Insider Threat

Insider Threat in the
Afghan National Defense Security Forces (ANDSF)

The insider threat that comes from within the Afghan National Defense Security Forces (ANDSF) is serious and could possibly cause an unraveling of the coalitions' determination to stay in Afghanistan.  Initially the killing of coalition Soldiers by members of the ANSF was called "Green on Blue" attacks. In the fall of 2012 ISAF started to refer to Green-on-Blue attacks as an "Insider Threat" or "Insider Attack".

News Articles about the Insider Threat
news articles on the ANSF insider threat.

ISAF Insider Threat Guidebook 2.0
ISAF Insider Threat Handguide

References about Insider Threat
Insider Threat References

Statistics of Green on Blue Attacks

Over 20 % of the deaths in 2012 were attacks by ANSF members. Some sources say that the majority of attacks are from Afghans that are disgruntled about the coalition or from personnel grievances. The coalition estimates that about 25% of these insider attacks are a result of Taliban infiltration or suspected links to the Taliban. ^6. An additional 15% are likely results of Taliban coercion and intimidation.

Causes of the Insider Threat

There are many explanations offered for the insider threat.

Cultural Differences. Some observers say that cultural differences cause friction between the western ISAF forces and the Afghans. This friction leads to violent action against ISAF Soldiers. A report by a Dr. Jeffrey Bordin produced in 2010, entitled "A Crisis of Trust and Cultural Incompatibility",  warned about Afghan troops attacking their Western allies because of cultural differences. The report was largely ignored by the military. The report was made public when first released but then it was later "classified" by the military. ^7. The report can be accessed here ^8.

Acts of Insensitivity.  Highly publicized acts of insensitivity has not helped the situation. The Koran burnings in a garbage dump at Bagram in February 2012 set the coalition back a bit and sparked several days of anti-American riots. The video of U.S. Marines urinating on corpses of dead Taliban fighters were an act that resonated throughout the Afghan population. ^8. Even the smallest slight - such as criticizing Islam or cursing sets relations back.

Highly Publicized Events. Many events that put the coalition in a bad light have captured the attention of the Afghan population. Some Afghans in the security forces have acted against coalition members as a result of these events. The killing of 16 Afghan civilians in Panjwei, burning of the Korans at Bagram Air Field, civilian casualties cause by air strikes ^11., media attacking the Islam religion ^12., and other events have all been catalysts that enrage Afghan security force members.

Improper Vetting, Poor Training, and Lack of Discipline. A second reason is that the Afghan security forces have grown rapidly over the last few years and vetting and training has taken a back seat to growing the Afghan forces. This 'quantity over quality' results in many problems to include that of discipline and infiltration.

Taliban Infiltration. The Taliban has successfully infiltrated the ANSF with Afghans who are recruited into conducting attacks against ISAF members.

Taliban Coercion. Some ANSF members have been coerced into conducting attacks against ISAF members due to threats against the ANSF member or his family. Many ANSF have been pressured by the Taliban while on leave visiting family.

Taliban Propaganda. The Taliban have been successful in getting some members of the ANSF to turn on ISAF through their information operations campaign.

"I urge all Afghans who perform duties in the ranks of the enemy to turn barrels of their guns against the infidel invaders and their allies instead of martyring their Muslim Afghans. We have always given a hero welcome to these young fighters and, on the basis of fraternity, we welcome everyone who leaves the rank of the enemy and comes over to his Mujahid people".

Mullah Mohammed Omar, August 5, 2013.

Self-Radicalization.  Some ANSF members who have conducted attacks against ISAF Soldiers have been 'self-radicalized'.

Numbers Game. In an attempt to determine what motivates an ANSF attack against ISAF some analysts have tried to put percentages against each type of attack. However, it is difficult to determine the percentages as over 50% of the attackers either escape or are killed. In addition, the Taliban many times will take credit for an attack that was as a result of a personal grievance or dispute. ISAF does not keep accurate numbers on how many casualties are caused by insider attacks - because it is difficult to determine. Where they can report the cause of death ISAF will attempt to release the information.  ^13.

