by Steve Coll
The deputy chief of staff of the Army, General Richard Zahner, who oversaw the service’s intelligence portfolio, called Sageman. “We have a problem here.” Sageman joined the counterintelligence teams looking at the individuals who had clicked on Awlaki’s materials. These case-by-case investigations took time, lasting into 2011. In the end, however, the review turned up only one individual, Naser Jason Abdo, the son of a Jordanian father and an American mother, who seemed dangerous. In 2011, Abdo was arrested for conspiring to commit violence against fellow soldiers and was sentenced to life in prison. In the several dozen or so other cases Sageman and Army counterintelligence investigators examined, however, they found no evidence of dangerous jihadi radicalization.
Sageman wrote up a classified analysis and briefed General Martin Dempsey, then the chief of Army staff, in his E-Ring suite at the Pentagon.
“You can’t overreact or you will break the Army” by fostering a witch hunt for Muslim traitors, Sageman told the Army leadership. “You have 1.1 million soldiers in the Army. With turnover, we’re talking about maybe 10 million soldiers over ten years. And you have two cases: Hasan and Abdo. That’s your base rate. Every five years you’re going to have some asshole.”
Dempsey and other Army commanders grasped the point. For all the anxiety generated publicly by members of Congress and cable TV demagogues, they did not face a strategic counterintelligence threat from Muslim-American soldiers. It was a huge relief.7
—
At Bagram Airfield, Sageman hopped a helicopter to the Kabul airport, then rode in a convoy to I.S.A.F. headquarters. On board the helicopter, he met a young woman, a legal researcher who worked with the judge advocate general’s office at Camp Eggers.
“What do you have on the insider attacks?” Sageman asked her.
Not much, she said, so far as she knew. But they exchanged cards and e-mail addresses. It would prove to be a fortuitous encounter.
At I.S.A.F.’s headquarters, the compound of lawns and metal trailers, Sageman met Jeffrey Bordin, the sociologist who had completed the landmark study of mistrust between American and Afghan soldiers early in 2011. They had lunch a few times and visited each other’s offices twice. Sageman admired Bordin but found him a little closed and defensive—bruised by experience, at the least. As the problem of insider killings got worse, Bordin had quietly returned to Afghanistan as an Army reservist, to continue his research. The problem for him was that General Allen didn’t appreciate his work any more than Petraeus had. Allen’s mission was to promote comradeship and cooperation between I.S.A.F. and Afghan soldiers, “shoulder to shoulder,” as the slogan went, to allow N.A.T.O. combat forces to leave the battlefield at the end of 2014. Allen believed that the alliance was sound fundamentally, and the Afghans he worked with from day to day did, too; they reinforced Allen’s belief that the fratricidal violence was best understood as a Taliban operation. In any event, in 2012, Bordin found that I.S.A.F. had vastly undercounted the true number of fratricidal killings—by as much as 50 percent. The official count of a quarter of all N.A.T.O. fatalities that year was bad enough. If Bordin’s estimate was right, I.S.A.F. was effectively at war with the Taliban and Karzai’s armed forces simultaneously, an impossible position to sustain. But Allen’s staff didn’t believe Bordin’s numbers. They found the researcher stubborn and headstrong. He was a thorn in their sides. Bordin’s position in reply to such criticism was Yes, the truth hurts.8
Sageman and Bordin now lived and worked in nearby trailers, by coincidence. They exchanged notes. As a social scientist, Sageman found Bordin’s work impressive and methodologically sound. Sageman was inclined to think that there was a direct causal link between the cultural misunderstandings Bordin had documented on the front lines of the “shoulder-to-shoulder” program and the murders Sageman had come to investigate. It seemed apparent to Sageman that international forces had overstayed their welcome. Fratricidal murder might represent only the most extreme outbursts in a chronically frayed atmosphere. The problem was, Sageman had no data. Bordin’s interview records did not touch upon the particular killings upending N.A.T.O.; they chronicled day-to-day perceptions among Afghan and American soldiers.
