Hitherto unreported insider attack in Afghanistan raises questions

A newly reported insider, or green-on-blue, attack on a small command post in Afghanistan in October 2011 raises questions about the US military’s approach to the security risks posed by Afghan partnering with US troops, as well as the military’s reporting on such attacks.

The hitherto unreported green-on-blue attack took place on the night of Oct. 8, 2011 at a temporary US tactical command post situated within Old Corps Headquarters, an Afghan base in Kandahar City in the southern province of Kandahar, according to the Associated Press, which uncovered the details of the attack and published an account of them for the first time last week.

A surprise attack from within

That night, US Army Captains Joshua Lawrence and Drew Russell were winding down in the tent that served as the command post, after a long day of coordinating security for over 100 Afghan religious and tribal leaders attending a nearby peace conference. The two officers and five other US soldiers were relaxed, their body armor and weapons lying in a corner. Two US soldiers stood guard. The American team’s four Afghan liaisons, including representatives from the Afghan army and intelligence, had left the tent “shortly before,” the AP account noted.

Less than 30 minutes earlier, at about 9 p.m., two or three Afghans had entered the compound, a common enough occurrence at the base, where unknown numbers of Afghan security personnel frequently “freely entered and exited the compound unchecked,” an Army investigator later wrote. One staff sergeant told investigators that the US troops “had been told to treat the Afghans as if they were mingling in Iron Horse Park, a recreation area on their home base,” in Fort Carson, Colo. The Afghans, at least one of whom was wearing an Afghan army uniform, were armed with a rocket-propelled grenade and at least one M16 rifle, but they were not questioned.

At 9:02 p.m., Specialist Paul A. LeVan, 21, who had been assigned to guard the tent, was reassigned by his sergeant to a guard tower overlooking the compound. He was soon joined by two of the Afghans; the one in uniform carried a grenade launcher, and the other, who was unarmed, spoke English. LeVan’s sergeant left the tower and informed the men in the command post tent about the grenade launcher.

Suddenly the Afghan with the grenade launcher began shooting at US medics in cots by their ambulance outside the command post, wounding a medic in the stomach and back. Shrapnel hit inside the tent, injuring the sergeant. Another gunman in the compound approached the entrance of the tent, shooting with an M-16.

Captain Lawrence was shot dead, and Captain Russell died of bullet wounds shortly thereafter. Three US soldiers were wounded seriously enough to evacuated, and four more were wounded less severely. The gunman fired about five or six rounds into the tent and then vanished. None of the attackers were captured; it is suspected that they had inside help.

The US and Afghan investigations

According to the Associated Press account, a US military investigation following the attack indicated there were two shooters, but an Afghan investigation said there was only one, an Afghan Army sergeant named Enayut. The chief Afghan military prosecutor for Kandahar at the time told AP recently that Enayut’s father and brother have been detained along with three Afghan soldiers for their roles in the incident. The father and brother are alleged to have known of Enayut’s links to insurgents. Enayut was said to have returned from a visit to Pakistan shortly before the attack.

Unlike the Afghan investigation, the US investigation did not find any links to insurgents.

Immediately after the shooting, an Afghan liaison officer told the compound commander that the shooter was an Afghan officer named Enayut. But despite the fact the US military knew the attack had been carried out by at least one insider, the next day the US-led military command in Kabul announced only that two service members had been killed in an “insurgent attack.” And on the following day, Oct. 10, the Pentagon stated that “enemy forces” had killed Captains Lawrence and Russell.

The AP‘s investigation of the incident was triggered in April, when a soldier with knowledge of it contacted the news agency. In May, the US military added the incident to its list of insider attacks for 2011, but refused to divulge details. The AP pieced together details of the attack after obtaining redacted official military records via the Freedom of Information Act.

The US military investigation of the incident originally concluded that the US chain of command in Kandahar “failed to use the appropriate security and force protection measures to secure the compound and safeguard their soldiers,” the AP found. That conclusion was subsequently overridden by an internal investigation by Major General James L. Huggins, who wrote in December 2011 that the US military’s security arrangements had been appropriate as there was “no known insider threat at the time.”

At the time of Oct. 8, 2011 attack, there had already been 12 reported green-on-blue attacks that year alone in Afghanistan, two of which occurred in Kandahar province, according to statistics compiled by The Long War Journal. And in the neighboring provinces of Helmand and Uruzgan, four green-on-blue attacks had already taken place that year. Between Jan. 1, 2008 and Oct. 8, 2011, a total of 24 attacks by Afghan troops on Coalition forces had been reported. [For more information, see LWJ report, Green-on-blue attacks in Afghanistan: the data.]

Green-on-blue attacks in 2012

So far this year, there have been 42 green-on-blue attacks in Afghanistan, accounting for 16% of Coalition casualties, already far exceeding last year’s total of 15 attacks. And in Kandahar province alone, there have been 10 such attacks, six of which took place before May, when the US military first acknowledged the nature of the Oct. 8, 2011 attack.

