Afghanistan Analysts Network – English

War and Peace

A Black Week in Kabul (2): Who are the most likely perpetrators?

Borhan Osman 12 min

On 31 May and 3 June 2017, Kabul was the scene of a series of new terrorist bomb attacks that took a heavy toll on the civilian population. While no group has claimed the attacks, the Afghan government has pointed at the Haqqani network, which is part of the Taleban. All this leaves room for various hypotheses and conspiracy theories. In this piece, following up on an earlier AAN summary of events and analysis of the political tensions that followed the bombings, AAN’s Borhan Osman weighs up the few clues available so far and assesses the most plausible explanations as to who could have been behind these attacks, and why. 

The alleged ISKP claim of the 31 May 2017 Kabul terrorist attack rejected by a pro-ISKP website. Source: Screenshot.

For a chronology of events leading up to 4 June 2017, read the first AAN analysis of the ‘black week’ in Kabul here.

Following a series of terrorist attacks and protests in Kabul, starting on 31 May 2017, there has been a prevailing sense of tension in Kabul, although the city has remained calm over the last three days, between 4 and 6 June 2017. Demonstrations have not taken place. Only the protestors who held out in a tent not far from the 31 May bomb site have erected two new tents in town, a sign that they are determined not to give up.

At the opening conference for the Kabul Process  on 6 June – a new attempt by the Afghan government to start a regional peace initiative –, President Ashraf Ghani released new casualty figures for the 31 May attack in Kabul: 150 dead and 350 injured. Injury figures had previously been reported as 450, so it can be assumed that many of those hurt in the blast have since passed away. This makes it the most devastating attack in Kabul since 2001.

ISKP: Celebrations but denial of responsibility

Beyond the official narratives of how the bomb attacks on 31 May and 3 June were carried out, one can only make an informed speculative analysis based on plausibility, in order to ascertain who was behind the attacks. There are two main possible perpetrators, based on other recent attacks in Kabul: the Taleban (all elements, including the Haqqani network, taken as a collective whole), who have been responsible for most of the previous attacks in the city, and the Islamic State Khorasan Province (ISKP), which is a relatively minor but growing actor.

Online sources known to reflect ISKP thinking initially celebrated the attack which, they said, must have killed muharibs (people in combat with IS) and their ‘puppets’, based on where the attack took place, which was near western embassies, the offices of international organisations and Afghan government installations. They even condemned the Taleban’s condemnation of the attack.

Several media outlets, both Afghan and non-Afghan (1 TV during a live transmission, Xinhua citing Afghan officials, Iran’s Fars news agency and the BBC’s John Simpson, for example, in a tweet) reported an ISKP claim, but never gave a source. These reports appear to have been wrong.

Later on, around ten hours after the explosion, social media accounts of known ISKP activists published an announcement denying responsibility and condemning the attack. The announcement came in the form of plain text rather than a formal statement with the group’s logo and usual layout. It noted that there would be no formal statement since, it said, the organisation (including its Afghanistan-Pakistan ‘provincial’ chapter) only issues statements when it carries out or claims an attack, not in the case of denials.

Two days later, on 2 June 2017, two Arabic-language statements bearing the logos and the graphic style of ISKP and the ISIS-affiliated Amaq news agency, spread throughout social media and were even widely circulated by the Taleban, including by their media division. One statement said the bombing had targeted the Germans and had killed a large number of their guards. The other statement contained the name and photograph of the alleged bomber, with his face blurred. ISKP-affiliated websites and online activists, however, rejected the authenticity of the two statements and pointed to flaws in the style of the statements as signs of fabrication. They blamed the Taleban for spreading fake statements in an attempt to cover up their own responsibility. It is not clear who crafted the statements or why, but the fact that the Taleban drew attention to them does suggest that they may have indeed been the source.

For ISKP, a successful truck bomb such as the one that carried out the attack would be a first and would represent a significant scaling up of its operational and logistical capabilities. So far, the organisation has not been able to supply or source such a large amount of explosives in Kabul. Most of the attacks it has claimed have been carried out by single or multiple bombers equipped with explosive belts and automatic guns, as reported in earlier AAN dispatches (for example here). However, it is not beyond the realm of possibility that ISKP’s Kabul cell could have upped its capacity and managed to transport this amount of explosives to one of Kabul’s better-guarded areas. There is always a first time. Moreover, ISKP is not operating within a void. Criminal networks and groups loosely connected with other insurgency actors are able to provide ISKP with one-off help in exchange for financial incentives. But it is too early to say whether that really happened.

