Abdul Saboor’s murder of Darin Loftis and Robert Marchanti moved the American war command to restudy the threat. That two senior officers could be dispatched with pistol shots to the backs of their heads in a heavily guarded compound in the heart of Kabul suggested that no one or nowhere could be considered safe. The crime recalled nationalistic Afghan uprisings against British occupations of the nineteenth century. In the weeks that followed, the C.I.A. circulated analysis in Washington pointing out that the frequency of insider murders against American and European forces had surged to a rate ten times greater than during the first decade of the war. The murders were on pace to constitute a quarter of all I.S.A.F. fatalities in 2012, an astounding percentage. Nothing like this had happened in Vietnam or during the Soviet occupation of Afghanistan. In fact, as far as the C.I.A.’s analysts could determine, Afghanistan’s insider killing spree after 2011 had no precedent in the history of modern counterinsurgency.1
Following murders of its soldiers late in 2011, France announced a withdrawal of two thousand combat soldiers from Afghanistan. Australia, Britain, Germany, and Spain all lost soldiers to killings by Afghan soldiers or police they worked alongside. The murder wave pulled at the foundations of every “line of effort” in N.A.T.O.’s campaign—the training of Afghan National Security Forces, the mentoring of Afghan police and technocrats in the ministries, and the resilience of political will in N.A.T.O. capitals to fight on after a decade of effort. The Taliban—or whoever or whatever was the cause of the insider killing—had located “exactly this political-emotional milieu we are in,” as a N.A.T.O. diplomat in Kabul put it. “All our capitals are tired. We lost the battle of public opinion three years ago, anyway.”2
More vexing still, there was no consensus about why these insider killings had surged. Were the killers Taliban infiltrators who had slipped through the N.D.S. vetting system designed to weed out enemy sympathizers from the Afghan National Army and police? Or were they non-Taliban who had become personally aggrieved over slights or insults from N.A.T.O. soldiers and decided to take violent revenge? This was a murder mystery that had become the war’s most important strategic puzzle.
Murders of American and European soldiers by Afghan allies spiked slightly in March 2012, and then ground along at an alarming rate of at least several per month into the summer. That year, Ramadan, the Islamic month of fasting and celebration, took place from July 20 to August 19. Ramadan is a time of self-purification, of rituals of affiliation with faith. For individuals susceptible to the call to violent jihad against foreigners, the fasting and celebration in 2012 seemed to have a stimulating effect.
On July 22, in Herat Province, an Afghan policeman shot and killed three N.A.T.O. trainers and wounded a fourth. The next day, in Faryab Province, an Afghan colleague shot and wounded two N.A.T.O. soldiers. Between August 3 and the end of Ramadan, Afghan soldiers or policemen committed at least nine more murders or attempted murders against N.A.T.O. and American troops, killing ten people, including five U.S. Marines, two of those Special Operations officers. During those final two weeks of Ramadan, Afghans attempted to kill Americans or Europeans they worked alongside about once every other day.3
Marine General John Allen’s chief of intelligence, Mike Flynn’s successor, was Robert Ashley, a two-star Army general. He was a silver-haired, sober-faced man whose highly secured offices lay a short walk from Allen’s command center at I.S.A.F.’s headquarters in downtown Kabul. Ashley knew well that solving the insider murder problem had become critical. At August’s rate of killing, the American plan for a slow, gradual drawdown from Afghanistan looked implausible.
Ashley and Allen established a program of “guardian angels,” in which Western commanders appointed armed guards from their own ranks to watch over Afghan allies during joint activities. As the murders picked up during Ramadan, Allen authorized field commanders to appoint even more watchmen if they felt it was needed. But it seemed obvious that the more the Americans tightened their internal security protocols—the more Afghan allies were stripped of their weapons before meetings or endured armed American surveillance on patrol—the more likely it was that these allies would conclude that the Americans were their enemies.
