Afghanistan Analysts Network – English

War and Peace

First wave of IS attacks? Claim and denial over the Jalalabad bombs

Borhan Osman Kate Clark 13 min

The suicide attack on the Kabul Bank in Jalalabad on 18 April 2015, which killed more than 30 people and injured at least 100 others, was condemned by the Taleban and claimed by the Islamic State (IS), or at least by a Facebook site purporting to represent IS, also known as Daesh. President Ashraf Ghani also appeared to endorse the Daesh claim. As Kate Clark and Borhan Osman report, despite the ‘Daesh attack’ making news headlines around the world, both claim and denial have to be carefully scrutinised.

More than 30 people dead, more than 100 injured in the Jalalabad attack - who did this to them? Photo: Chinapost

Jalalabad endured a bloody day on Saturday, 18 April 2015. A suicide bomber blew himself up among crowds of people outside the city’s branch of the Kabul Bank, killing and injuring scores of those queuing up to get their monthly salaries from the government. Members of the Afghan National Security Forces (ANSF) (not in uniform) were hit, along with government workers and other civilians. Children were among the casualties. The scenes of carnage captured on film showed dazed and bloody survivors among the wounded and dead.

At about the same time in Jalalabad, a saint’s shrine called Dolakai Baba was blown up, wounding two civilians and, also on the same day, a magnetic bomb exploded in the nearby Behsud district killing one person and injuring two others. A fourth bomb was safely detonated by Afghan National Security Forces (ANSF) outside the Jalalabad branch of Afghanistan’s central bank which is not far away from the Kabul Bank.

Claim and denial

Both denial and claim of responsibility for the attacks came swiftly. Two hours after the bank attack, the Taleban spokesman, Zabihullah Mujahed, tweeted: “2 blasts hit civilians this morning at a shrine & front of Bank in ‪#Jalalabad, we condemn/deny involvement in both.” He told Reuters, it was “an evil act.”

All four attacks were claimed on a recently activated Facebook account  purportedly belonging to Shahidullah Shahid, the former spokesman for the Pakistan Taleban and now spokesman for Islamic State’s ‘Khorasan province’ (an old Islamic name for the wider Afghanistan region, so incorporating supporters in Afghanistan and Pakistan) appointed by IS central after a lot of urging from his side (for more detail on Shahid and his success, on the fifth attempt, at getting IS central to recognise the Khorasan chapter, see here). About 20 minutes after the shrine attack (at 8:38 am), this account said IS had blown up “a centre of idolatry” (shirk). ‘Shahid’ also claimed the Kabul Bank attack on “government people” soon after (8:52). A claim for the attempted attack on the Central Bank was posted at 9:50 and the attack in Behsud on the vehicle of a district chief from Kunar at 11:49. The same claims were also posted around the same timings by another account named in Arabic as ‘Khorasan Province, Nangarhar.’ Local journalists in Jalalabad said a man introducing himself as Shahidullah Shahid and claiming to speak for IS telephoned within half an hour of the attacks to say IS was responsible.

Hours later, President Ghani appeared to endorse the IS line – telling journalists, “In the horrific incident in Nangarhar, who took responsibility? The Taliban didn’t claim responsibility. Daesh claimed responsibility for it.” It is not clear if the president had special information to back up his comments or whether this was another attempt to claim that Daesh is in Afghanistan and the international powers should be worried and continue to back his government.

The president’s words helped harden the Daesh claim. Many journalists, particularly those from outside Afghanistan, who contacted AAN for background or interviews on the bombing, assumed Daesh had been behind the attack. “Why were they killing Sunnis?” the presenter of a domestic British news programme asked, as he struggled to make sense of attack and claim. “These are disgruntled Taleban who have rebranded as IS?” he asked. By the time the attacks hit the news stands, for some it had become fact: “First-ever IS suicide attack in Afghanistan kills 35″ was the headline for The News, in Pakistan, while the Mumbai Mirror reported: “33 die in first ISIS attack in Afghanistan.”