The most powerful argument against ISKP’s involvement in the bombing is the fact that it would almost certainly have claimed it had the group carried out the attack. First, the group does not care much about its popularity, especially in the Kabul environment, and would be ready to face a public outcry produced by such an atrocity. The area of the attack could also be well justified in ISKP’s logic, with all its ‘legitimate targets’. This was already evident in early comments on social media by ISKP members before the informal denial came. On the contrary, claiming such an attack would have given ISKP an enormous propagandistic boost, which it certainly needs following recent setbacks, such as the attacks on its strongholds in eastern Afghanistan. (There were even initial speculations that the blast could have been an act of revenge for the ‘MOAB’ strike that was directed at ISKP in Nangrahar province.) This attack, had it been claimed, would have put ISKP at the top of the international news headlines. This is probably no different from IS claims on recent attacks in London and Manila (the latter not even considered a terrorist attack by investigating agencies.)

The fact that the attack has remained unclaimed could also have encouraged ISKP to lay claim to it for the sake of publicity.

The attack would have shown that ISKP had indeed shifted gears, carrying out an attack of this magnitude with such a powerful bomb. It would have boosted its standing vis-à-vis its other major enemy in the Afghan arena, the Taleban.

A close study of ISKP’s media operation, however, indicates that it has started developing more rigorous internal regulations when it comes to its media outreach. Claims of major attacks have to first go through their provincial media branch, which are then given the green light by central media operators in Syria, according to ISKP sources. All in all, ISKP’s involvement in the 31 May terrorist attack remains the less plausible scenario.

Taleban: Condemnation – but…

The Taleban denied responsibility for the attack, and even condemned it. This statement came four hours after the attack. This relatively sluggish response is fairly common for them, however. For a normal attack planned by their central military commission, Taleban spokesmen are immediately briefed when it happens, even sometimes in advance. But for attacks undertaken by special units of the Taleban, or groups that do not always coordinate with the central military commission – such as the Haqqani network –, it usually takes time for the Taleban to establish their own involvement. In some cases, the interval between an attack and a claim or denial is intentional, in order to assess the consequences of the attack and gauge public opinion, before making an official statement (more on this further down.)

In the case of the bomb at the Chahrrahi-ye Zanbaq (Zanbaq junction) on 31 May, however, Taleban social media activists went further than simply condemning it. They blamed it on US and/or foreign intelligence agencies and vowed to avenge the attack, saying that the root cause of the problem was “foreign occupation” and that the only solution to stop such carnage was to end it.

Despite the Taleban’s categorical denial, however, the attack bears all the hallmarks of the movement more than of any other non-state actors. The movement’s operational capacity and logistical access to plan and execute such a bombing is beyond question. It regularly carries out attacks of this magnitude. The main questions are, what was the intended target and why have the Taleban denied it? It could have been a premature detonation, which concurs with the official version that the truck only detonated after the ANP stopped it at the entrance to the city’s well-protected ‘Green Zone’.

The real intended target remains a matter of speculation, as many prominent institutions are present in the area: government institutions (the presidential palace, Ministry of Defence or NDS, for example), international headquarters (including that of Resolute Support and the CIA, in the Ariana Hotel), embassies (many western ones, but also the Indian embassy) etc. The amount of explosives and the magnitude of the explosion, however, were clearly designed to do as much damage as possible.

To understand what may have happened, it is useful to revisit an earlier AAN dispatch on how some semi-autonomous networks under the umbrella of the Taleban operate and why the movement might deny some of the attacks they carry out. These networks tend to have their own sources of funding and a particular chain of command, although nominally and officially under the Taleban’s Rahbari Shura (the Leadership Council.) The Haqqani network is probably the largest and most powerful of these semi-autonomous networks. Another is the former Taleban military chief Qayum Zaker’s network in Helmand, which retains a degree of autonomy despite being partly dependent on resources from the Rahbari Shura. There are also smaller networks that serve as Pakistan’s direct proxies (and are much more loyal to the Taleban than the Haqqanis are) but that also enjoy the freedom to act freely within the insurgency’s sphere. These are thought to be responsible for a series of assassinations (or assassination attempts) against politicians, tribal elders (especially in the south) and ulema, as well as Afghan Taleban members.