One night that August, Ashley’s counterpart in the Afghan National Army, General Abdul Manan Farahi, the head of military intelligence, telephoned. It was unusual to hear from Farahi so late. Ashley stepped outside to take the call.
“My friend, I just want to make sure, with Eid coming up,” he said, referring to the celebration of Ramadan’s end. “Just minimize the contact with the guys in the field and take care.” These were haunted times, Ashley told colleagues, as he relayed Farahi’s message.4
Ashley decided he needed a fresh mind to analyze the crisis. He turned that autumn to one of the more unusual, naturally gifted characters in the American intelligence community. Marc Sageman, who was then in his late fifties, was a bald, white-bearded forensic psychiatrist and former C.I.A. operations officer. He sometimes favored bow ties and spoke with a still-noticeable French accent. He had been born in Poland but raised as a refugee in France, where his parents had landed after surviving the Holocaust. Sageman matriculated at Harvard University at age sixteen, became a medical doctor, earned another doctoral degree in political sociology, served as a Navy flight surgeon, and then joined the C.I.A. as a case officer. He worked in Pakistan during the 1980s, running frontline C.I.A. contacts with Ahmad Shah Massoud’s aides, among other mujaheddin commanders. Later Sageman served as a psychiatrist on the faculty at the University of Pennsylvania, where he studied murder, crime, and terrorism. Sageman was already conducting intelligence investigations for the Army, but not everyone in the command was a Sageman fan. Like some other very smart individuals, he could be dismissive of opinions he found wanting. He was an independent operator, “not a team player,” as one general in Washington warned Ashley.
“I have nothing but team players and we don’t understand what’s going on,” Ashley replied.5
Sageman agreed to take on the Afghan murder project as a contractor—his title in Ashley’s intelligence shop would be “political officer.” He flew to Bagram Airfield in mid-October. Sageman had never been in Afghanistan, at least not meaningfully. As a C.I.A. case officer, he had accompanied mujaheddin rebels he armed and financed to the Afghanistan-Pakistan border and symbolically stepped a few yards onto Afghan soil to have his picture taken, but that was it. (The C.I.A. banned case officers from traveling with rebel clients inside Afghanistan, for fear they would be captured and turned into tools for Soviet propaganda.)
As he touched down in Kabul, Sageman was ambivalent. He had a wife and son at home in the Washington suburbs. He had never bought into Obama’s counterinsurgency strategy for Afghanistan; it was too ambitious, too disconnected from reality, he believed. But the opportunity to work as a kind of homicide detective was intriguing. And Sageman felt a quiet sense of purpose—to save as many American and European lives as he could by developing insights that might reduce the murder wave, to get as many soldiers and officers as possible safely home from a misbegotten war.6
Ashley had won approval for Sageman’s assignment in part because the psychiatrist had recently impressed the Army’s leadership with his work on another classified, high-priority counterintelligence project. On November 5, 2009, at Fort Hood, Texas, Major Nidal Hasan, an Army psychiatrist, carried out a mass shooting against colleagues on the base, killing thirteen people and wounding more than thirty before he was subdued. It turned out that Hasan had been in contact over the Internet with Anwar Al-Awlaki, an American of Yemeni origin who had become a charismatic Al Qaeda preacher. After Fort Hood, the F.B.I. and American intelligence agencies identified and reviewed American residents who had previously clicked on Awlaki’s Web sites or exchanged e-mail with him. The investigations revealed, among other things, that Awlaki’s audience included about one hundred active service members in the U.S. Army. This looked like a classic counterintelligence threat. What if, during the Cold War, the Internet had been around and the Army had discovered that a hundred soldiers and officers were clicking through to the K.G.B.?
The deputy chief of staff of the Army, General Richard Zahner, who oversaw the service’s intelligence portfolio, called Sageman. “We have a problem here.” Sageman joined the counterintelligence teams looking at the individuals who had clicked on Awlaki’s materials. These case-by-case investigations took time, lasting into 2011. In the end, however, the review turned up only one individual, Naser Jason Abdo, the son of a Jordanian father and an American mother, who seemed dangerous. In 2011, Abdo was arrested for conspiring to commit violence against fellow soldiers and was sentenced to life in prison. In the several dozen or so other cases Sageman and Army counterintelligence investigators examined, however, they found no evidence of dangerous jihadi radicalization.