Prior to 2012, N.A.T.O. had not investigated or analyzed insider attacks systematically. Each victimized coalition government handled investigations according to its own procedures. The records were scattered. During 2012, the I.S.A.F. Joint Command, the war’s day-to-day headquarters unit, which was located on the north side of Kabul’s airport, adopted a new approach. The command created Joint Casualty Assessment Teams—“JCATs,” as they were called—to investigate and report on insider attacks immediately after they took place. The teams flew to the site of a murder or attempted killing (more than half of the attacks took place in Kandahar and Helmand), where they would interview witnesses, examine the crime scene, and write up a report within two days. The Joint Command’s intelligence unit reviewed these investigations. A brigadier general, Paul Nakasone, oversaw the unit; he ran a department of twenty or so analysts, some from the Defense Intelligence Agency, others civilian. Not too many murder investigations can be resolved in just two days, but the JCATs were intelligence analysts, not detectives working toward an arrest and conviction. The Joint Command’s approach effectively prioritized speed over depth, in Sageman’s view.9
He discovered that Great Britain had dispatched a brigadier of the Royal Dragoon Guards, Tim Hyams, to look at the insider threat across the N.A.T.O. command. His title was chief, insider threat mitigation, and he oversaw a multinational cell of analysts and investigators. In late October, Sageman and Hyams traveled to the Joint Command headquarters to meet with the JCATs’ murder investigation squads. But the analysts there told Sageman and Hyams that they had no data. This turned out to be untrue—they had been building a matrix of information about the killings they had investigated. Bureaucratic hoarding of intelligence was commonplace. Hyams did not have high-level clearances. The pair went away empty-handed, without even being told that the matrices on the cases existed.
Sageman e-mailed the Army legal researcher he had met on the helicopter. He asked if she had copies of the “15-6” records of insider murder cases. These were highly detailed files created by the Army’s Criminal Investigative Division staff, who looked into violent deaths where something other than straightforward combat might be involved. C.I.D. records often included extensive interviews with witnesses, reconstructions of crime scenes, and other rich evidence. They were subject to confidentiality and privacy rules, however.
The researcher asked her boss, an army lawyer, who wrote Sageman.
“Do you have the names of the victims?” the lawyer asked.
“That I have.”
All right, she said, but don’t tell anybody about my cooperation.10
Ultimately, she sent Sageman records of two dozen insider murder cases that had involved Army personnel. Military C.I.D. investigators had conducted almost all of the reviews. An exception was the case of a female C.I.A. base chief in Kandahar killed by an inside suicide bomber. C.I.A. investigators had looked into that attack. It proved harder to persuade the Marines to turn over records; they had about ten cases. And there were other cases involving Britain and continental European militaries. Of the files Sageman ultimately received, about three fifths included full 15-6 files, each of which ran to hundreds of pages of interview notes and other documents.
He traveled to Helmand and Regional Command headquarters elsewhere to talk to some of the investigators as well as other officers who knew the cases. He also interviewed ten confessed murderers being held in Afghan prisons. He began to build his own matrix of forty factors in each shooting—where the Afghan shooter was from, what language he spoke, who the victims were, whether there was evidence of ideological motivation, how the attack had been executed, and so on.
Some of the murders turned out to have little or nothing to do with either personal slights or
the Taliban insurgency. In one case, a N.A.T.O. unit that had been quietly paying off locals with a regular tanker of gasoline rotated out and the incoming unit ceased the practice. The aggrieved smugglers shot the new soldiers. In three or four cases, Afghan soldiers who kept young Afghan boys as sex slaves—“chai boys,” or tea boys, as the victims were euphemistically known—fell into apparent crises of conscience over their behavior and decided to purify themselves by joining the Taliban. To prove they were worthy, they shot up N.A.T.O. soldiers on their way out. In Helmand, Sageman examined a case where local thugs involved in protection rackets for truckers decided to join the Taliban, but were told they had to first kill an American to prove their bona fides. This morass of corruption, sexual predation, and gang thugs becoming made men evoked Elmore Leonard’s texture of debased human truths, but it was not obvious how violence of that character might be stopped.