For the networks mentioned above, an official policy towards a certain issue does not necessarily always matter. They are bound only by the Taleban’s universal red lines, notably that they cannot engage in sectarian attacks, beheadings or rapes – in order to keep their pledge of allegiance to the movement and benefit from the name. But there is a wide grey area in which these networks can operate with some divergence from official Taleban policies. For the time being, the Taleban leadership seems to heed those networks’ insistence on operational autonomy, in part as a reward for their important military contributions. This also provides the Taleban leadership deniability when it comes to particular ‘operations,’ for example, when the attacks by these networks cause remarkably high numbers of civilian casualties.

Why would the Taleban deny it?

The Taleban do not always claim the attacks they carry out. Their official position toward attacks varies, ranging from proud claims of responsibility to silence, denial or even condemnation. The type of behaviour is determined mainly by how the attack will affect the Taleban’s image among the wider public, the Taleban support base and the broader political spectrum. For example, the assassination of former President Borhanuddin Rabbani in 2011, then-Chairman of the High Peace Council, obviously resonated well with the Taleban’s support base, but claiming it publicly was seen as too damaging for its political image among the former mujahedin. The Taleban’s response in that instance was silence – although the perpetrator had come as an alleged Taleban peace messenger. Other instances where the Taleban have denied responsibility (but may well have been the perpetrators) include the large truck bomb that seems to have exploded prematurely one night in August 2015 in Kabul’s Shah Shahid neighbourhood, killing dozens, mainly civilians (see here and here.) Denial and occasional condemnation are typical responses when the attack causes a particularly unjustifiable level of damage or number of casualties by the Taleban’s standards, even when they are seen as ‘collateral’ rather than intended.

Examples of Taleban condemnation of attacks that were clearly carried out by their own fighters include two of the deadliest ones, both in Paktika, in 2014 and 2015. In July 2014 – the holy month of Ramadan that year – a truck bomb went off in Urgun killing scores of people, almost all of them civilians, and reduced a large part of the town to rubble. Details provided to AAN at the time by locals left no doubt that the attack was carried out by a well-known local Taleban commander, who had wanted to target a notorious pro-government militia commander, Azizullah Karwan. It was not clear, though, whether the bomb had detonated prematurely or intentionally, given that many local Taleban foot soldiers considered the entire population of the town a legitimate target for its collective hostility toward Azizullah. Another attack targeted a group of people that were considered similarly ‘hostile’ when a suicide bomber blew himself up among a crowd watching or participating in a volleyball tournament in Yahyakhel district in November 2015, that included a number of ALP commanders. The Taleban officially condemned the attack in a statement and promised to hold those responsible to account, while on the other hand a pro-Taleban website provided detailed justifications for the attack.

If the massive truck bomb on 31 May was indeed a premature detonation, the denial by the Taleban would make sense, given their mindfulness of their public image – a contrast to how ISKP handles this. Furthermore, the fact that Taleban media activists went out of their way to promote a fabricated ISKP claim may well have been an attempt to deflect suspicion – although it could also have simply been an attempt to tarnish the image of its jihadist rival.

Conspiracy theories provide ‘easy explanations’

There are two other explanations circulating on social media and among the Afghan public, both falling in the category of conspiracy theories. One is that the government itself was behind the explosion. This, in particular, was hinted at by some of the protestors on 2 June 2017 and in statements by the protest leaders, most of whom are Jamiatis with longstanding grievances against the government. A pro-Taleban writer also pointed to this possibility, arguing that the self-inflicted attack had been aimed at building momentum for the upcoming Kabul Process meeting. The writer argued that the government wanted to magnify the gravity of the threat from terrorist groups, so it could emphasise the need for more international engagement.