Sageman wrote up a classified analysis and briefed General Martin Dempsey, then the chief of Army staff, in his E-Ring suite at the Pentagon.
“You can’t overreact or you will break the Army” by fostering a witch hunt for Muslim traitors, Sageman told the Army leadership. “You have 1.1 million soldiers in the Army. With turnover, we’re talking about maybe 10 million soldiers over ten years. And you have two cases: Hasan and Abdo. That’s your base rate. Every five years you’re going to have some asshole.”
Dempsey and other Army commanders grasped the point. For all the anxiety generated publicly by members of Congress and cable TV demagogues, they did not face a strategic counterintelligence threat from Muslim-American soldiers. It was a huge relief.7
—
At Bagram Airfield, Sageman hopped a helicopter to the Kabul airport, then rode in a convoy to I.S.A.F. headquarters. On board the helicopter, he met a young woman, a legal researcher who worked with the judge advocate general’s office at Camp Eggers.
“What do you have on the insider attacks?” Sageman asked her.
Not much, she said, so far as she knew. But they exchanged cards and e-mail addresses. It would prove to be a fortuitous encounter.
At I.S.A.F.’s headquarters, the compound of lawns and metal trailers, Sageman met Jeffrey Bordin, the sociologist who had completed the landmark study of mistrust between American and Afghan soldiers early in 2011. They had lunch a few times and visited each other’s offices twice. Sageman admired Bordin but found him a little closed and defensive—bruised by experience, at the least. As the problem of insider killings got worse, Bordin had quietly returned to Afghanistan as an Army reservist, to continue his research. The problem for him was that General Allen didn’t appreciate his work any more than Petraeus had. Allen’s mission was to promote comradeship and cooperation between I.S.A.F. and Afghan soldiers, “shoulder to shoulder,” as the slogan went, to allow N.A.T.O. combat forces to leave the battlefield at the end of 2014. Allen believed that the alliance was sound fundamentally, and the Afghans he worked with from day to day did, too; they reinforced Allen’s belief that the fratricidal violence was best understood as a Taliban operation. In any event, in 2012, Bordin found that I.S.A.F. had vastly undercounted the true number of fratricidal killings—by as much as 50 percent. The official count of a quarter of all N.A.T.O. fatalities that year was bad enough. If Bordin’s estimate was right, I.S.A.F. was effectively at war with the Taliban and Karzai’s armed forces simultaneously, an impossible position to sustain. But Allen’s staff didn’t believe Bordin’s numbers. They found the researcher stubborn and headstrong. He was a thorn in their sides. Bordin’s position in reply to such criticism was Yes, the truth hurts.8
Sageman and Bordin now lived and worked in nearby trailers, by coincidence. They exchanged notes. As a social scientist, Sageman found Bordin’s work impressive and methodologically sound. Sageman was inclined to think that there was a direct causal link between the cultural misunderstandings Bordin had documented on the front lines of the “shoulder-to-shoulder” program and the murders Sageman had come to investigate. It seemed apparent to Sageman that international forces had overstayed their welcome. Fratricidal murder might represent only the most extreme outbursts in a chronically frayed atmosphere. The problem was, Sageman had no data. Bordin’s interview records did not touch upon the particular killings upending N.A.T.O.; they chronicled day-to-day perceptions among Afghan and American soldiers.
