Ocana: a plot on the president, undone by social media
Colombian police captured Dairo Ferizzola Rojas, alias Firu or Firulais, at Ocana in Norte de Santander on 4 September. Police describe him as a designated sniper of the Camilo Torres Restrepo front of the Ejercito de Liberacion Nacional (ELN), and say he was tasked to take part in planning and carrying out an armed action against President Abelardo de la Espriella.
El Tiempo reports that investigators fixed his location from videos his partner was posting on social media. The man accused of preparing a long-range shot at a head of state was found because somebody close to him kept posting.
↓ Download one-page brief (PDF)19 June 2025 - two officers shot at long range
At Rio de Oro in Cesar, officers Herney Ospino Lasso and Jose Daniel Pedraza Gonzalez are shot while running a checkpoint. Investigators conclude a 5.56 mm rifle was used at distance. Reporting describes a payment of two million pesos ordered by a commander known as El Zorro.
June 2025 to February 2026 - three homicides charged
El Tiempo reports that the charges against Ferizzola cover three homicides across this period, along with firearms offences.
A partner posts videos
Investigators fix his location from material his partner publishes on social media. Intelligence indicates he means to leave the region.
4 September 2026 - captured at Ocana
DIJIN and DIPOL officers detain him at Ocana. He is carrying a 5.56 mm rifle cartridge. The president posts the capture the same day; the National Police announce it on 5 September.
The plot is stated, not detailed
Police and the president say he was designated by the North-Eastern War Front's general staff for an armed action against the president. No operational detail is released.
Rio de Oro, Cesar
Two police officers shot at long range at a checkpoint. A 5.56 mm rifle is identified. This is the case that produced the warrants.
Los Patios, Cucuta
A VBIED at a police station in the same department. Reported by Scorpius as Los Patios.
Ocana, Norte de Santander
Ferizzola captured. Police state the tasking against the president.
Military intelligence sources quoted by El Tiempo describe an ELN sniper programme running since 2008, studying the vulnerabilities, equipment and response patterns of the security forces in each operating area. If that is right, the relevant fact is not that one marksman was caught but that there is a system producing them, and a system is not disrupted by an arrest.
The plot is stated by the state, and the state is a party to it
The allegation of a plot against the president comes from the National Police and from the president himself, on the same day. That does not make it wrong, and both have access to intelligence nobody else can see. It does mean the only two sources for the most serious claim in the file are the intended target and the force that reports to him, with no detail released that a third party could test. The warrants he was actually taken on are a separate and better-evidenced matter.
Being tasked and being ready are different things
Police say he was designated to take part in planning and executing an armed action. Nothing has been published about a reconnoitred firing point, a weapon held for the task, a date, or a stage reached. It is a realistic possibility that the plot was at the tasking stage and no further. Treating a designation as an imminent attempt overstates what is on the record.
The capability is the finding, not the man
A front that keeps designated marksmen, studies response patterns and reportedly pays for shootings is describing a capability rather than an opportunist. It is likely that the same front retains others able to do the same work. An arrest removes an operator; it does not remove the programme that trained him.
Social media closed the case
The location that mattered came from videos posted by somebody close to him. This is the fourth Scorpius report in recent weeks in which the decisive break was not a technical capability - at Munich and in Romania it was a member of the public, and here it was an open-source trail. Operational security fails through the people around the operator at least as often as through the operator.
Where this goes
It is likely that ELN action against the security forces in Catatumbo continues at the present tempo, given the VBIED of 31 August and the state of the talks. It is a realistic possibility that the plot allegation is put to a court, at which point the evidence becomes testable. It is unlikely that operational detail about the presidential tasking is released while the investigation is live.
Nothing in the public record says this man had a firing point, a rifle for the task or a date. What it does say is that a front with a standing sniper programme assigned someone to the problem. Protective planning against a long-range threat is driven by terrain, predictability and dwell time, not by how far a particular plot had got, and none of those three change because one operator is in custody.
- Assume the people around your principal are the leak. This capture came from a partner's social media. The same exposure runs the other way - the movements of a protected person are most often given away by the people travelling with them.
- Plan against the capability, not the plot. The published facts describe a front that keeps trained marksmen. Route selection, dwell time at fixed points and overwatch of dominant ground are the controls, and they do not depend on knowing which individual is tasked.
- Read the charging documents, not the announcement. The warrants here are for homicide and firearms offences. The presidential plot is an accusation with no published detail. Brief them as two different levels of certainty.
- Watch the department, not the incident. A police-station VBIED on 31 August and a sniper capture on 4 September in the same department is a tempo. Anyone with people or assets in Norte de Santander should be planning against the run, not the last event.
- Expect an arrest to change nothing about the threat picture for some weeks. Fronts replace operators. If your posture relaxes on the news of a capture, it was not built on the capability in the first place.
- https://www.infobae.com/colombia/2026/09/04/cayo-alias-firu-francotirador-del-eln-que-habria-planeado-un-atentado-contra-abelardo-de-la-espriella/
- https://www.semana.com/politica/articulo/abelardo-de-la-espriella-confirmo-la-captura-de-alias-firu-participo-en-la-planeacion-de-un-atentado-contra-mi-vida/202604/
- https://www.eltiempo.com/justicia/conflicto-y-narcotrafico/el-rastro-que-llevo-hasta-firulais-el-francotirador-del-eln-senalado-de-asesinar-a-tres-policias-y-de-planear-un-atentado-contra-de-la-espriella-3583776
- https://www.elheraldo.co/colombia/2026/09/04/capturan-en-ocana-a-presunto-francotirador-del-eln-senalado-de-planear-atentado-contra-abelardo-de-la-espriella/
- https://es.euronews.com/2026/08/31/colombia-de-la-espriella-pone-fin-a-3-procesos-de-negociacion-con-grupos-armados
Compiled from open-source reporting for professional security discussion. This is a protective-security lessons-learned assessment, not an operational account. Dairo Ferizzola Rojas has been captured on outstanding warrants and has not been convicted of anything; he is entitled to a fair trial and nothing here should be read as a finding against him. The allegation that he was tasked against the president is made by the Colombian National Police and by the president, and no operational detail supporting it has been published. Accounts differ on how many police officers he is accused of killing and where, and both versions are given rather than reconciled. The Rio de Oro payment figure and the commander named as El Zorro are as reported by El Tiempo. The description of an ELN sniper programme running since 2008 is attributed by El Tiempo to military intelligence sources and is not an official statement. The map plots Ocana; Rio de Oro is not plotted separately.