Terrorists in Taliban-Ruled Afghanistan

In October 2021, the U.S. undersecretary of defense for policy, Dr. Colin Kahl, testified before the U.S. Congress on the status of security in Afghanistan. When asked about the potential resurgence of international terrorism emanating from the country, Kahl responded that the U.S. intelligence community assessed both al-Qaida and the Islamic State’s “Khorasan” branch (known as ISK) “have the intent to conduct external operations, including against the United States, but neither, currently has the capability to do so.” Kahl went on to state that ISK could potentially develop such a capability within 6 to 12 months, while al-Qaida could take a year or two to do so.

We are now within the window of Kahl’s assessment for these two groups to have potentially reconstituted their capabilities to threaten Afghanistan’s neighbors and beyond. But have they done so?

A year after Kahl delivered this assessment, it is worth taking stock of notable terrorist groups in Afghanistan and what various actors are doing to counter them. The rest of this article examines the recent evolution and current status of four terrorist groups in Afghanistan, namely al-Qaida, ISK, Tehrik-e-Taliban Pakistan (TTP), and the East Turkestan Islamic Movement (ETIM, also known as the Turkestan Islamic Party). After discussing each group in turn, the article will describe what – if anything – the Taliban have done about them, as well as what we might expect in the year ahead.

Al-Qaida

Al-Qaida’s presence in Afghanistan consists of a cadre of its “core” leadership as well as members of its regional affiliate, known as al-Qaida in the Indian Subcontinent (AQIS). At the time of the Taliban’s takeover of Afghanistan, al-Qaida’s core leadership released a statement that heartily congratulated the group on its accomplishment. It also used the opportunity to energize its global affiliates and to reinvigorate drives for new recruits and funding.

Al-Qaida’s leadership had been recovering from a period of losses, and Ayman al-Zawahiri, Osama bin Laden’s successor as the head of the organization, released a video in September 2021 that put to rest persistent rumors of his death. In early 2022, al-Qaida was assessed to have several dozen senior leaders in the country, some of whom were reported to be living in Kabul’s former diplomatic quarter. Zawahiri was believed to be in eastern Afghanistan, along with several other core leaders.

By May 2022, the U.N.’s monitoring team concluded that “the operational activities of al-Qaida in Afghanistan have been limited to advice and support to the Taliban… al-Qaida appears free to pursue its objectives, short of international attacks or other high-profile activity that could embarrass the Taliban or harm their interests.” It also assessed that al-Qaida would likely remain focused on internal reorganization to better pursue its global jihadist aspirations. The U.S. government largely concurred with that assessment.

By July, however, al-Qaida had re-energized its media wing and Zawahiri had been issuing regular audio and video messages exhorting his followers to “besiege America with terror.” These activities seemed to indicate a newfound level of comfort for the al-Qaida leader within Taliban-run Afghanistan. Nonetheless, al-Qaida appeared to be refraining from developing an external operations capability in Afghanistan in order to stay on the good side of its Taliban hosts.

In early August, President Joe Biden announced that the United States had killed Zawahiri via a drone strike in Kabul. Validating the earlier assessment of some U.N. member states, Zawahiri was found living in the diplomatic quarter of the capital, in a house that was maintained by a close associate of Sirajuddin Haqqani – the acting minister of interior in the Taliban’s interim government.

Zawahiri’s death marked the second time the U.S. had killed the leader of al-Qaida. In an ironic operational reversal, while Osama bin Laden was killed in Pakistan by U.S. troops based in Afghanistan, Zawahiri was killed in Afghanistan by a U.S. drone that flew through Pakistani airspace on its way to Kabul. Both leaders, however, were killed near important governmental institutions in each country, fueling accusations in both cases of the host government’s complicity in hiding them.