Methods of Decreasing Insider Threats

Background Checks of ANSF. There are some steps that are supposed to happen for an Afghan to join the ANSF and one of these is a background check. There is an eight-step process that an Afghan National Army (ANA) recruit must go through for proper vetting and screening. ¹⁶ and ¹⁷. Unfortunately the Afghan background check system is flawed. Many Afghans simply pay a bribe to enter the ANSF bypassing the background check.

Re-Vetting of ANSF.  Steps are being taken by the Afghan police and military to remove undesirable members of the ANSF.  Reports indicate that hundreds of police and Soldiers have been either detained or released from service due to a variety to reasons during the August to October 2012 period. These reasons for detention or removal include drug addictions, questionable backgrounds, or disciplinary problems.

Re-Vetting of Afghan Local Police (ALP). The training of about 1,000 new recruits to the Afghan Local Police or ALP has been put on hold so that the 16,300 current members (as of September 2012) of the ALP can be "re-vetted". The Combined Joint Special Operations Task Force - Afghanistan or CJSOTF-A will restart the ALP training program once the re-vetting process is completed. ^2.

Deployment of Counterintelligence Teams.  Counterintelligence teams composed of Afghans and coalition members are being fielded to question members of the ANSF to determine if they are a potential threat. In late 2012 many CI teams deployed from the states and from European countries into theater.

Screening Returnees from Leave.  Those members of the ANSF who are returning from leave are being questioned and observed.  Many 'Green on Blue' incidents happen within 48 hours of an ANSF member returning from leave.  While on leave some are influenced by their local village or are forced by the Taliban to commit attacks. Some take leave in Pakistan where the are prone to recruitment by the Taliban. The ANA is taking steps to interview and observe the ANA members returning from leave to include visits with the kandak or brigade Religious Cultural Affairs (RCA) officer and senior enlisted NCO.

Improved Intelligence Sharing between ISAF and ANSF. There are measures being instituted to improve the intelligence sharing between the Afghan National Security Forces and ISAF. It is hoped that this will contribute to a lessening of the level of 'green-on-blue' incidents. However this is hampered at the lower unit levels with an incomplete understanding of what intelligence can be displayed and/or released to Afghan officials. There appears to be no prescribed process . . .  or if there is it is not well known by junior intelligence officers and NCOs.

Cultural Training.  There is a push for cultural training for both coalition and Afghan security force members. The intent is to provide both sides a better understanding of why Afghans or westerners act in certain ways. The MoD recently released a cultural guide about coalition Soldiers to the ANA with instructions that ANA unit leaders conduct cultural sensitivity classes about the crass and impolite Westerners occupying their country.

"Get Closer to Your Afghan Parter".  Of the many suggestions to improve relations with the ANSF is the statement that ISAF trainers should get closer to their Afghan partners that they work with and train with. ^15. Of course, as SFAATs start pulling back from their Afghan partners - adapting the "Level 2" advising concept we will see advisors and mentors getting further away from their Afghan partner.

Guardian Angels.  ISAF has instituted the 'Guardian Angel' program that designates one or two individuals to stand guard while others conduct Key Leader Engagements (KLEs) or meetings with their Afghan counterparts. In addition, these Guardian Angels are also present at locations that have a large number of troops such as dining facilities and gyms. ^22.

Loaded Weapons.  Many FOBs and COPs are now requiring their Soldiers to carry loaded weapons (ammunition clips or magazines inserted into their rifles or pistols). ^14.

