Afghanistan:
Green-on-Blue Attacks in Context

October 31, 2012 — R. Hossain

Introduction

PRT commander Col Arturas Radvilas, Gen Asadulah Ulamiar and ANA Company commander. Courtesy ISAF Media.

The spike in green-on-blue attacks (also known as "insider attacks") in Afghanistan in 2012 is a worrying development that has the potential to endanger the International Security Assistance Force's (ISAF) mission to train and prepare Afghan security forces for the challenges of stabilizing the country. It is important to establish both the scope of the green-on-blue threat as well as the context in which the attacks occur.

General trends in green-on-blue attacks

From 2007 to 2012, there have been 71 documented green-on-blue attacks. It is difficult to draw definitive conclusions about the principal causes of these attacks given the small total number of incidents, but there are discernible trends.

First, insider attacks have increased in frequency over the past few years. Based on available information, there were two green-on-blue attacks in 2008, five in 2009 and 2010 each, 15 in 2011, and 42 in 2012 (as of November 13). Insider attacks were largely concentrated in the Southern, Southwestern, and Eastern regional commands. More than half of all attacks in 2012 occurred in Kandahar and Helmand, which were the focus of the counterinsurgency campaign during the "Surge."

Insider attacks are a complex phenomenon, and the trends in the data do not demonstrate causality. Instead, visualizing this data highlights the specific context in which each attack occurred. One notable anomaly is a complex attack on September 29, 2012, in which a group of apparent Afghan National Army soldiers ambushed a U.S. patrol from multiple directions at a checkpoint in Wardak, possibly with the aid of insurgents.

Possible explanations for the 2012 increase in green-on-blue attacks

There are two main narratives purporting to explain why green-on-blue attacks happen and why they are happening more frequently: grievances and infiltration. Grievance-based insider attacks occur because of cultural misunderstandings between foreign and Afghan troops, low morale, and revenge for perceived insults or provocations. Attacks caused by insurgent initiative are pre-planned violence organized by groups like the Quetta Shura Taliban or their Haqqani Network associates who have infiltrated the ANSF or influenced existing members to execute attacks.

The Pentagon believes that the vast majority of green-on-blue attacks are grievance-based rather than a result of infiltration, and on August 23, 2012 Gen. John Allen estimated that 25% of the attacks come from Taliban infiltration. In contrast, on October 4th, Afghan Deputy Foreign Minister Jawed Ludin described the majority of insider attacks as the result of "terrorist infiltration" rather than cultural differences. Another theory cites the rise in attacks in 2012 as a result of copycat behavior. Meanwhile, the Taliban claims credit for nearly every attack.

It is also important to consider the opportunity that green-on-blue incidents provide to insurgents in Afghanistan. Several indicators suggest that the Taliban is seizing on green-on-blue attacks as an opportunity to achieve a psychological effect in the U.S., responding to U.S. media coverage of prior incidents. Indicators include recent observations of a greater degree of coordination prior to attacks as well as a minor trend in copycat behavior emanating from attacks in Helmand. The sharp rise in attacks during Ramadan in 2012, which breaks from trends observed in former years, may also be interpreted as deliberate.

Navigating the information

This site includes density maps showing the geographic distribution of insider attacks in the provinces and districts of Afghanistan, graphs that place data about green-on-blue attacks in context, and charts examining trends in green-on-blue violence. Data will be regularly updated to reflect the latest information.

Note: this website is best viewed on a modern desktop browser such as Google Chrome or Mozilla Firefox. Refreshing the page may be necessary to see the most updated maps and graphics.

More information

Contact Maggie Rackl at (202) 293-5550 x205 or [email protected].

Last updated: November 13, 2012

Return to the Institute for the Study of War's homepage

Switch view to: | |

Provinces (attacks): | |

Districts (attacks): | |

Click on areas on the map to see the number of attacks, KIA, and WIA.

Note: District-level information for one attack in Kandahar in 2011 not available. Maps last updated November 13, 2012.