Al-Qaida’s regional affiliate, AQIS, was assessed in mid-2022 to have between 180-400 fighters and a presence in at least six to nine provinces of Afghanistan, a situation that has been roughly constant since the Taliban’s takeover. While the group has not formally claimed an attack since 2016, AQIS was heavily involved in fighting alongside the Taliban during its campaign to capture the country in 2021 and it continues to do so in operations against ISK. Overall, however, AQIS continues to be viewed as the weakest and least globally significant of al-Qaida’s formal affiliates. U.S. intelligence agencies assess AQIS as remaining primarily focused “on its own survival and reorganization.”

Islamic State – Khorasan

ISK is the Islamic State’s “province” in South Asia, whose sights are set on the historical region of Khorasan (which comprised large swaths of Iran, Afghanistan, and several Central Asian states), as well as Pakistan. Even before the U.S. withdrawal from Afghanistan, ISK had recovered from the losses it suffered at the hands of U.S. counterterrorism operations and in clashes with the Taliban and was in the process of rebuilding itself.

The appointment of Shahab al-Muhajir as the new leader of ISK in September 2020 provided the group new energy, as he brought a wealth of prior experience working with al-Qaida and the Haqqani network. Under his leadership, ISK attacks in the first quarter of 2021 were nearly triple those of the year before. The strategy that he put into place re-emphasized attacks on sectarian and minority groups, focused attention on attacking the Taliban directly, and eventually added a new component of attacks against economic targets and critical infrastructure. The goals of this strategy are to instill “fear through raids and assassinations of Taliban officials and security forces; [exacerbate] sectarian tensions; and [delegitimize] the existing governance structure.”

Amid the U.S. evacuation of Kabul in late August 2021, ISK conducted a suicide attack that killed 13 members of the U.S. military and at least 170 Afghans. This attack elevated ISK to be perhaps the most prominent of the Islamic State’s regional affiliates and resulted in $500,000 in new funding from Islamic State leadership in Syria.

By late 2021, ISK was assessed to have increased in size from roughly 2,200 fighters to approximately 4,000. The increase stemmed from a combination of the nation-wide jailbreaks that accompanied the Taliban’s overrun of government security positions, defections from other militant groups (including the Taliban and ETIM), and former members of Afghanistan’s security forces, in addition to new recruits lured in part by financial incentives (the U.S. has assessed that ISK is more capable of consistently paying its members than the Taliban). The group was primarily located in a few provinces of eastern Afghanistan (such as Nangarhar), although it also had notable recruiting and attack networks operating in Kabul, a sizable presence in five northern provinces, and at least a minimal presence in every other province of the country.

In the months following the Taliban’s ascendence in Afghanistan, ISK conducted a campaign of attacks against Taliban forces. In response, the Taliban mobilized, conducted sweep and search operations, and engaged in brutal suppression of populations believed to be supporters of ISK. While these efforts suppressed ISK cells in some areas, they failed to substantially diminish the overall threat posed by the group. From April through June 2022, ISK claimed 80 attacks in Afghanistan, an increase of 90 percent from the prior three months. These attacks spanned 11 Afghan provinces, nearly doubling the geographic spread of the previous quarter. They included heinous assaults on minority groups, such as one at a Shia Hazara mosque in Mazar-e-Sharif that killed or wounded over 90 civilians and another on a Sufi mosque that killed at least 33 people. In total, Human Rights Watch concluded in September that ISK has so far killed or wounded over 700 Hazaras alone since the Taliban rose to power.

In conjunction with its growing strength in Afghanistan’s north, ISK also conducted rocket attacks against security force targets in Tajikistan and Uzbekistan – its first external attacks against either country – as well as sustained attacks against Pakistani security forces, in an attempt to demonstrate expanded capabilities and to strain relations between the Taliban and its neighbors. In early September, ISK also attacked the Russian embassy in Kabul. The group’s attacks against Taliban security forces have continued and become bolder, as evidenced by an early August attack in which ISK forces took hostages and control of an apartment building in Kabul and then used it to rain fire on Taliban security patrols below. The Taliban took nearly seven hours to retake the building.