Increased Training in Shooting Skills. According to one defense news release "Personnel at increased risk from an insider attack were required to undertake specific close-quarter combat and active shooter training". ^2. It is not evident that extra advanced pistol training has been universally adapted by SFAATs and units deploying into theater. The normal state of weapons training by US Soldiers is insufficient to deal with the insider threat. Insider attacks develop quickly and will take place in crowded places and close quarters. While some units do the advanced shooting training during pre-deployment ^18.; it is not evident that the majority of the SFAATs are doing "extra shooting". Accurate shooting skills are a necessity under many different circumstances and conditions. This advanced pistol training should also be conducted periodically while deployed. ^{20 and 21.}

Some SFAATs are conducting advanced pistol range training while deployed. This
SFAAT member from 10th Mountain is using his pistol from a variety of firing positions.
(Photo LT Brian Wharton, August 5, 2103.)

Safe Zones. ISAF members who work with Afghan counterparts have been instructed to create 'safe zones' where they can move to and defend themselves in the event of a threat. ^3.

Training in Force Protection. The Army has offered courses in Force Protection for many years. U.S. Army Special Forces teams conduct numerous missions year after year advising Foreign Security Forces (FSF) and are required to partipate in specialized special forces training by attending courses such as combat pistol craft, ATFP Level II Advisor, INTAC, and some of the civilian security driving schools that are available.

Changing the Narrative.  Everyone knows that the ISAF Information Operations (IO) effort is dismal.  The themes are usually out of touch with the Afghan people and it takes a long time to get messages approved through the bureaucratic IO system. The Afghan government and military IO system exists structurally but it is not very effective. There are some themes that can be exploited to help decrease the incidents of Insider Threat. ^4. It is unlikely that ISAF has the ability to use these themes or to get the Afghan government to adopt them and disseminate the message. ISAF does put out messages from time to time (see a statement by General Dunford on insider threat).

Pressure the Afghan Government and Military.  A great deal of pressure is being applied to the Afghan government and military to deal with the increasing number of 'green-on-blue' incidents. Afghans at the highest level are on the receiving end of this message. ^5.

Afghan Embarrassment. The Afghan military and police officials are understandably embarrassed by the insider attacks. Karzai has repeatedly laid the blame on Pakistan entities sponsoring Taliban infiltration and coercion although statistics don't necessarily bear that argument out. The Afghan officials also bring up the fact that there is a lot of 'green-on-green' attacks. Out of sensitivity for the Afghan position ISAF has changed the verbiage from 'green-on-blue' to 'insider attacks' - thus not highlighting the ANSF attacks against ISAF Soldiers and including 'green-on-green' attacks in the narrative.

The Aftermath. SFAATs that lose a member of the team to an insider attack face significant challenges. How do the members of an SFAAT interact with their counterparts after one or more of their SFAAT team members are killed by an Afghan from the unit they are advising? One SFAAT has presented the issues faced in such an event. Read "Facing the Insider Threat in Afghanistan", Army Magazine, September 2013, pages 63-67. An online article about the aftermath SFAAT members and others had to face after an insider attack killed three advisors in eastern Afghanistan in June 2013.

Attacks in 2014. For the most part, 2014 has seen very few insider attacks. However, the highest ranking military member killed was Major General Harold Greene, attacked by a member of the Afghan Security Forces in August 2014. Greene was the deputy commander of CSTC-A.

Papers, Reports, and Publications about the Insider Threat
in the Afghan National Security Forces (ANSF)
(papers and reports listed in chronological order)

Ahmad, Javid, Dress Like Allies, Kill Like Enemies: An Analysis of 'Insider Attacks' in Afghanistan, Modern War Institute at West Point, April 4, 2017f.
http://mwi.usma.edu/wp-content/uploads/2017/04/Dress-Like-Allies-Kill-Like-Enemies.pdf

Long, Austin. "'Green on Blue'. Insider Attacks in Afghanistan", Survival: Global Politics and Strategy, June-July 2013.
www.iiss.org/en/publications/survival/.../survival...june-july-2013...

