The Islamic State Threat in Taliban Afghanistan: Tracing the Resurgence of Islamic State Khorasan.

• Author: Jadoon, Amira

The suicide bombing that struck the Kabul airport in August 2021 not only shocked the world due to the hundreds it left dead or wounded, (1) it also refocused attention on the threat of the Islamic State Khorasan Province (often abbreviated to ISIS-K or ISK). The attack ushered in urgent questions about the implications of the ISK threat on the remainder of U.S. withdrawal efforts, the stability of a Taliban-controlled Afghanistan, and the security of the country's neighbors. While the spectacular nature of the Kabul airport attack led many to view ISK as a renewed threat in the country, warning signs of a resurgent ISK had actually started to permeate in the preceding year. The Taliban's swift takeover of Afghanistan, along with an abysmal collapse of the Afghan government, (2) created new opportunities for ISK to undermine the legitimacy and control of an internationally isolated Taliban. ISK is now present in almost every province of Afghanistan, according to the United Nations, (3) as Taliban forces engage in a deadly counterinsurgency campaign against their jihadi rivals with limited measurable success reported thus far. (4) Understanding the future trajectory of ISK, its rivalry with the Taliban, and the regional security risks it poses requires tracing the adaptation of the group's violent strategies in various periods of its existence: the early period of its emergence, years of intense U.S. and Afghan forces-led military operations, and finally, the period of its intensified battle with the Taliban after the U.S. withdrawal.

In 2015, while U.S. and Afghan forces were still battling the Taliban insurgency, Islamic State-Khorasan, the Islamic State's official affiliate in the Afghanistan region, began to create space for itself by adopting a strategy that focused on coopting opportunistic militant organizations, (5) while differentiating itself from the other dominant groups. (6) On one hand, cooption of groups such as Lashkar-e-Jhangvi and the Islamic Movement of Uzbekistan provided ISK with expanded expertise and regional geographical knowledge, and curtailed competition for recruits. On the other hand, differentiation from other groups, most prominently the Afghan Taliban--but also groups such as Lashkar-e-Taiba--created opportunities for ISK to persuade militants to switch allegiances for both practical and ideological reasons.

In early 2022, only three years away from marking a decade of formal existence in the region, ISK has shown itself to be a persistent threat to the stability of Afghanistan and its neighbors. In this article, the authors draw on original data on ISK-claimed attacks; propaganda releases by ISK and its competitors (including radio broadcasts); captured internal documents, which reveal communication between Islamic State-Central (ISC) and ISK; and finally, the authors' discussions with former Afghan government members, Taliban officials, and tribal elders in Nangarhar and Kunar. (7) To trace ISK's pathway to its present state, this article unfolds in four main parts. The first traces the evolution of the group from 2015 to 2019, including the nature of ISC's engagement with ISK during its earlier years. (8) The second focuses on ISK's resurgence in 2020 and 2021, and highlights its efforts to rebuild its militant base through multiple channels. The third section outlines ISK's relationship with three groups in the region that are likely to remain its key challengers--Tehrik-e-Taliban Pakistan, al-Qa'ida, and the Afghan Taliban. Finally, the authors conclude the article by highlighting some of the regional security implications associated with a resurgent ISK.

The Evolution of Islamic State Khorasan (2015-2019)

The official announcement of ISK's formation was made in January 2015 via an audio recording by the Islamic State's then spokesman Abu Muhammad al-Adnani. However, efforts to set up the affiliate materialized prior to this announcement. Early defections to ISK through public pledges to Abu Bakr al-Baghdadi included nine former members of al-Qa'ida in March 2014, (9) as well as six Tehrik-i-Taliban Pakistan (TTP) commanders joining the nascent Islamic State Khorasan in October 2014. (10) Hafiz Saeed Khan's (a former TTP commander) appointment to the top leadership position of the group in 2015 was an early indication that the affiliate was going to draw heavily from the local militant infrastructure.