A similar theory holds that the explosion was not caused by a tanker-borne bomb, but rather by a huge missile. A well-known and well-respected civil society activist presented metal pieces from the site during a live TV talk show, claiming they did not belong to a vehicle, and adding that the Shah Shahid blast of 2015 mentioned above had been of a similar nature. The implication behind the theory is that the US (or some other western) military dropped the bomb to escalate the conflict. The theory is quite popular on social media, where video clips of the civil society activist has been widely shared and viewed. It comes as no surprise, therefore, that there were anti-US signs and slogans raised during the 2 June 2017 demonstrations. (Another source of anti-US sentiment is the feeling that the bilateral security agreement between Afghanistan and the US has done nothing to address the country’s main security threats.)

The 3 June attacks on the funeral

There are even fewer clues and details surrounding the nature of the explosions that shook the funeral of the son of Muhammad Alam Ezadyar. Three successive explosions took place while a number of high-ranking officials, mostly linked to Jamiat, were attending the ceremony (including Chief Executive Abdullah, Foreign Minister Salahuddin Rabbani, former NDS chief Amrullah Saleh and Minister of Public Health Ferozuddin Feroz.) Officials and participants described how the explosions had been caused by three suicide bombers. They had apparently chosen different locations among the crowd of mourners before blowing themselves up. Afghan media later showed footage indicating the explosive charges were hidden in shoes. This was a well-packed crowd, and if the explosives had been more powerful, the carnage could have been much larger than during the 31 May bombing. However, given that security must have been tight due to the attendance of senior officials, the bombers seem to have arrived with a minimal amount of explosives to avoid being detected and caught.

Nobody claimed responsibility for this series of explosions, either. The Taleban, this time, quickly issued a statement denying their involvement and saying the attack had been the result of “internal enemy feuds”. The NDS, on the other hand, released a video of a man it said was one of the bombers at the funeral (who had failed to detonate his charge), and that he was linked to the Taleban. On the video the man confessed that the funeral attacks had been organised by mullahs based in Chaman, near the Afghan border in Balochistan, without explicitly mentioning the Taleban.

Prominent participants at the funeral, such as Salahuddin Rabbani, hinted that circles within the government (in his words, “terrorists within the system”), had been the culprits. Another prominent member of Jamiat, governor of Balkh province Atta Muhammad Nur, also joined in, describing the attacks as a “cowardly conspiracy and a direct attack on a specific political current [Jamiat] [which] furthers the speculations about the hand of circles within the establishment in orchestrating these attacks.”

Politically charged feuds and claims aside, the two main suspects in this case remain the dominant insurgent groups operating in Kabul. In terms of tactics, the scope of the attack and nature of the target (a funeral ceremony) as well as the limited clues that are available, all point to the involvement of ISKP rather than to the Taleban. Planning such an attack and supplying a small amount of explosives for three bombers would not present a major challenge for ISKP. AAN has reported earlier on a part of ISKP’s Kabul cell operating in the northern parts of the city. An event like this, with the participation of so many senior government officials, would make it not only a ‘legitimate’, but also a highly attractive target for ISKP. However, the fact that the group did not claim the attack, casts doubt on this scenario, which would otherwise be the most plausible.

Afghanistan’s increasingly complex web of violence

Due to the high number of both government and foreign institutions as well as the potential for grabbing media attention far and wide, Kabul has always been an attractive place for insurgent groups to carry out attacks. Over the past decade and a half, a range of militant groups, from the Afghan Taleban to the now reconciled Hezb-e Islami, to Taleban splinter groups such as Fedai Mahaz or Dadullah Mahaz and more recently, ISKP, have focused their attacks on the capital. Kabul remains a favourite launch pad for attacks for any new militant group seeking to gain publicity and introducing itself to potential recruits at the national level.

Lately, it would appear that ISKP and the Taleban have been competing over who could unleash the most violence in the capital. Sometimes, both have claimed responsibility for the same incidents, simultaneously (in the past, similar contesting claims had pitted Hezb-e Islami against the Taleban.) Such a spirit of competition usually makes groups rush to lay claim to the attacks they carry out, providing details of the operation to bolster the credibility of their claims.

What makes the attacks this past week unusual is not only that they caused mass casualties, but also that they came one after the other, as though the first led to the next; both hit soft targets but, importantly, and belying the spirit of competition, nobody claimed responsibility for them. This lends an air of mystery to these attacks. They have succeeded in creating further political tension in the already notoriously divided National Unity Government, feeding an array of conspiracy theories.

Edited by Sari Kouvo, Thomas Ruttig and Emilie Jelinek