EXCLUSIVE REPORTING — Three years after the U.S. withdrawal from Afghanistan and the return of the Taliban to power, the country has once again become a haven for terrorist organizations.
Former Afghan officials and United Nations workers say that since the collapse of the Afghan government in August 2021, more than a dozen terrorist groups have established – or reconstituted – safe havens in Afghanistan, helped by the presence of a Taliban regime that is either unable or unwilling to stop them.
The latest report from Islamabad-based Security Studies Center of Research (CRSS) found that Afghanistan experienced a surge in terror attacks during the second quarter of 2024. Some 240 attacks and counter-terror operations resulted in 380 deaths and 220 injuries among civilians, security personnel, and suspected terrorists.
“I believe that (Afghanistan) is really a utopia for jihadi groups – and they are assisted by tens of thousands of students who have graduated from Islamic madrassahs (seminaries) in Afghanistan and Pakistan,” Ahmad Zia Saraj, the last Afghan head of intelligence before the 2021 fall and now a professor at King’s College London, told The Cipher Brief.
“They have free or very cheap manpower…so this makes Afghanistan a place where they can accomplish a lot.”
General Mohammad Yasin Zia, the former Chief of the Afghan General Staff and acting Defense Minister until June 2021, told The Cipher Brief that despite Taliban claims to the contrary, “ISIS and al Qaeda continue to have a significant presence” on Afghan soil.
Experts are divided as to whether the threat is limited to Afghanistan and its neighbors, or may extend to Europe and the West. What is clear is that a nation that harbored terrorists who plotted the September 11 attacks is once again home to jihadist groups that are training and operating with impunity.
The ISIS affiliate in Afghanistan
Three years after the U.S. withdrawal, the most dangerous terror group in Afghanistan is believed to be the Islamic State Khorasan Province – also known by the acronyms ISKP and ISIS-K.
This branch of the Islamic State emerged in 2015 is perhaps best known for large-scale attacks in Western Europe – on the Bataclan theater in Paris in November 2015 and at a concert in Manchester, England in May 2017 – as well as the suicide bombing at the Kabul Airport in August 2021, in the chaotic last days of the U.S. withdrawal from Afghanistan. That blast killed 170 civilians and 13 American service members.
This year alone, ISKP has claimed responsibility for major strikes against Iran and Russia – the latter an attack on a concert hall outside Moscow that killed 140 people.
Complicating the current picture in Afghanistan – some experts say in a helpful manner for the West – is the fact that ISKP and the Taliban are enemies. According to the State Department, the Taliban considers ISKP its primary adversary and has conducted counterterrorism operations against the group. Despite these efforts, ISKP continues to pose a severe challenge inside Afghanistan and beyond.
Hans-Jakob Schindler, Senior Director at the Counter Extremism Project, told The Cipher Brief that ISKP has “shifted its strategy and focuses only on a few high-profile attacks, rather than many smaller attacks”; given that those larger-scale operations are aimed at other nations, Schindler said, “Taliban operations against ISKP have significantly slowed down.”
Terrorism experts say there is no question that ISKP harbors global ambitions. Beyond the roster of attacks in Europe, ISKP operatives have been arrested in several European countries recently, and U.S. officials have warned of the group’s potential to conduct attacks against Western interests.
In June, U.S. authorities arrested eight Tajik nationals in Los Angeles, New York, and Philadelphia with suspected links to ISKP. And in the wake of the Moscow attack, Gen. Michael Kurilla, head of the U.S. military’s Central Command, warned that ISKP “retains the capability and the will to attack U.S. and Western interests abroad in as little as six months, with little to no warning.”
Veryan Khan, President and CEO of the Terrorism Research & Analysis Consortium (TRAC), told The Cipher Brief that ISKP has “been running external operations” from inside Afghanistan “for at least six to twelve months.” She added that ISKP’s “seemingly endless supply of explosive material, including active bomb makers on Afghan soil, should concern Washington.”
Schindler said that “the significant number of foiled plots in Europe and the arrests in the U.S. demonstrate that ISKP is currently making sustained attempts to target Europe, U.S. interests in Europe as well as potentially the U.S. homeland.”