ISK has also dramatically increased, altered, and expanded its media output to appeal to a broader set of audiences. Its themes are now more religiously attuned and tailored to undermine the Taliban’s claims of legitimacy. As stated by Lucas Webber and Riccardo Valle in a recent article for The Diplomat, “the majority of [ISK] publications now criticize the Taliban for its foreign relations and attempts to fit in with the international community… [ISK] accuses the Taliban of being controlled by and selling out to what it perceives as the great power enemies of Islam, namely China, Russia, and the United States.” ISK has also routinely aimed its propaganda at Iran, through translations of its publications into Farsi and the use of Farsi channels on social media.

The group has even expanded its media offerings to include Pashto and Central Asian languages, in an attempt to recruit more members from those communities (it has been successful in doing so previously, for example in 2015 when a faction of the Islamic Movement of Uzbekistan pledged fealty to ISK). Notably, an ISK attack on a Shia mosque last October was conducted by a Uyghur, marking the first time the group has employed a suicide bomber from that ethnic group. In line with this development, ISK has also been more aggressive in its messaging against China, likely intending to recruit more Uyghurs and to use the lever of competition between the U.S. and China to its advantage. ISK has also more aggressively targeted global audiences via a notable increase in English language media, including books, magazines, and videos. The group’s central media hub, Al-Azaim, “now produces materials in at least Pashto, Dari, Arabic, Urdu, Farsi, Uzbek, Tajik, Hindi, Malayalam, Russian, English, and occasionally Uyghur,” Webber and Valle wrote. “Further, Al-Azaim uses various platforms such as Telegram, Facebook, TikTok, Hoop, Element, Archive.org, and more.”

Tehrik-e-Taliban Pakistan

The TTP is an umbrella organization comprised of roughly 40 Pakistani militant groups whose main targets to date have consisted of the Pakistani government and its security forces. It is generally allied with the Afghan Taliban – having pledged allegiance to its supreme leader – and has strong links especially to the latter’s Haqqani faction. In general, the Taliban appear to have deep support for the TTP and its goals. TTP leaders also maintain ties to members of al-Qaida and to ETIM, in addition to a range of other militant groups.

Even before the Taliban’s takeover of Afghanistan, the TTP had begun recovering from several years of fragmentation that severely weakened the group from its zenith in 2009. The strengthening continued after the fall of Kabul. The group has been deemed the largest beneficiary of the Taliban’s takeover, effectively enjoying “de facto political asylum” in Afghanistan. The TTP’s leader, Noor Wali Mehsud – with the help of the Haqqanis and possibly also members of al-Qaida – effectively reunited and merged a number of groups, which resulted in a more cohesive and sizable organization.

Before the Taliban’s ascendance, the TTP was reported to consist of 3,000 to 4,000 fighters located in eastern Afghanistan, which constituted the largest group of foreign fighters in the country. Inside Pakistan, the TTP has expanded its presence to include the tribal areas as well as Balochistan, Karachi, and Gilgit Baltistan. As a result, the group is much more politically powerful and it now poses a more substantial threat to Pakistan.

The group’s narrative has shifted from global jihadism to one that is Pashtun- and Pakistan-centric. This has left some analysts to wonder whether the group’s goal remains overthrowing the entire Pakistani government or if it has evolved to a more limited aim: the establishment of its own, smaller state in the tribal areas of Pakistan governed by Shariah.

In the months that followed the Taliban’s rise, the TTP declared a ceasefire in exchange for the Pakistan government releasing TTP prisoners. The two sides then engaged in a round of unsuccessful talks that were facilitated by the Taliban. Following the breakdown of those talks, the TTP suspended its ceasefire. The group then launched a spring offensive named “Al Badr” in March, which resulted in the deaths of nearly 100 members of the Pakistani security establishment. It also conducted several notable attacks against Chinese officials in Pakistan, a development that greatly concerned the Pakistani government as it had the potential to threaten Chinese investment in the country.