Prior to 2012, N.A.T.O. had not investigated or analyzed insider attacks systematically. Each victimized coalition government handled investigations according to its own procedures. The records were scattered. During 2012, the I.S.A.F. Joint Command, the war’s day-to-day headquarters unit, which was located on the north side of Kabul’s airport, adopted a new approach. The command created Joint Casualty Assessment Teams—“JCATs,” as they were called—to investigate and report on insider attacks immediately after they took place. The teams flew to the site of a murder or attempted killing (more than half of the attacks took place in Kandahar and Helmand), where they would interview witnesses, examine the crime scene, and write up a report within two days. The Joint Command’s intelligence unit reviewed these investigations. A brigadier general, Paul Nakasone, oversaw the unit; he ran a department of twenty or so analysts, some from the Defense Intelligence Agency, others civilian. Not too many murder investigations can be resolved in just two days, but the JCATs were intelligence analysts, not detectives working toward an arrest and conviction. The Joint Command’s approach effectively prioritized speed over depth, in Sageman’s view.9
He discovered that Great Britain had dispatched a brigadier of the Royal Dragoon Guards, Tim Hyams, to look at the insider threat across the N.A.T.O. command. His title was chief, insider threat mitigation, and he oversaw a multinational cell of analysts and investigators. In late October, Sageman and Hyams traveled to the Joint Command headquarters to meet with the JCATs’ murder investigation squads. But the analysts there told Sageman and Hyams that they had no data. This turned out to be untrue—they had been building a matrix of information about the killings they had investigated. Bureaucratic hoarding of intelligence was commonplace. Hyams did not have high-level clearances. The pair went away empty-handed, without even being told that the matrices on the cases existed.
Sageman e-mailed the Army legal researcher he had met on the helicopter. He asked if she had copies of the “15-6” records of insider murder cases. These were highly detailed files created by the Army’s Criminal Investigative Division staff, who looked into violent deaths where something other than straightforward combat might be involved. C.I.D. records often included extensive interviews with witnesses, reconstructions of crime scenes, and other rich evidence. They were subject to confidentiality and privacy rules, however.
The researcher asked her boss, an army lawyer, who wrote Sageman.
“Do you have the names of the victims?” the lawyer asked.
“That I have.”
All right, she said, but don’t tell anybody about my cooperation.10
Ultimately, she sent Sageman records of two dozen insider murder cases that had involved Army personnel. Military C.I.D. investigators had conducted almost all of the reviews. An exception was the case of a female C.I.A. base chief in Kandahar killed by an inside suicide bomber. C.I.A. investigators had looked into that attack. It proved harder to persuade the Marines to turn over records; they had about ten cases. And there were other cases involving Britain and continental European militaries. Of the files Sageman ultimately received, about three fifths included full 15-6 files, each of which ran to hundreds of pages of interview notes and other documents.
He traveled to Helmand and Regional Command headquarters elsewhere to talk to some of the investigators as well as other officers who knew the cases. He also interviewed ten confessed murderers being held in Afghan prisons. He began to build his own matrix of forty factors in each shooting—where the Afghan shooter was from, what language he spoke, who the victims were, whether there was evidence of ideological motivation, how the attack had been executed, and so on.
Some of the murders turned out to have little or nothing to do with either personal slights or the Taliban insurgency. In one case, a N.A.T.O. unit that had been quietly paying off locals with a regular tanker of gasoline rotated out and the incoming unit ceased the practice. The aggrieved smugglers shot the new soldiers. In three or four cases, Afghan soldiers who kept young Afghan boys as sex slaves—“chai boys,” or tea boys, as the victims were euphemistically known—fell into apparent crises of conscience over their behavior and decided to purify themselves by joining the Taliban. To prove they were worthy, they shot up N.A.T.O. soldiers on their way out. In Helmand, Sageman examined a case where local thugs involved in protection rackets for truckers decided to join the Taliban, but were told they had to first kill an American to prove their bona fides. This morass of corruption, sexual predation, and gang thugs becoming made men evoked Elmore Leonard’s texture of debased human truths, but it was not obvious how violence of that character might be stopped.