Since ISK's emergence in 2015, the group's operational activity has spanned virtually every province in Afghanistan and Pakistan. At various points, this included the consolidation and governing of territory in parts of northern and northeast Afghanistan, especially in Nangarhar province. Elsewhere in Afghanistan in 2015, fledgling ISK nodes, mostly the product of breakaway Taliban or Taliban-aligned groups, were contained by the Taliban and/or U.S. airstrikes and Afghan ground force interventions. (11) But it was in Nangarhar's southern districts that ISK enjoyed numerous advantages to support its initial territorial project. (12) Reporting on the group's early expansion efforts indicated that ISK, at its height, controlled eight districts across southern Nangarhar, (13) amassing operational resources and personnel around its de facto headquarters in the valleys of Achin district. It was not until 2016 that a number of convening factors initiated the gradual decline in ISK's territorial control: The Taliban mobilized ground forces to limit ISK's expansion in and around Nangarhar; (14) the Obama White House granted expanded ISK targeting authorization authorities to the Pentagon; (15) a U.S. and Afghan-allied coalition ground offensive backed by U.S. airpower killed or captured hundreds of ISK rank-and-file and leadership; (16) and additional Afghan units arrived to help clear and hold territory regained from ISK control. (17)

From 2015 to 2019, state-led operations captured, killed, or forced the surrender of over 10,000 of the group's affiliated members in Afghanistan and Pakistan combined, including hundreds of upper- and lower-level leadership. (18) As the end of the decade approached, ISK's territorial holdings in Nangarhar were depleted, and the group's remaining forces had either surrendered en masse to the previous government or relocated north to neighboring Kunar province or into major urban areas. (19)

Over the same period from 2015 to 2019, ISK's attack operations followed a trajectory of rise and decline. As Figure 1 shows, (a) the total number of ISK's attacks (in Afghanistan and Pakistan combined) rose each year from 2015 to 2017 before falling from 2017 to 2019, and as Figure 2 shows, its average casualty count (the number it killed and wounded per attack) rose from 2015 to 2018 before declining in 2019. ISK conducted attacks in over 25 provinces across Afghanistan and Pakistan from 2015 to 2019, inflicting almost 6,800 casualties (killed and wounded) in the former and 2,073 casualties in the latter. By far, the hardest hit city during this period was Kabul (nearly 3,900 casualties), followed by Jalalabad (over 1,000 casualties) in Afghanistan and Quetta in Pakistan (over 750 casualties). In both countries, the majority of ISK's attacks have targeted the state, including infrastructure and/or security and government personnel, but especially police forces. (20) Prior to 2020, various soft targets, such as religious institutions and public spaces, had also consistently been targeted, with Afghanistan's Shi'a and Pakistan's Sufi communities frequently attacked, including with suicide attacks. (21)

The ISK Relationship with Islamic State Central

Despite periods of intense targeting pressure, however, internal ISK documents (22) reveal an organization very much dedicated to the method of Islamic State Central (ISC) in Iraq and Syria. The documents also shed light on ISK's initial goals. For example, the authors reviewed a memo dated July 2016 from ISK that appeared to be penned after the death of ISK's first emir, (23) Hafiz Saeed Khan. The memo presented a status update from ISK, appearing to be intended for ISC. The letter states:

(a) The authors compiled ISK attacks data from January 2015 to December 2021 into an original database sourced from open source-news articles and attack claims issued by the Islamic State in its official weekly magazine, Al Naba, as well as through its central media channel, Amaq. Each attack is coded for date, location, casualties, and target.

We appointed an Emir of War for the Khurasan province, and we formed a military shura for the province as well... The brothers of the Khurasan province were relieved by the establishment of a Sharia committee for disputed issues, and for that reason, application of the Islamic State's methodology has been much easier. Even in the face of reported significant manpower and leadership losses in the first half of 2016, ISK appeared to have prioritized multiple lines of organizational development and administrative expansions. Various reports about ISK's losses provide details about the wide-ranging activities of its members; these reports indicate that targeted ISK members were performing duties across several administrative bodies with comparative structures in ISC's bureaucratic protostate. (24) These included military training, battlefield operations, and martyrdom operations; judicial and religious matters; media, proselytization, and recruitment; and logistics, information technologies, and financial bodies. (25)

While there is much uncertainty surrounding the links between ISC and ISK, open-source reports as well as captured materials from Afghanistan indicate that ISC played an important role in facilitating the establishment of ISK, at least in its early years. Ranging from facilitation of meetings to provision of general guidance on governance, as well as dispute resolution, ISC helped ISK build its roots in the region.

To understand the level of engagement between ISK and...