Assessing the Taleban denial

Generally, claims and denials in Afghanistan have to be taken with a dose of scepticism. The Taleban’s denial could be genuine, although they do have a record of distancing themselves from attacks which ‘go wrong,’ for example those that cause high numbers of civilian casualties, particularly in areas considered to be their heartland (and because their official line is – based on their code of conduct to avoid harming ‘the common people’ and their property). (1) In the face of a denial, it can be difficult and it takes time to verify whether an attack has been launched by the Taleban (which includes the Haqqani network, sometimes described as a separate organisation). However, in AAN’s report into the Taleban Code of Conduct, we traced several examples of false denials of attacks where commanders had subsequently been investigated.

Recent attacks where the denial looked suspicious would include the attack on Afghan Local Police who were watching a volleyball match on 23 November 2014 in Yahyakhel district, Paktika province. The bomber killed ten ALP members, including two commanders, along 53 civilians, including 21 children (a further 85 civilians, including 26 children, were injured; figures are from UNAMA’s 2014 report on the Protection of Civilians).

On the face of it, the attacks in Jalalabad, with the exception of the attack on the shrine, fit the Afghan Taleban’s pattern of operations. If it had not been for the Daesh claim, no-one would have noticed anything extraordinary about them. The Taleban spokesman called the attack on the Kabul Bank “evil,” but it resembled other Taleban attacks on ANSF personnel drawing their salaries from banks. UNAMA detailed these two in the second half of last year:

Suicide attack at Kabul Bank, Lashkargah City, Helmand – On 17 December, two men wearing [body-born IEDs]  entered the Kabul Bank in Lashkargah city, Helmand. One [body-born IED] detonated causing 16 civilian casualties (three killed and 13 injured). Three [Afghan National Policemen] ANP were also killed and four injured. The Taliban claimed responsibility for the attack.

On 1 October, a magnetic IED detonated near a bank in Kunduz city, Kunduz province, targeting the ANP, which caused 16 civilian casualties (one death and 15 injured including one woman and two children). The Taliban claimed responsibility and stated having killed five ANP.

Saturday’s attack was the second time the Kabul Bank in Jalalabad has been targeted in very similar fashion. In February 2011, the Taleban sent several armed men into the bank, dressed in police uniform, who killed 38 people and wounded 70; the movement claimed to have targeted “policemen, intelligence agents and other government employees” who were drawing their wages from the bank. An estimated half of the casualties in the bank were non-policemen.

The attack was captured on the bank’s CCTV and the footage shown on television. It horrified and sickened Afghans and led to a backlash against the Taleban. As AAN reported, the popular revulsion at this and similar attacks which targeted civilians or civilian places (2) and the political damage caused lead to some re-thinking by the movement as to its tactics or at least its media strategy. Its thinking on ‘civilian casualties’ has moved on; in early 2015, for example, its definition of civilian broadened somewhat (3), and the group has become more proactive on cataloguing its own lists of civilians by which it accuses the ANSF and international military of killing or wounding. UNAMA has been investigating these claims and adding them (where appropriate) to its figures and reports. In some periods, the Taleban appear to take greater care, for example reducing their use of pressure plate IEDs, which are inherently indiscriminate (and therefore also illegal under International Humanitarian Law) and kill large numbers of civilians, and trying to minimise collateral damage in suicide or complex attacks. However, such efforts are not consistent.

Civilian casualties may now be on the Taleban radar as potentially politically damaging and they have appeared to make some mitigation efforts. However, the group still has a high tolerance of collateral damage, for the Taleban this would mean ‘ordinary Afghans’ incidentally killed in an attack. (4) An analysis by UNAMA of the 382 attacks claimed by the Taleban in 2014 found that most of them – 236 – had military targets (international or Afghan armed forces or pro-government armed groups), but caused 1682 civilian casualties. (5) To take a recent example, on 10 April 2015, the Taleban claimed an attack on an ISAF convoy outside Jalalabad which wounded two international soldiers. killed eight civilians and injured 15 others.

