In late September 2012 TRISA published an updated version of its Insider Threat Handbook to reflect the numerous attacks against International Security Assistance Force (ISAF) Soldiers by Afghan National Security Force (ANSF) personnel in July and August 2012. The Handbook provides the latest information on “green-on-blue” attacks, analyzes the events for trends, and summarizes the inside attackers’ tactics, techniques, and procedures (TTP). The Handbook also provides an annex with a summary of the 64 green-on-blue attacks from May 2007 to August 2012 available from open sources with the details of the attack; the type of attack, if known; and the results of the attack.
There are four types of insider attacks: co-option, infiltration, impersonation, and personal grievance. Co-option occurs when the insurgents pressure an already serving ANSF member to conduct an attack against ISAF by threatening the individual, his family, or through some sort of enticement such as money. Infiltration occurs when an insurgent purposely enlists in the Afghan National Police (ANP) or Afghan National Army (ANA) to conduct an attack. Impersonation occurs when an insurgent obtains an ANSF uniform and uses the disguise to get close enough to ISAF members to conduct an attack. Personal grievance is when a dispute between the ANSF member and an ISAF member precipitates the actual attack.
An analysis of the data from the 64 attacks provides some important trends. Over one-third (24/64) occurred in only two provinces—Kandahar and Helmand. Insider attacks doubled from 2010 to 2011 and have already doubled again in 2012 despite four months remaining in the year. While the majority of all attacks since 2007 have been against U.S. Soldiers, there was a drop in the percentage of attacks against Americans between mid-2011 and mid-2012. In July 2012, however, the attacks against U.S. Soldiers again rose while attacks against non-Americans dropped.