In May, TTP leaders announced a unilateral ceasefire at the request of Pakistani tribal elders and began negotiations with the Pakistani government. The TTP demands in these talks center on the release of its prisoners and the reversal of the absorption of the Federally Administered Tribal Areas of Pakistan into Khyber Pakhtunkhwa province. In early June, the TTP announced that it was extending its ceasefire indefinitely to continue negotiations, although sporadic clashes between its forces and the Pakistani security establishment have continued. In early August, one of the TTP’s key leaders was killed via a bomb blast in Afghanistan, the perpetrators of which have not been identified.

East Turkestan Islamic Movement

ETIM is comprised primarily of Uyghurs, who are ethnically Turkic and follow the Sufi school of Islam. Of the four groups described in this article, ETIM is generally of least concern for the international community, with the notable exception of China, which sees the group as a potent threat in relation to the large Uyghur population that it has been repressing in its western regions.

In late 2021, the U.N. reported that the Taliban moved ETIM’s few hundred fighters from their locations in Badakhshan province, which borders China in northeastern Afghanistan, to several more distant northern provinces. Presumably, the Taliban did so to reassure Beijing of their intent to contain ETIM’s members from launching attacks against China or Chinese interests in Afghanistan. Nonetheless, ETIM remains operational in Afghanistan, engaging in activities such as running extremist madrassas, disseminating propaganda, and training fighters for a jihadist campaign to establish their own state (East Turkestan).

By July, ETIM was reported to have rebuilt several of its positions in Badakhshan and re-established its main operating location in Baghlan. The group was also encouraging its members to register as refugees or apply for citizenship in Afghanistan, in the hopes that the Taliban would then provide them with documents enabling international travel. The head of ETIM, Abdul Haq, shook up the group’s leadership council and made efforts to strengthen connections between ETIM and other militant groups, most notably TTP. ETIM maintains a strong relationship with the Taliban, as well as al-Qaida.

What Have the Taliban Done?

In the few months after the Taliban’s conquest of Afghanistan, the U.N. assessed that there were no “signs that the Taliban [have] taken steps to limit the activities of foreign terrorist fighters in the country. On the contrary, terrorist groups enjoy greater freedom there than at any time in recent history.”

The movement of ETIM fighters away from Afghanistan’s border with China would seem to be an example of the Taliban restricting one terrorist groups from threatening a neighbor, but subsequent reports of ETIM re-establishing itself in its prior locations – after China proved unwilling to embrace the Taliban regime – call that into question. The de facto asylum granted by the Taliban to thousands of members of the TTP and the Taliban’s refusal to act on Pakistani demands for their expulsion are another example of regional terrorists enjoying a safe haven in Afghanistan.

The discovery of Zawahiri living comfortably under Sirajuddin Haqqani’s protection in Kabul was a high-profile punctuation of what now appears to be a Taliban policy of allowing these groups to remain in Afghanistan – even while conducting activities ranging from exhortations for attacks against other countries (al-Qaida) to preparing (ETIM) and executing those attacks (the TTP). Such activities are exactly what the Taliban promised to prohibit when they signed the U.S.-Taliban Agreement in February 2020, which the Taliban continue to assert remains in force.

The only group against which the Taliban have taken sustained countering actions since they seized control of Kabul is ISK. Unsurprisingly, this is because ISK is the only terrorist group in Afghanistan that poses a direct threat to the Taliban themselves. Privately, some mid-level Taliban commanders have expressed concerns about defections of their fighters to ISK and many of the Taliban government’s actions appear to center on mitigating these concerns. Taliban leaders prioritized maintenance of the group’s cohesion while it was still an insurgent movement and this remains a top priority of the Taliban government (at least for its Pashtun factions; the group seems to care less about minority group elements).