All this means that, even though the Saturday attacks, with the exception of the one on the shrine, fit the Taleban’s normal modus operandi, the movement may still have wanted to deny the attacks, particularly the Kabul Bank attack because of the feared bad publicity. This was a ‘messy’ operation. The number of ordinary people killed and injured compared to the ‘military’ target may have seemed too high, the video already showing on television too appalling, to claim the attack. Or, of course, the denial may have been genuine.

The Daesh claim

‘Shahid’s’ claim could also be authentic or merely opportunistic. The most plausible aspect of the claim is the IED against the saint’s shrine, given that shrines are not normal Taleban targets, but do offend Daesh’s Salafist ideology. Moreover, an IED is easy to place, and that claim came quickly, within minutes of the explosion.

The Facebook account is new and cannot be verified as belonging to Shahid. (6) IS Khorasan’s ‘official’ Twitter and Facebook accounts have been suspended several times, so it would be no surprise if a personal account had been used. However, Shahid normally contacts the media by phone and speaks in Arabic. This is the first time we know of him posting a claim or using Pashto. Even if this new account does belong to Shahid, operating in his capacity as IS Khorasan spokesman, the claim might still not be genuine.

Further muddying the water, a report was published on 22 April of a denial from IS-Khorasan which in itself is unverifiable and, anyway, of questionable authority. (7)

The attack has not yet been claimed on any ‘official account’ from ‘IS central’ in Iraq/Syria.

The posting claiming the Kabul Bank attack included a generic photograph of ‘the bomber,’ whom the account names as ‘Abu Muhammad Khorasani.’ Sitting on a prayer mat, with his face masked by a scarf, the man has a Kalashnikov rifle by his side and Daesh’s black flag in the background. The IS flag looks to be of crude, home-made design rather than having the standard IS calligraphy used by the group’s authorised branches. The picture is not especially convincing.

Local journalists who received calls from ‘Shahid’ claiming the Jalalabad attacks for IS-Khorasan told AAN the voice sounded ‘younger’ than normal and had a Nangrahari accent (Shahid is from Orakzai Agency of the Federally Administered Tribal Areas).

A step change for Daesh or a grab for publicity? 

So far, Daesh has been prominent in Afghanistan largely on social media and in reports by the media and Afghan officials. Such ‘sightings’, as AAN discovered, usually turn out to be baseless. Where a Daesh presence on the ground has been confirmed (see AAN reporting here) was in the ‘Khorasan chapter’ being announced on 26 January 2015 with known Taleban commander Rauf Khadem at the helm for Afghanistan and a former Pakistani Taleban commander, Hafez Saeed Khan, as the overall ‘governor’ of Khorasan. Khadem’s group was active in Helmand province. However, he was killed two weeks later on 9 February in a drone attack. The handful of others who have proclaimed themselves IS tend, like Khadem, to be disgruntled former Taleban. Several had been kicked out for criminality. For the group to now pull off three attacks in a day, with a fourth thwarted, would be a step change in its operations.

That having been said, if one wanted to start IS in Afghanistan, the east would be the obvious place to start. The insurgency there is much more fractured than in the south, making it potentially easier for new groups to emerge and recruit members. The east also has a stronger history of Salafism, the ultra-orthodox school of Islam followed by Daesh, than other parts of Afghanistan. However, unlike Daesh’s internationally-minded, jihadist Salafism, the main Salafist strand in the east, and across Afghanistan for that matter, has generally been quietist. It has also had Salafi fighting groups since the days of the anti-Soviet jihad of the 1980s. In recent years, such groups have fought alongside the Taleban after failing to operate independently (see AAN’s 2010 piece on the joining of Kunar’s Salafis with the Taleban). Anecdotal observation suggests increased sympathy with global jihadism among the youth in the east (as opposed to other regions), particularly among those fighting with Salafi groups and among ‘cyber-jihadists.’ This trend appears to have gained momentum since the emergence of IS in the Middle East, especially after the announcement of its Khorasan province. (8)

As to the Jalalabad attacks, no other group disputed the ‘IS claim’ for any of the four incidents, including the Behsud attack, which did not cause the kind of collateral damage that might have prompted a denial by the Taleban. This lends some weight to the argument of those speculating that all four attacks, which happened within four hours, were planned for a dramatic launch of Daesh operations in Afghanistan.