The Attacks in Context

In order to understand the rising threat of green-on-blue violence, attacks must be examined in a broader context. How does the number of insider attacks change as troop levels vary? What branches of the Afghan National Security Forces are responsible for the most attacks? Where do attacks occur most often?

Green-on-blue attacks and troop levels

ANSF troop levels consist of Afghan National Army and Afghan National Police numbers; the levels of Afghan Local Police are not included. Note that reported ANSF troop levels may not reflect the number of troops present for duty.

The chart below illustrates that the number of attacks has generally increased as the number of ANSF troops has increased. However, the sharp rise in activity in August 2012 breaks from this trend. It may either represent an outlier or signal a new trend emerging.

Who commits green-on-blue attacks?

The Afghan Local Police (ALP) was created in mid-2010, so there is no data for them in 2009-2010 period.

The charts illustrate that while the number of attacks has increased over time, they have generally mirrored the troop levels for each Afghan security component as they grew from 2009 to 2012. Notably, the ALP accounts for a disproportionate number of attacks against ISAF troops in 2012 given its small size.

Where do green-on-blue attacks happen?

The chart below represents all attacks for which location information is available. Attack environments are divided into three basic categories. "Military bases" are locations primarily under ISAF control; "Police Stations" and checkpoints are locations primarily under Afghan control; and "In the field" includes all activity "outside of the wire" such as patrols, raids, and other operations.

The chart illustrates that most green-on-blue attacks occurred on Military Bases.

Attacks over time

This timeline shows the number of attacks and KIA casualties over time.

The timeline illustrates that a sharp rise in green-on-blue incidents occurred during Ramadan in 2012; however, the same was not true in 2011 or 2010.

Trends in Green on Blue Attacks

View an interactive motion chart (opens in new window).

Other trends in green-on-blue attack data may be observed by clicking through the spreadsheet tabs below.

Methodology

Sources

ISW's attack data is derived from the Long War Journal's green-on-blue timeline, the New America Foundation's insider attacks minisite, iCasualties.org, the Guardian's Datablog, and ISAF casualty reports. Attacks were cross-checked across each list to verify dates and details, and duplicate records as well as attacks that did not qualify as green-on-blue based upon the definition below were removed. Where possible, the attacker's apparent affiliation, the environment of the attack, the number of perpetrators, the number killed or wounded (excluding the attackers), and the specific locations of each incident are identified.

Each incident entry in the original spreadsheet includes at least one general source, and sources for specific details are included as a comment on the cell in question. Data is derived exclusively from open source information and thus may not represent the full population of green-on-blue attacks.

Data validity

The details for every known attack have been checked across several sources; however, there are some incidents for which data confidence is limited. These are marked in red in the downloadable spreadsheet.

Some district-level information for known attacks is not confirmed with complete confidence, which is also noted in red. Where possible, this information is provided based on reasonable assumptions.

Maps

Boundary information for Afghanistan's administrative provinces and districts are courtesy of Geocommons.com. They may not reflect the most recent changes in district boundaries.

Definition of terms

Green-on-Blue Attack/Insider attack: The use of armed force by an apparent member of the Afghan National Security Forces or an Afghan contractor employed by ISAF that attempts to inflict or results in casualties to ISAF personnel.
ANSF: Afghan National Security Forces, which consist of the Afghan National Army, Afghan National Police, and Afghan Local Police.
# Killed, Wounded: The number of non-attackers killed or wounded in the incident. This includes non-ISAF personnel.
Province, District, Locale: The administrative province and district the incident occurred in according to current boundaries. Locale is used to identify general information about the location of an incident below the district level.
Attack Environment: attack environments have been divided into three basic categories: Military Bases, Police Stations/Checkpoints, and Field. Military bases are locations primarily under ISAF control, police stations and checkpoints are locations primarily under Afghan control, and the field includes all activity "outside of the wire" such as patrols, raids, and other operations.

Download ISW's data

Download the latest copy of our insider attack data.

Other resources

Contact

Maggie Rackl at (202) 293-5550 x205 or [email protected].