Other cases, however, provided evidence of direct Taliban military operations. The killing of the C.I.A.’s base chief that autumn was one such example. A brother of a local police chief in Kandahar defected to the Taliban and decided to carry out a suicide bombing. Telephone intercepts tracing all the way to Quetta documented the orders the bomber received. In essence, these orders were “When your brother gets some V.I.P.s visiting, go and blow yourself up.”11
As he traveled, Sageman wrestled with the question of whether personal affronts or American arrogance provoked fratricidal murders. In late November, he investigated a case where there were rumors that the shooter had been outraged by a story that I.S.A.F. forces had held up a pregnant Afghan woman’s car at a checkpoint, preventing her from getting to the hospital to deliver her baby. The JCAT report of the case chronicled this motivation. Supposedly, the shooter had learned of the woman’s case and spontaneously attacked. Sageman picked through the 15-6 file, which included dozens of photographs of the attack taken from soldiers’ helmet-mounted cameras. The photos, along with the interviews he conducted, showed that there was no civilian car involved, no pregnant woman. It was not clear where this story had even come from. The attacker had approached in a column of combined N.A.T.O. and Afghan forces, in the back of a pickup with a mounted machine gun. He had previously decided to join the Taliban and defected on the spot by opening fire at random military targets. Sageman stared at the photos and wondered if other reports about personal or cultural misunderstanding escalating into shootings might also be inaccurate.12
As the weeks passed, back at the I.S.A.F. compound, hunched over a restricted computer terminal, Sageman found that communication intercept evidence provided the greatest insights. Because of his previous Army counterintelligence work, Sageman had access to many compartments in the Joint Worldwide Intelligence Communications System, where the Army stored Taliban intercept records, among other sensitive information. Ashley assigned a D.I.A. officer to help. Sageman and the officer extracted names, dates, and details from their 15-6 and other murder investigative files to use in searches to retrieve archived intercepts. Gradually, these transcripts led Sageman to change his thinking about the nature of the problem and to develop a new hypothesis.
The hardest thing to let go of was the “myth,” as Sageman began to call it. This was the belief that cultural incompatibility between N.A.T.O. and Afghan soldiers had grown so severe it occasionally turned murderous. Bordin’s valid field interviews had created a misleading impression, Sageman concluded. In fact, violence did not follow misunderstanding or resentment very often, Sageman found. In many cases, there was no or very little contact between the victim and the shooter before the murder. In these cases, the shooter behaved more like a mass killer who walked into a mall and fired on shoppers at random.13
There were clearly some acts of broad, well-publicized cultural or political provocation—the mistaken Koran burnings at Bagram in February 2012 and, the following month, the mass murder of Afghan civilians carried out by U.S. Staff Sergeant Robert Bales near Kandahar. These incidents had provoked vengeance-seeking insider killings by Afghans. The murders of Loftis and Marchanti were an example. Of course, even their deaths did not arise from intimate misunderstanding between the shooter and his victims. To General Allen, these revenge killings after public events of desecration by Americans belonged to a different category from other insider violence. Altogether, Sageman concluded, there were seven or eight killings caused by cultural provocation, particularly the Koran burning, but these cases were far from a majority.
The Taliban intercept records provided evidence that in many more cases, Afghan soldiers and police changed their minds about which side of the war they wanted to be on. Then, from inside N.A.T.O. bases, these side switchers reached out to Taliban commanders by cell phone to volunteer their services. Or, through social networks, Taliban commanders opened phone conversations with government soldiers or police and recruited them to defect. The Taliban instructed the volunteers to kill N.A.T.O. soldiers and then run away to join the Taliban. As the murders quickened, the visibility of insider killings created stimuli for new defectors. When contacted by volunteers, the Taliban encouraged them to murder N.A.T.O. personnel because the killings made news and sapped Western morale. Encouraging a defector to kill on his way out the gate also resolved the Taliban’s own counterintelligence risk, because the shooter wrote his true intentions in blood and erased suspicion that he might be an N.D.S. or C.I.A. infiltrator.