Brooks Tigner, "Afghanistan and ISAF agree new efforts to counter 'green-on-blue' attacks", Janes.com, September 13, 2012.  Accessed here.

Bill Roggio and Lisa Lundquist, "Green-on-blue attacks in Afghanistan: the data". The Long War Journal, August 23, 2012 (updated September 16, 2012). Accessed here.

Dr. Jeffrey Bordin, "A Crisis of Trust and Cultural Incompatibility: A Red Team Study of Mutual Perceptions of Afghan National Security Force Personnel and U.S. Soldiers in Understanding and Mitigating the Phenomena of ANSF-Committed Fratricide-Murders", May 12, 2011. Accessed here on the Michael Yon Online Magazine on September 16, 2012.

References

MoD, Force Protection and insider Threat Policy, Afghan Ministry of Defense, September 2017. This document was published to improve training and security procedures among Afghans and Coalition service members.

Joint Pub 3-24, Counterinsurgency Operations, 5 October 2009.  See Chapter V. Intelligence Support to Counterinsurgency.  Accessed here on dtic.mil website January 2012.  (Adobe PDF).

"Insider Threats in Partnering Environments".  Asymmetric Warfare Group (AWG). This detailed chart covers three broad areas to include an indicator decision chart, mitigation techniques for an insider threat, and how to interact with partnered forces on the topic of insider threats. This unclassified tactical reference guide is posted on the Wired.com website and can be accessed here.

Websites Related to Insider Threat

Culture-Intelligence.net.  Providing research, field guide, magazine, training and resources on cultural intelligence.
www.cultural-intelligence.net

Magazine and Periodical Articles about the Insider Threat

The Importance of Intelligence in Combating a Modern Insurgency.  By Kevin Reamer, Journal of Strategic Security, 2 (2): 73-90, 2009.  Accessed here January 2012.

Why Defeating Insurgencies Is Hard: The Effect of Intelligence in Counterinsurgency Operations - A Best-Case Scenario.  By Moshe Kress and Roberto Szechtman.  Operations Research, Vol. 57, No. 3, May-June 2009, pp. 578-585.  Accessed here on NPS.edu January 2012.  (Adobe PDF).

Return to Top of Page

Videos About Insider Threat

August 8, 2013. "Troops Hone Situational Awareness Skills". DVIDS. A short video on Advanced Situational Awareness Training (ASAT) received by engineer unit.

October 16, 2012. "Afghan army strengthens recruitment procedures". NTM-A.

September 18, 2012. "US announces indefinite suspensions of Afghan joint operations". ABC News - Australia.

September 14, 2012. Insider Threat Report. Gail McCabe reports on the insider threat in Logar and Wardak provinces (TF Bayonet - 173rd). YouTube.com.

September 17, 2012. "Surge of 'Green on Blue' Attacks Has Great Cost of U.S.". PBS Newshour on YouTube.

September 16, 2012.  "When Friends Are Enemies". CNN Video on YouTube.

September 16, 2012. "Insider Attacks Kill Six Coalition Soldiers Brig. gen. Gunter Katz". ISAF Briefing.

August 20, 2012. "NATO in Afghanistan - An insider threat". By NATO Community on YouTube.

Return to Top of Page

Endnotes

1. Benjamin Jenson, "Commentary: Use Afghan beliefs to inspire camaraderie", The Town Talk, September 14, 2012.  Accessed here on September 16, 2012.

2. Karen Parrish, "ISAF, Afghans Working to Curb Insider Threats, Spokesman Says", American Forces Press Service, September 4, 2012. Accessed here on Sep 16, 2012. One ISAF news release states that training for 1,000 ALP recruits is on hold while over 16,300 current members of the ALP are being re-vetted.

3. George Little, "DoD News Briefing with George Little from the Pentagon", U.S. DoD News Transcript, September 4, 2012.  Accessed here on September 16, 2012.

