specific case but about a class of method, and about the formal infrastructure required to instantiate it. Prosecutions of high-level officials in captured-state environments confront a persistent evidentiary difficulty: the requirement to prove specific knowledge on the part of the accused, in networks where documentary evidence of knowledge is systematically suppressed by the network itself. The application of formal ontology and spectral graph analysis to the courtroom-established network offers a complementary form of evidence. Where documentary evidence proves what was said, structural evidence can characterize what was informationally accessible.
The specific infrastructural contribution offered here is TOCSC-O (Brattin, 2026a), an OWL 2 ontology that unifies three previously separate literatures: dark-network criminology (Morselli, 2009; Faust & Tita, 2019), the Co-opted State Reconfiguration framework from institutional political science (Garay-Salamanca & Salcedo-Albarán, 2011), and the W3C provenance and reasoning stack (PROV-O, SHACL, OWL 2). Each of these components has a mature literature. What has been less developed is their combination into a formalism whose case-derived instance graphs can be queried by SPARQL, validated by SHACL, and reasoned over by an OWL 2 reasoner, with every downstream claim carrying attribution back to its source document. The present paper is the first published case application of this formalism; the ontology itself is offered for peer criticism and extension.
The Co-opted State Reconfiguration framework (Garay-Salamanca & Salcedo-Albarán, 2011) provides the theoretical basis on which the findings are situated. The Hernández case has been characterized in academic and policy commentary as a paradigmatic instance of stage-3 capture. This paper offers a formal-methods contribution to that characterization: the network structure that CStR theory predicts should be present in a stage-3 case is, in this instance, quantitatively documented against the trial record.
What this analysis does not, and cannot, do.
The instance graph represents relationships documented in the trial record. It does not represent the underlying network in full. Dark relationships, undocumented actors, and edges suppressed by the network itself are, by construction, absent. The structural properties reported are properties of the documented subgraph, not of the true network. This is a general limitation of court-derived network analysis and cannot be resolved from within the analysis itself.
The propositions in §5 establish that ignorance was not informationally attainable from the documented network position. They do not establish moral culpability, criminal intent, or any legal element beyond what the criminal proceeding has already adjudicated. The paper is careful to distinguish structural-informational claims from legal claims and to reserve the terminology of proof for the former.
The centrality measures reported (Fiedler, Shapley, Burt, betweenness) each operationalize different theoretical constructs of network importance. The convergence of these measures on the same conclusion is presented as robustness, not as independent confirmation. If a reader rejects the underlying model of information flow that these measures presuppose, the epistemic claim of §5 does not follow. The author takes the position that the presupposed model is standard in the dark-network literature and defends its application in the technical appendix.
The subject of this analysis has been convicted in a court of law of the offenses discussed. Everything named in this paper is either a matter of the court record or a straightforward measurement against that record. The analytical claims respect the boundary between epistemically demonstrated properties of the documented network and questions of moral or legal responsibility that are not the paper's subject.
Cited works and case records.
Academic works
- Barabási, A.-L. (2016). Network Science. Cambridge University Press.
- Burt, R. S. (1992). Structural Holes: The Social Structure of Competition. Harvard University Press.
- Faust, K., & Tita, G. E. (2019). Social networks and crime: Pitfalls and promises for advancing the field. Annual Review of Criminology, 2, 99–122.
- Fiedler, M. (1973). Algebraic connectivity of graphs. Czechoslovak Mathematical Journal, 23(2), 298–305.
- Garay-Salamanca, L. J., & Salcedo-Albarán, E. (2011). Institutional impact of criminal networks in Colombia and Mexico. Crime, Law and Social Change, 57(2), 177–194.
- Meroño-Peñuela, A., Ashkpour, A., van Erp, M., Mandemakers, K., Breure, L., Scharnhorst, A., Schlobach, S., & van Harmelen, F. (2015). Semantic technologies for historical research: A survey. Semantic Web, 6(6), 539–564.
- Morselli, C. (2009). Inside Criminal Networks. Springer.
- Shapley, L. S. (1953). A value for n-person games. In H. W. Kuhn & A. W. Tucker (Eds.), Contributions to the Theory of Games, Vol. 2, 307–317. Princeton University Press.
Case records and prosecutorial documents
- United States v. Juan Antonio Hernández Alvarado, S6 15 Cr. 379 (PKC), USDNY (2019). Judgment and sentencing memoranda.
- United States v. Juan Orlando Hernández, S7 15 Cr. 379 (PKC), USDNY (2024). Trial record, jury verdict of 8 March 2024, sentencing memorandum of 26 June 2024.
- United States v. Juan Carlos Bonilla Valladares, S7 15 Cr. 379 (PKC), USDNY (2024). Guilty plea and sentencing memoranda.
- United States Department of Justice, Office of Public Affairs. Press releases and case updates, 2019–2024.
Ontology and companion technical output
- Brattin, E. (2026a). TOCSC-O: Transnational Organized Crime and State Capture Ontology. Version 1.0. Trace Origin LLC Technical Report TOR-TR-2026-01. OWL 2 DL serialization (Turtle), SHACL shape constraints, PROV-O provenance layer, SKOS penal-code vocabularies. Proprietary infrastructure of Trace Origin LLC; specification available for academic citation, complete implementation available for verification under NDA.
- Brattin, E. (2026b). Structural impossibility of ignorance in a captured-state network: a knowledge graph analysis of the Hernández case. Trace Origin LLC Working Paper TOR-WP-2026-02. [The present paper.]
- Trace Origin LLC (2026). Reproducibility notebook for TOR-WP-2026-02. Instance graph, SPARQL query set, NetworkX computations, Monte Carlo null-model scripts. Proprietary; available for academic verification under NDA.