As Kabul nights turned freezing and Christmas neared, Sageman started to write up his findings and analysis. None of it was black and white and plenty of mystery remained. What caused the insider Taliban volunteers to change their minds? This was harder to document because the phone intercepts did not typically reveal motivation and many of the murderers had been killed by return fire or had escaped. In any event, the number of Afghan defectors to the Taliban side was not particularly large or unexpected in such a war dividing families and tribes. It was, rather, the shocking death toll the shooters managed to exact as they switched sides that made them significant.
There remained many cases—perhaps a quarter of the total—where the murderer’s motivation was unknown or arose from some extraneous tangle, like corruption rackets. As Sageman was writing, another of these cases turned up on his doorstep.
On Christmas Eve 2012, Joseph Griffin, a forty-nine-year-old American police trainer from Mansfield, Georgia, was shopping at a stall just outside police headquarters in downtown Kabul. He was looking for a belt buckle for his son, who was back in the States. A thirty-three-year-old female Afghan police sergeant in uniform, who had trained as a sharpshooter, approached Griffin, pulled out a pistol, and shot him dead. The woman then tried to melt away among pedestrians. She was arrested before she could escape.
Sageman hustled over from I.S.A.F. headquarters. He interviewed the shooter at the scene. She seemed to be faking a psychiatric condition, but didn’t do it very well. Kabul police raided the woman’s house and soon returned with garbage bags of her belongings and dumped them on a table. It turned out that she was an Iranian citizen who had married an Afghan refugee and then moved to Afghanistan with him. She was a Shia—the Islamic sect generally opposed to the Taliban—and she had recently been to the Iranian consulate about returning home. The Kabul police thought the murder was an Iranian operation, but Sageman doubted that. She had no apparent contact with anyone, Iranian or otherwise. He marked her down as another “unknown.”14
As Sageman completed his analysis, the season of Ramadan jumped out of his numbers. The number of insider attacks had approximately tripled during Ramadan, then returned to its previous rate. This anomaly stood in contrast to the total number of “security incidents” in the Afghan war during the summer. The war’s total measured violence had peaked in June and then fallen steadily into the autumn. If Ramadan was not a stimulant of combat, why was it a stimulant of insider murder? Sageman looked back at the less complete data for 2011 and saw a mini-peak of murder during Ramadan that year as well. One of the atta
ckers Sageman interviewed in detention told him that Ramadan “was a time when lots of informal religious discussions took place” among Afghan soldiers and police working with N.A.T.O. The talk “about religion and tradition . . . might have tipped people predisposed to attack I.S.A.F. into actually doing so.” Sageman also noticed that several of the murders linked to corruption or the sexual exploitation of children had taken place during Ramadan. The holy month, he wrote, “is a time when people look for redemption, especially people who might have a guilty conscience.”15
In January, Sageman completed a draft of “The Insider Threat in Afghanistan in 2012.” The unclassified version ran to thirty pages with a hundred footnotes. Its main argument sought to debunk the “myth of personal social insensitivity” as a factor in insider murders. His review of all the 2012 cases “failed to detect a single case where direct personal social misunderstandings escalated into confrontation ending in a lethal firefight.” More general perceived cultural insults did stimulate violence, in about 10 percent of cases, according to Sageman’s analysis. But these perceived insults “fell on fertile ground” because a majority of the murderers studied had connected with the Taliban before they decided to kill, either because they were recruited while on the inside or because they volunteered. Sageman reported that 56 percent of the inside attackers had “solid” links to the insurgency, another 9 percent had “probable” links, and another 10 percent had “possible” links. These conclusions came substantially from the telephone intercept records he and his D.I.A. colleague had examined. Altogether, 75 percent of the attacks involved shooters who had at least possible prior links to the Taliban. They were not infiltrators, however; they were side switchers.16