4. Benjamin Jenson, "Commentary: Use Afghan beliefs to inspire camaraderie", The Town Talk, September 14, 2012.  Accessed here on September 16, 2012.

5. Amie Ferris-Rotman and Rob Taylor, "U.S. urges Karzai to counter growing Afghan insider threat", The Toronto Sun, August 19, 2012.  Accessed here on September 16, 2012.

6. The 25% of attacks associated with the Taliban figure comes from the following article accessed here - "Attacks lead U.S. to halt some Afghan training", Navy Times, September 2, 2012.

7. For more on the report by Dr. Bordin on cultural differences leading to 'green-on-blue' incidents see "Previously rejected report is now key to US effort to curb insider killings in Afghanistan", Stars and Stripes, September 10, 2012. Accessed here.

8. The report by Jeffrey Bordin can be accessed here on the Michael Yon Online Magazine website. It can also be accessed here on the George Washington University website.

9. For a more detailed list of cultural slights that enrage Afghans see "Afghanistan: 'Green on Blue' Killings Explained, by Sami Yousfzai and Ron Moreau, The Daily Beast, August 27, 2012.  Accessed here.

10. See "General Notes Taliban Coercion in Some Attacks on Troops", The New York Times, August 23, 2012. Accessed here.

11. Over the years there have been numerous air strikes that have inadvertently killed Afghan civilians. While these incidents, known as CIVCAS for civilian casualties, have decreased over the last few years they still happen and cause anger among the Afghan population and security forces. See "NATO Airstrike Kills 8 Afghan Women", Voice of America, September 16, 2012.  Accessed here on Sep 17, 2012.

12. For an example of a media product that incites Afghans see "Hundreds of Afghans protest anti-Islam film", AFP, September 17, 2012. Accessed here on September 17, 2012. Also see "Afghans Protest Anti-Islam Film", Radio Free Europe, September 17, 2012.

13. For up to date news on ISAF casualties you can refer to the "ISAF Casualty Report" page at the following link:
                       http://www.isaf.nato.int/article/casualty-report/index.php

14. For more on carrying loaded weapons see "All coaltion troops at Afghan bases now armed around the clock", CNN U.S., August 17, 2012 at this link.

15. See "ISAF trainers told to get closer to Afghan partners to prevent insider attacks".  Stars and Stripes, August 28, 2012 accessed here.

16. The eight-step ANA recruit process instituted in March 2011 is listed below:
     1)  Valid Tazkera (Afghan identity card)
    2)  Two letters from village elders or other guarantors
    3)  Personal information, including name, father's name, village, and two photos
    4)  Criminal records check through MoI, supplemented with an Army G2-record check by Ministry of Defense
    5)  Application with validation stamp from recruiting authority
    6)  Drug screeing
    7)  Medical screening
    8)  Biometric collection (fingerprints, Iris scan, etc.)

17. Statement on Use of Afghan Nationals to Provide Security to U.S. Forces.  Presented to the House Armed Services Committee of the U.S. House of Representatives, January 31, 2012.  Accessed here.

18. For more on SFAATs and others incorporating advanced shooting skills like Close Quarters Combat (CQB) into their pre-deployment training see "Unit bound for Afghanistan drills like never before", Stars and Stripes, July 27, 2013.  Accessed here.

19. The source of Mullah Omar's statement on green-on-blue attacks is from the Long War Journal, Threat Matrix, August 9, 2013. Accessed here.

20. Some SFAATs in the 10th Mountain are conducting in-theater advanced pistol training while deployed. See "3-89 SFAAT team improves skills at pistol range". DVIDS, August 23, 2013. Accessed here.

21. See a video about Guardian Angels shooting on the range while deployed in Zabul.  "Guardian Angel Reflexive Fire". DVIDS, August 22, 2013.

22. For more info on Guardian Angels read a DVIDS press release entitled "Guardian Angels set-up shop at Gamberi" dated March 27, 2013.

Return to Top of Page