This summer, the US began adopting measures to deal with the spike in insider attacks, including ordering US and NATO troops to carry a loaded weapon at all times while on base, increasing counterintelligence forces, and requiring stricter vetting of Afghan security personnel. In September, partnering with Afghan forces was briefly restricted but then largely restored.

As the Coalition continues to draw down its forces, and the residual troops move increasingly from a combat role to the training and mentoring of Afghan security personnel, significant risks remain. An apparent reluctance by the US military to initially admit the scope of the insider attack problem may have delayed the imposition of needed security measures. Now that certain measures have been adopted, however, they appear to be starting to have an effect, as the number of reported green-on-blue attacks has dropped in the past few months, from a high of 11 in August, to 4 in September, to 3 in October, and 2 in November. The recent downward trend in attacks may also be due in part to the slower pace of the Taliban winter fighting season as well as the continuing drawdown of Coalition troops.


  • blert says:

    The opfor has struck out with virtually all other gambits.
    Hence, Mullah Omar has been encouraging his faction to ramp up this one tactic.
    It also directly frustrates the administrations desired endgame.
    I don’t know what changes the ISAF has instituted…
    But, it’s a pretty good bet that recruitment standards for the ANA are being tightened.
    Beyond that, it’s clear that it’s impossible to grant Afghans free reign inside our secured perimeters.
    Opfor tactics are now reduced to gangland style deceits and back stabbings — such as portrayed in he Godfather films.
    One notable feature of such feral fighting is the family feud. Because all attacks are ‘underhanded’ — the survivors shift over to retaliation against kith and kin.
    Such tactics are as old as dust. The US Army had to contend with them in the 19th Century. Ultimately, the USA used embedded, alienated, native scouts to track down the dirty dogs of war.
    It’s time for the USA to revisit its roots — and reread Sherman and Crook.

  • Hiding these types of attacks actually may be due to November election, only degrades the credibility of USA while it encourages the Taliban

  • mike merlo says:

    “It’s time for the USA to revisit its roots — and reread Sherman and Crook.” “Phoenix” is alive and well in the AfPak Theater

  • blert says:

    mike merlo
    I don’t get the association.
    Generals Sherman and Crook, of the 19th Century, had no connection to the Vietnam conflicts.
    Sherman was strongly connected to Atlanta — and to providing security for the Union Pacific Railroad as it laid track westward towards Promontory Point.
    The steepest, most significant ascent in their system was named in his honor: Sherman[‘s] Hill.

    General Crook was made famous fighting the toughest in the West. Native scouts were critical to his campaigns.

  • mike merlo says:

    The Phoenix ‘program,’ as I’m sure you well know, initially conceived(SOG) & ‘made’ operational during America’s ‘tenure’ in South Vietnam has since been refined & applied on multiple occasion’s by the US military & its Intelligence Community.
    Tactics & strategies employed by Sherman & Crook undoubtedly serve as models worthy of study & introspection. As I’m sure America’s pacification efforts in the Philippines, following the Spanish American War, & the multiple ‘interventions’ in the Caribbean & Central America as elucidated in the USMC’s Small Wars Manual & The Barbary Coast Wars of bygone days etc.,.
    Your referencing of OPFOR efforts in AfPak theater ‘smacking’ of failure(s?) when nothing could be further from the truth. Suggesting the US revisit its’ 1800/1900 ‘roots’ fails to take into account that not only has the US Military & Intel Community done ‘that’ but has long since folded the lessons of the past into its present & future ‘applications.’
    If there is to be any ‘root seeking’ in the AfPak theater the interests of the US Military & Intel Community are best served by studying & analysing British & Tarist Russia’s expeditionary forays into Afghanistan & the adjoining areas/regions. Whatever can be historically gleaned & its relevance applied to present & near future ‘events’ such as the Kharijites(*see* Olaf Caroe, authored The Pathans, as a relevant source) who showed up in the Helmand watershed in the 7th century and the history of Afghanistan from the late 70’s to the present with particular emphasis on the era prior to the US invasion.
    With all due respect to General Crook & your high opinion of him who cares what made general Crook ‘famous’ & who cares what was named after Sherman, that’s irrelevant. Crook ultimately failed to bring Geronimo to ‘heel’ & had to give ‘way’ to General Miles who managed to bring ‘closure’ to the whole affair.
    “The association” is simply: citing dated prior engagements & efforts while apropo within some historical context however when juxtaposed against ‘current events’ or ongoing operations one is best served by reserving such ‘observations.’ Unless present attempts of strategic & tactical ‘applications’ are proving to be so woefully incompetent other ‘options’ should exercised and or explored. Which IMO is no where near necessary.


Islamic state



Al shabaab

Boko Haram