Yet, the Taliban’s attempts to suppress the Islamic State – which have included night raids, invasive house searches, targeting and harassment of Salafist populations that the Taliban suspect of supporting ISK, extra-judicial killings, and public hangings of accused ISK members – have proven ineffective at containing the group.

Looking Ahead

The most notable developments regarding these four terrorist groups over the past year have been Zawahiri’s death, ISK’s expansion, the TTP’s ceasefire declarations and negotiations with Pakistan, and ETIM’s re-establishment of its positions in northern Afghanistan.

Looking forward, al-Qaida will need to select a new leader. In contrast to the quick announcement of Zawahiri as bin Laden’s successor, the former apparently did not have a succession plan in place for his own demise. Whether al-Qaida will select a caretaker figure to continue on its current trajectory or whether it will opt for a visionary disrupter that steers the group toward another path remains to be seen. Leading candidates include Saif al-Adel, an Egyptian and long-time senior al-Qaida figure currently under house arrest in Iran, and Abd al-Rahman al-Maghrebi, a Moroccan who leads al-Qaida’s propaganda efforts (also from within Iran).

Analysts remain divided as to what the ultimate impact of Zawahiri’s death will be for al-Qaida going forward. Some note that he was viewed as an uncharismatic, dogmatic orator who was far less inspiring than bin Laden or previous al-Qaida firebrands like Anwar al-Awlaqi. Others cite Zawahiri as a talented strategist and organizational leader, who effectively managed al-Qaida’s transition from a hierarchical, centralized group to its current decentralized – and far more resilient – model of networked affiliates. It is difficult to say, therefore, whether this transition will substantially change the U.S. assessment that al-Qaida is on a “declining global trajectory” and would need another one to two years to “conceptualize, develop, and execute complex plots.”

Regarding ISK, the U.N. assessed that the group “poses the greater threat in the short and medium term” while the U.S. maintains that ISK “could develop a capability to attack the United States within the next year, if the group prioritizes such an attack.” It is unclear whether ISK will do so, though it seems unlikely in the year ahead. One reason for this is that the group has developed and is executing a strategy that appears to be successful, judging by its increase in overall membership, attacks, and media output, and general notoriety relative to other affiliates of the Islamic State. While striking directly at the U.S. would bring even more notoriety, doing so would necessitate a robust U.S. response with consequences likely matching those that befell al-Qaida in the wake of 9/11 and the Islamic State in Iraq and Syria after its meteoric rise and inspired attacks against Western states in the mid-2010s. Yet ISK’s attacks beyond the borders of Afghanistan – inside Pakistan and against Tajikistan and Uzbekistan from Afghan soil – along with its increased media output in English (among other languages), means that the possibility of near-term external attacks by the group cannot be fully discounted.

While the TTP remains the largest terrorist group resident in Afghanistan, its aspirations remain locally focused on Pakistan and this seems unlikely to change. Analysts seem generally aligned that the negotiations between the TTP and the Pakistani government are unlikely to end positively, given that each side is advancing demands that cross the other’s redlines. We are thus likely to see fits and starts in those talks – alongside occasional skirmishes – if not their collapse and return to outright fighting. ETIM is far smaller and will likely remain in building mode as it develops capabilities and prepares itself for a long-term struggle against China.

In sum, a year after the Taliban’s takeover of Afghanistan, the country remains a simmering cauldron of jihadist terrorist groups, various actors seeking to counter them, and conflict and cooperation among the groups themselves. The Taliban have attempted to counter ISK and possibly to temper the actions of ETIM and the TTP, while al-Qaida appears to have had a much freer hand. The temperature of the jihadist cauldron has thus fluctuated over the past year, though it appears to be slowly rising overall.Whether it will continue to do so is predicated on too many variables to accurately predict; perhaps the only viable prognostication is that the pot is unlikely to boil itself dry anytime soon and the Taliban are unlikely to pour it out. States concerned about terrorism in Afghanistan would therefore do well to calibrate their resources, actions, and expectations for a longer view of an issue that is likely to last another generation or more.