Other cases, however, provided evidence of direct Taliban military operations. The killing of the C.I.A.’s base chief that autumn was one such example. A brother of a local police chief in Kandahar defected to the Taliban and decided to carry out a suicide bombing. Telephone intercepts tracing all the way to Quetta documented the orders the bomber received. In essence, these orders were “When your brother gets some V.I.P.s visiting, go and blow yourself up.”11
As he traveled, Sageman wrestled with the question of whether personal affronts or American arrogance provoked fratricidal murders. In late November, he investigated a case where there were rumors that the shooter had been outraged by a story that I.S.A.F. forces had held up a pregnant Afghan woman’s car at a checkpoint, preventing her from getting to the hospital to deliver her baby. The JCAT report of the case chronicled this motivation. Supposedly, the shooter had learned of the woman’s case and spontaneously attacked. Sageman picked through the 15-6 file, which included dozens of photographs of the attack taken from soldiers’ helmet-mounted cameras. The photos, along with the interviews he conducted, showed that there was no civilian car involved, no pregnant woman. It was not clear where this story had even come from. The attacker had approached in a column of combined N.A.T.O. and Afghan forces, in the back of a pickup with a mounted machine gun. He had previously decided to join the Taliban and defected on the spot by opening fire at random military targets. Sageman stared at the photos and wondered if other reports about personal or cultural misunderstanding escalating into shootings might also be inaccurate.12
As the weeks passed, back at the I.S.A.F. compound, hunched over a restricted computer terminal, Sageman found that communication intercept evidence provided the greatest insights. Because of his previous Army counterintelligence work, Sageman had access to many compartments in the Joint Worldwide Intelligence Communications System, where the Army stored Taliban intercept records, among other sensitive information. Ashley assigned a D.I.A. officer to help. Sageman and the officer extracted names, dates, and details from their 15-6 and other murder investigative files to use in searches to retrieve archived intercepts. Gradually, these transcripts led Sageman to change his thinking about the nature of the problem and to develop a new hypothesis.
The hardest thing to let go of was the “myth,” as Sageman began to call it. This was the belief that cultural incompatibility between N.A.T.O. and Afghan soldiers had grown so severe it occasionally turned murderous. Bordin’s valid field interviews had created a misleading impression, Sageman concluded. In fact, violence did not follow misunderstanding or resentment very often, Sageman found. In many cases, there was no or very little contact between the victim and the shooter before the murder. In these cases, the shooter behaved more like a mass killer who walked into a mall and fired on shoppers at random.13
There were clearly some acts of broad, well-publicized cultural or political provocation—the mistaken Koran burnings at Bagram in February 2012 and, the following month, the mass murder of Afghan civilians carried out by U.S. Staff Sergeant Robert Bales near Kandahar. These incidents had provoked vengeance-seeking insider killings by Afghans. The murders of Loftis and Marchanti were an example. Of course, even their deaths did not arise from intimate misunderstanding between the shooter and his victims. To General Allen, these revenge killings after public events of desecration by Americans belonged to a different category from other insider violence. Altogether, Sageman concluded, there were seven or eight killings caused by cultural provocation, particularly the Koran burning, but these cases were far from a majority.
The Taliban intercept records provided evidence that in many more cases, Afghan soldiers and police changed their minds about which side of the war they wanted to be on. Then, from inside N.A.T.O. bases, these side switchers reached out to Taliban commanders by cell phone to volunteer their services. Or, through social networks, Taliban commanders opened phone conversations with government soldiers or police and recruited them to defect. The Taliban instructed the volunteers to kill N.A.T.O. soldiers and then run away to join the Taliban. As the murders quickened, the visibility of insider killings created stimuli for new defectors. When contacted by volunteers, the Taliban encouraged them to murder N.A.T.O. personnel because the killings made news and sapped Western morale. Encouraging a defector to kill on his way out the gate also resolved the Taliban’s own counterintelligence risk, because the shooter wrote his true intentions in blood and erased suspicion that he might be an N.D.S. or C.I.A. infiltrator.