The return of Al Qaeda
It was the Taliban’s relationship with Al Qaeda that led to the September 2001 attacks and later that year, the U.S.-led campaign to oust the Taliban from power. Now multiple reports suggest that Al Qaeda has rebuilt its presence in Afghanistan.
A February report from the United Nations Analytical Support and Sanctions Monitoring Team found that Al Qaeda had substantially increased its presence in Afghanistan since the American withdrawal. The report said Al Qaeda had set up new training camps, religious schools, and weapons caches, and an earlier UN assessment described Al Qaeda’s Afghanistan operations as being “in a reorganization phase, establishing new training centers” in the eastern part of the country.
U.S. intelligence assessments from 2023 were far less pessimistic. They characterized Al Qaeda as being at its weakest point ever in Afghanistan and Pakistan, with little chance of a resurgence. Few experts hold that view now.
“There are indications that Al Qaeda is increasing operational capabilities inside Afghanistan,” Gen. Zia noted. “For example, Al Qaeda has established multiple new training centers including in former US/NATO bases in Jalalabad and Kandahar.”
Zia also claimed that Al Qaeda now serves as the “strategic mind behind the Afghan Taliban as it relates to the extraction of mines, drug trafficking, and other economic activities,” adding that Al Qaeda in Afghanistan is “growing, especially with training camps and recruits.”
Good news and bad news
Counterterrorism operations in Afghanistan since the 2021 fall of Kabul suggest both a greater danger – and some successes in countering the threats.
Ayman al-Zawahiri, the leader of al-Qaeda and a key architect of the September 11 attacks, was killed in a U.S. drone strike in Kabul in July 2022. On the one hand, the operation marked a significant counterterrorism victory for the U.S.; on the other, Zawahiri's presence in Kabul – in a safe house run by an aide to a Taliban minister – raised major questions about the Taliban's commitment to cracking down on terrorism.
Schindler also highlighted the July arrest by Pakistani authorities of Amin ul Haq, a former associate of Osama Bin Laden and a senior figure in Al Qaeda, as “a clear sign that the Pakistani authorities are getting increasingly worried about the Taliban’s ability to control al Qaeda.”
Schindler said that Haq had openly broadcast his return to Afghanistan on social media following the takeover of Kabul by the Taliban in August 2021.
If the good news was that Haq had been captured, the bad news was that Pakistan had felt it necessary to pursue him.
“The fact that the Pakistani authorities felt compelled to arrest him now, three years later, is a worrying sign,” Schindler observed. “If the Pakistani government is worried about Al Qaeda, so should we be.”
A dozen other terror groups
In a recent paper on the terrorist threat in Afghanistan, Saraj, the former National Security Advisor, said 14 jihadist groups – ISKP, Al Qaeda and a dozen others – were known to be operating in the country.
The best known of these is Tehreek-e-Taliban Pakistan (TTP) – an anti-Islamabad network of militants based in the tribal regions of Pakistan, and an ideological partner of the Taliban.
A security report from the U.N. sanctions monitoring team, released in July, called the TTP “the largest terrorist group” currently operating in Afghanistan.
“TTP continues to operate at a significant scale in Afghanistan and to conduct terrorist operations into Pakistan from there, often utilizing Afghans,” the report stated, adding that the TTP, comprised of some 6000-6500 fighters, receives backing from Taliban rulers to conduct cross-border attacks in Pakistan.
The report also said that the Taliban “have proved unable or unwilling to manage the threat from (the TTP)...The Taliban do not conceive of TTP as a terrorist group: the bonds are close, and the debt owed to TTP is significant.”
The assessment also found that the TTP was working with Al Qaeda operatives in Afghanistan in carrying out high-profile attacks within Pakistan.
A January 2023 raid on a Pakistani police compound killed over 100 civilians and prompted a Pakistani counteroffensive, including airstrikes in Afghanistan and the forced displacement of Afghan refugees. Since then, the TTP has been blamed for a surge in bombings, suicide attacks, and targeted killings across Pakistan, particularly in the northwestern regions bordering Afghanistan. These attacks have targeted both security forces and civilians.