It is also quite possible that local fighters, who used to fight alongside Taleban or in semi-independent Salafi groups and are now self-identifying with IS, carried out these attacks. They might have no operational or actual connection to IS, but have adopted its ideology and have enough military experience to plan a series of attacks on one day. However, that could still mean that Shahid’s claim was opportunistic (and the Taleban’s denial genuine). It is difficult to imagine IS’s Khorasan chapter’s ‘media operations’ being that organised or hooked up to self-identifying IS armed men on the ground.

It is also completely plausible that the attacks had nothing to do with IS, or with groups who have rebranded themselves as IS, and was purely opportunistic on the part of Shahid or someone else claiming to be Shahid. The IS claim is reminiscent of ‘Fedai Mahaz’s’ statement that it murdered the Swedish journalist, Nils Horner, in Kabul in March 2014, a claim which AAN looked into) and found to be unverifiable – possible, but highly questionable. That claim did, however, generate enormous amounts of publicity for Fedai Mahaz – as Saturday’s did for Daesh in Afghanistan.

Impact of claim and attack

It is impossible at this stage to say for certain whether these attacks were carried out by the Taleban or by IS or IS sympathisers. UNAMA seems correct in its call for the presence of Islamic State in Afghanistan to be meticulously evaluated to ascertain if militants are committing violence under a different name. More investigation is needed as to who the Kabul Bank bomber was and what his networks were, where he spent the night before the bombing and so on. More should be known generally about how the Taleban run their suicide (fedayi) operations; who endorses suicide attacks, who carries out surveillance, who trains, how is command and control ensured. As to IS, unlike the Taleban’s media operation, which is familiar to journalists – they know who they are talking to and their trustworthiness –, reporters are still in the dark about IS or indeed whether there is an IS to speak to. This makes it more difficult to verify claims.

What is certain is that Daesh’s name made this particular attack international news, something which the Taleban now struggle to do. The Daesh name also caused uneasiness among the Afghan public. Already, there was disquiet that certain savage tactics had been (re-) introduced into the war, following the release of a video of an Afghan soldier being beheaded by the Islamic Movement of Uzbekistan (IMU) earlier this month and the kidnapping of more than 30 Hazaras allegedly by the same group in Zabul in late February (AAN will be publishing a piece on this soon). There is fear that the emergence of IS in the Middle East and the announcement of its Khorasan chapter may embolden the more radical of the militant networks in Afghanistan – and particularly in the east – who have worked under the supervision of the Taleban. The cooperation emerged not because they share the Taleban’s doctrine and vision, but because they could not operate independently. IS may be an attractive alternative for such radical jihadists operating in Afghanistan, giving them an opportunity to align themselves with the new brand. There is also the possibility that ‘good publicity’ for IS in the wake of the Jalalabad attack may encourage others to switch groups, including those with long, military experience. Of course, more savage attacks would be unlikely to help Daesh find favour with Afghans generally, and, as the Taleban found, very brutal tactics tend to result in popular backlash (again, see AAN’s paper on the Taleban Code of Conduct); they are not a sustainable way to build support.

Afghanistan had already been preparing for a bloody year after 2014 saw an intensification of the conflict, with the highest number of civilian casualties in any year since 2001 and a war which failed to fall into its normal winter lull. Whether genuine or not, the Taleban denial, the Daesh claim and the president’s apparent endorsement of both gave weight to fears that this year could see more savagery and fewer red lines in the Afghan war.