As Kabul nights turned freezing and Christmas neared, Sageman started to write up his findings and analysis. None of it was black and white and plenty of mystery remained. What caused the insider Taliban volunteers to change their minds? This was harder to document because the phone intercepts did not typically reveal motivation and many of the murderers had been killed by return fire or had escaped. In any event, the number of Afghan defectors to the Taliban side was not particularly large or unexpected in such a war dividing families and tribes. It was, rather, the shocking death toll the shooters managed to exact as they switched sides that made them significant.
There remained many cases—perhaps a quarter of the total—where the murderer’s motivation was unknown or arose from some extraneous tangle, like corruption rackets. As Sageman was writing, another of these cases turned up on his doorstep.
On Christmas Eve 2012, Joseph Griffin, a forty-nine-year-old American police trainer from Mansfield, Georgia, was shopping at a stall just outside police headquarters in downtown Kabul. He was looking for a belt buckle for his son, who was back in the States. A thirty-three-year-old female Afghan police sergeant in uniform, who had trained as a sharpshooter, approached Griffin, pulled out a pistol, and shot him dead. The woman then tried to melt away among pedestrians. She was arrested before she could escape.
Sageman hustled over from I.S.A.F. headquarters. He interviewed the shooter at the scene. She seemed to be faking a psychiatric condition, but didn’t do it very well. Kabul police raided the woman’s house and soon returned with garbage bags of her belongings and dumped them on a table. It turned out that she was an Iranian citizen who had married an Afghan refugee and then moved to Afghanistan with him. She was a Shia—the Islamic sect generally opposed to the Taliban—and she had recently been to the Iranian consulate about returning home. The Kabul police thought the murder was an Iranian operation, but Sageman doubted that. She had no apparent contact with anyone, Iranian or otherwise. He marked her down as another “unknown.”14
As Sageman completed his analysis, the season of Ramadan jumped out of his numbers. The number of insider attacks had approximately tripled during Ramadan, then returned to its previous rate. This anomaly stood in contrast to the total number of “security incidents” in the Afghan war during the summer. The war’s total measured violence had peaked in June and then fallen steadily into the autumn. If Ramadan was not a stimulant of combat, why was it a stimulant of insider murder? Sageman looked back at the less complete data for 2011 and saw a mini-peak of murder during Ramadan that year as well. One of the attackers Sageman interviewed in detention told him that Ramadan “was a time when lots of informal religious discussions took place” among Afghan soldiers and police working with N.A.T.O. The talk “about religion and tradition . . . might have tipped people predisposed to attack I.S.A.F. into actually doing so.” Sageman also noticed that several of the murders linked to corruption or the sexual exploitation of children had taken place during Ramadan. The holy month, he wrote, “is a time when people look for redemption, especially people who might have a guilty conscience.”15
In January, Sageman completed a draft of “The Insider Threat in Afghanistan in 2012.” The unclassified version ran to thirty pages with a hundred footnotes. Its main argument sought to debunk the “myth of personal social insensitivity” as a factor in insider murders. His review of all the 2012 cases “failed to detect a single case where direct personal social misunderstandings escalated into confrontation ending in a lethal firefight.” More general perceived cultural insults did stimulate violence, in about 10 percent of cases, according to Sageman’s analysis. But these perceived insults “fell on fertile ground” because a majority of the murderers studied had connected with the Taliban before they decided to kill, either because they were recruited while on the inside or because they volunteered. Sageman reported that 56 percent of the inside attackers had “solid” links to the insurgency, another 9 percent had “probable” links, and another 10 percent had “possible” links. These conclusions came substantially from the telephone intercept records he and his D.I.A. colleague had examined. Altogether, 75 percent of the attacks involved shooters who had at least possible prior links to the Taliban. They were not infiltrators, however; they were side switchers.16
The killers’ motivation was group identification, as Muslims or Afghans, where the terms of membership required violent action against the enemy. In that sense, Sageman’s hypothesis was even darker than Bordin’s. In theory, cultural misunderstanding might be overcome through training. The broad, fertile belief that American soldiers were occupiers could be addressed only by their departure.