“We have a shared interest with the Pakistani people and the government of Pakistan in combating threats to regional security,” State Department spokesperson Mathew Miller told reporters in July. “We do continue to urge the Taliban to ensure that terrorist attacks are not launched from Afghan soil. That has been a priority for us in engagements with them, and it continues to be.”
Perhaps more worrisome are signs of cooperation between the ISKP and TTP groups in Afghanistan. Khan noted that ISKP-run media recently touted a collaboration between the two organizations aimed at “common enemies” as varied as the Afghan government and NATO forces.
“This is a groundbreaking announcement, that TTP and ISK are willing to cooperate,” Khan said.
Meanwhile, an analysis by the Armed Conflict Location & Event Data Project (ACLED) found that other “small groups from Pakistan occasionally make an appearance in Afghanistan,” and the recent U.N. report said that several groups from Central Asian nations are operating with “greater freedom of movement” in the country. Saraj, the former National Security Advisor, told The Cipher Brief that many of these groups include foreign fighters who fought alongside the Taliban during the U.S. war. Taliban leaders feel indebted to these fighters, Saraj said, and willingly provide them shelter and operational freedom.
For its part, the Taliban denies that terrorist groups have a footprint on Afghan soil, and claims to have kept its international commitment to ensure Afghanistan would not be used as a springboard for terrorist attacks abroad.
The U.S. “over-the-horizon” policy
On August 16, 2021, as Taliban forces moved into Kabul and the U.S. rushed to evacuate American troops and Afghan citizens who had helped them, President Joe Biden assured the American public that the withdrawal wouldn’t hamper U.S. efforts to fight terrorism in the region.
“We conduct effective counterterrorism missions against terrorist groups in multiple countries where we don’t have a permanent military presence,” Biden said. “If necessary, we will do the same in Afghanistan. We’ve developed counterterrorism over-the-horizon capability that will allow us to keep our eyes firmly fixed on any direct threats to the United States in the region and to act quickly and decisively if needed.”
That phrase, “Over the horizon” – as in, watching and policing from afar – remains the U.S. approach, and U.S. officials say the Zawahiri killing was a clear case of its success. After the strike, the Defense Department said that “Zawahiri was killed in an over-the-horizon operation in downtown Kabul,” and a senior official said “his death deals a significant blow to al-Qaeda and will degrade the group’s ability to operate.”
Three years after Biden made his pledge, experts are divided as to whether the “over-the-horizon” strategy will be sufficient.
“The U.S. is currently employing a combination of diplomatic, intelligence, and counterterrorism efforts to counter threats from Afghanistan,” Khan said. “While the withdrawal of troops has reduced the American military footprint in the region, the U.S. can act through over-the-horizon operations. This involves utilizing drones, intelligence assets, and partnerships with regional allies to monitor and neutralize terrorist threats.”
Others are less confident.
Sean McFate, a Senior Fellow at the Atlantic Council and Professor at the National Defense University, said that while he doubts that the country will once again become a breeding ground for large-scale global terrorism, Washington’s “over-the-horizon” capabilities – including intelligence gathering – are limited.
“Intel assets are finite,” McFate told The Cipher Brief. “We’ve shifted our intel assets away (from places of terrorism concern) to focus on (targeting) great powers like China and Russia and Iran.”
Saraj said the world needs “a wakeup call” to the threat posed by the myriad groups in Afghanistan, particularly given the “inspiration” he said jihadists have taken from opposition to Israel’s war in Gaza.
In his paper, which he called “2024 Afghan Threat Assessment,” Saraj wrote that “the collapse of the Islamic Republic of Afghanistan in 2021 opened a new chapter of terrorism in Afghanistan and the region.”And in his interview with The Cipher Brief, Saraj said that “today it’s not a big issue for the U.S., but at some point it will be a threat, if we do not pay proper attention.”
Who’s Reading this? More than 500K of the most influential national security experts in the world. Need full access to what the Experts are reading?
It’s not just for the President anymore. Cipher Brief Subscriber+Members have access to their own Open Source Daily Brief, keeping you up to date on global events impacting national security. It pays to be a Subscriber+Member.