(1) Injunctions include: suicide attackers must “avoid casualties among the common people” (art. 57); Taleban must “with all their power…be careful with regard to the lives of the common people and their property’ (art. 65); “anyone who harms people in the name of the mujahedin shall be punished (arts. 65, 66) and; “Taking care of public property and the lives and property of the people is considered one of the main responsibilities of a mujahed” (back cover).

(2) Other attacks included one on a Finest Supermarket in Kabul in January 2011, supposedly targeting the head and workers of the private security company, Blackwater, but killing nine Afghan civilians, including the mother, father and four children of one family, and another attack, in February 2011, in Kunduz, on men supposedly registering for the Afghan local police; of the several dozen killed, many had simply been trying to renew their IDs and were clearly far too young or too old to have been conceivably trying to join the ALP.

(3) UNAMA wrote:

 A Taliban statement released on 4 January 2015 reported a revised definition of “civilian” to include “any person who is not engaged in activities against the Taliban: “those people who do not stand shoulder to shoulder with the enemy forces and are not carrying out actions against Jihad are to be considered as civilians.” The 2013 statements reported a definition of “civilian” which included women, children, elderly persons and those who “live an ordinary life” under the category of civilians who must be protected from attacks.

(4) Collateral damage normally refers to civilians killed or injured ‘incidentally’ in an attack on a military target. The Taleban consider many people classed under International Humanitarian Law as civilian (because they are not in the armed forces or participating in hostilities) as legitimate targets. So, with the Taleban, it is more accurate to talk about their high tolerance for collateral damage among the common people, rather than civilians.

(5) From a war crimes perspective, targeting civilians per se is illegal – the International Criminal Court’s preliminary examination into war crimes in Afghanistan includes an assessment of the Taleban’s deliberate targeting of civilians. Also illegal are indiscriminate attacks, where no discrimination is made between military and civilian, as well as attacks on military targets where it could be foreseen that the loss of civilian life would be disproportionate to the military gain. UNAMA gives the following examples of disproportionate harm done:

On 28 December, an IED detonated in front of a shop in Alingar district, Laghman province. The shop was located near an ALP check-point and was owned by a tribal elder who was a member of the district Afghan Social Outreach Program (ASOP). The detonation caused five civilian casualties (two killed, including the shop owner, and three injured including a 13-year-old boy). The Taliban claimed responsibility on their website.

On 13 December, a 17-year-old a suicide attacker detonated his suicide vest against an [Afghan National Army] ANA shuttle bus in Kabul city, killing and injuring 14 ANA combatants. The detonation also seriously injured 14 civilians, including a woman and two children. The Taliban claimed responsibility for the attack on Twitter.

On 1 November, a [vehicle-born] IED attacker targeted a joint check post of ANA and ALP in Azra district, Logar province. The explosion caused 29 civilian casualties (five killed, including a pregnant woman and a child, and 24 injured, including four women and three children). The blast damaged five civilian houses and a mosque. The attack also killed and injured 21 combatants (ANA and ALP members). The Taliban’s claim of responsibility indicated that the attack killed 28 ANA, ANP and ALP members and injured 19 other members of Afghan national security forces. The statement said that five civilians, including two children had been slightly injured.

(6) The same account had, on Friday, posted pictures supposedly of an IS training camp in Logar under the leadership of Saad Emarati, the former Taleban commander in Azra district who has defected to IS.

(7) The Daily Beast reported a denial by Muslim Dost whom they name as a spokesman for IS. However, this Afghan, based in Pakistan, is a Salafi scholar who pledged allegiance to IS. For more detail about him, see AAN’s first report on Daesh.

(8) In Nangrahar, locals in Chaparhar district, about 20 kilometres from Jalalabad, have told AAN that insurgents there who were already mostly Salafi have been tilting towards IS in recent months, as evidenced by more IS flags and more talk about IS. AAN has verified accounts of men from Chaparhar going to fight in Syria/Iraq and some being killed there in September as already being reported. Some of these Chaparharis who have ‘migrated’ to the IS heartland (and married there) are actively in touch with local supporters on social media.


Civilian Casualties Daesh IS Islamic State Jalalabad Taleban Taliban