Sageman’s findings had one major implication for N.A.T.O. operations. Its forces needed a much more attentive counterintelligence program to monitor the communications of allied Afghan soldiers and police to detect defectors before they acted. If some of the phone conversations Sageman reviewed had been monitored when they took place, killings would have been prevented. “The challenge is to detect people who defect to the insurgency after they join” government forces. By Sageman’s count, four out of five shooters joined the Taliban after they had been initially vetted for the Afghan army or police; only one out of five was a true sleeper or infiltrator. “Many perpetrators were recruited in place by their peers or superiors, either for ideological or political reasons, especially during Ramadan, or by corrupt commanders trying to reach a compromise with the insurgency.”
Sageman’s analysis also showed that there was a strong statistical likelihood that when one insider murder took place, another would follow within two days. This copycat pattern in the numbers also had operational implications: After an attack, N.A.T.O. should raise its alert levels for several days. After that, statistically at least, the threat subsided.
The report’s bar graphs again created a reassuring sense of clarity, but the case studies Sageman mustered were dismal and evocative of the felony docket in a Mafia stronghold:
A police checkpoint commander and his deputy had extensive connections to both local insurgents and drug traffickers. The commander also allegedly sexually abused young adolescents who were forced to serve him. He took an interest in a young handsome police recruit of low intelligence. The commander and his deputy encouraged the young recruit to shoot at I.S.A.F. forces accompanying a female USAID civilian inspecting a local school. Prior to the attack, the deputy gave the eventual shooter some opium.
A corrupt army combat outpost commander, who extorted money from local villagers and sexually abused young recruits and had extensive connections to insurgents, encouraged a young soldier to carry out an attack on I.S.A.F., who were transferring the outpost over to the Afghans. The commander claimed that the withdrawing forces would take all the weapons, tanks and vehicles with them. One of his subordinates carried out the attack and the commander organized the escape with the help of insurgents.17
All militaries, including the U.S. Army, had to manage criminals in their ranks and the threat of traitors. The practical thing to do was to catch them before they did too much damage. In many of the cases Sageman reviewed, “people within the [Afghan National Security Forces] knew about the plans to carry out an insider attack” in advance. Sometimes, the plot was reported up the Afghan chain of command, “but nothing was done.” And nobody told American or European commanders about what was going on. That reflected deeper problems in the Afghan system. “The failure of leadership is often compounded by widespread corruption by A.N.S.F. unit leaders using their position to extort money from local citizens, commercial traffic crossing their area of responsibility, and drug trafficking,” Sageman wrote.18
Sageman briefed Allen, who embraced the findings, despite the discouraging elements. The analysis affirmed Allen’s core belief: American and Afghan government forces were allies who had and would share sacrifice to defeat the Taliban. The problem was not cultural incompatibility. The problem was the insurgency. In truth, Sageman’s evidence made clear, it was both; Allen could not do much about Sageman’s belief that the presence of international troops in such large and visible numbers was itself dangerously provocative. Sageman had at least identified a counterintelligence task—identifying Taliban defectors after they were vetted at enlistment, but before they struck—that offered a path to improvement as the American withdrawal went on. And he had provided Allen with a framework for talking to Afghan and American troops about the murder wave. The general could use Sageman’s evidence to move from “let’s hang together” speeches to a rallying cry: “We have a determined enemy.”
Sageman’s report overturned the analysis earlier circulated by the I.S.A.F. Joint Command intelligence analysts. They had found a much lower percentage of links to the Taliban than Sageman did, and therefore had emphasized the theme of cultural friction. In intelligence bureaucracies, it is common to attack the findings of rival units. Tribalism is a factor, but the disputes can also reflect a healthy marketplace of ideas. The lead Joint Command analyst on the murder wave was a civilian with a bachelor’s degree. Her team told Ashley that Sageman was wrong—that he had misclassified his cases, misread the evidence, and ended up with a distorted picture of high Taliban involvement in the killings. According to the Joint Command matrix of cases, only 18 percent of shootings showed links to the insurgency. She and her analysts sent Ashley a long, line-by-line critique of Sageman’s report.
Ashley called Sageman in. “We have to resolve this,” he said. Sageman explained that his differing conclusions were grounded in intercepts that Joint Command analysts had probably not examined. Ashley appointed what was in effect a three-judge appellate panel—three D.I.A. analysts, including the one who had worked with Sageman. They looked at every case. To support his brief, Sageman pulled documents from six different systems that he had used to accumulate his evidence. In the end, after extensive reviews and debate, the appellate panel downgraded one of Sageman’s findings of “definite” links to the Taliban to “probable,” but it upgraded another from “probable” to “definite.” He felt vindicated.19
That winter, Sageman returned to Washington. From there, he helped I.S.A.F. headquarters’ “lessons learned” team rewrite standard operating procedures to account for the category of internal defectors he had identified, to monitor their communications and improve vetting. Some of his Pentagon colleagues wanted to send portable lie detectors to Afghanistan. Even though American courts regarded them as unreliable, polygraphs were a routine tool of counterintelligence vetting at the C.I.A. and other American intelligence agencies. Sageman and the other analysts involved didn’t think they would work in the environment he had seen in Helmand and Kandahar. The only thing Afghan police and army commanders would use them for would be “to beat the other guy,” meaning the detainee, with the machine. Ashley thought the polygraph machines, adapted for use in the Pashto language, were effective, as one part of an array of new measures. These included the deployment of more investigators to support the screening system, Allen’s guardian angel programs, and stepped-up efforts to convince Afghan leaders that they had to take greater responsibility.
The new standard operating procedures did not end the insider murder wave. The number of attacks declined in 2013 and 2014, but so did the number and activity of N.A.T.O. troops. During Allen’s tour, his command closed about 500 out of about 835 N.A.T.O. bases and outposts in Afghanistan. European governments reduced or ended their military commitments to the Afghan war, but they did not abandon support for the Karzai government’s struggle with the Taliban. Allen believed the murder rate fell because of the measures taken during and after Sageman’s investigations, not because of the reduction in troop numbers.
Allen understood Sageman’s point about the provocative potential of the international troop presence. He thought it could be overcome, but Karzai’s public criticism made it harder. Karzai’s rhetoric played into the Taliban’s narrative. Once, Allen confronted Karzai in his office at the Arg.
“Look at the numbers that are in school today,” he said. “Look at the numbers of Taliban we removed that were victimizing your population.”
Karzai cited the number of tribal leaders being assassinated in Kandahar and implied that the Americans had a hand in the violence, so as to sow chaos, so as to have a reason to stay in Afghanistan.
Allen came out of his seat. “We aren’t staying. We are going home. If you’re implying that we are committing these assassinations, you need to tell me.”
Karzai backed off. This had become his familiar demeanor. He shared freely his belief that the United States had a hidden agenda in Afghanistan (otherwise it would do something about Pakistan and the I.S.I.) but he never went so far as to sever relations with American counterparts altogether. Later, when Allen’s mother died, Karzai called him to offer personal condolences.
Sageman reflected on what he had learned. He had spent the last several years studying counterintelligence problems in several settings—the U.S. Army, the Afghan army and police. The Army also commissioned him to study military traitors during the Cold War period to determine what insights might be gained. Whether the context was Soviet-inspired communism or the Taliban or the Islamic State, Sageman concluded, an individual’s act of crossing over to the other side was often about identification, not ideology. It was about feeling a part of someone else’s “imagined community,” in the anthropologist Benedict Anderson’s resonant phrase. Such a change of identification might arise from discussions with friends or coworkers. It might arise from provocations like Koran burnings or images of civilian casualties on the battlefield. Sageman now believed that this had implications for American counterterrorism policy. If the United States escalates a conflict violently and visibly, that action would as a side effect contribute to more terrorism. For the Army Sageman served, it would not be a satisfying or popular insight, but it was where the evidence led him.