At least 34 cases of ―insider‖ attacks against International Security Assistance Force (ISAF) soldiers by Afghan National Security Force (ANSF) personnel have taken place over the last five years. In April 2011, the number of attacks, also known as ―green on blue‖ attacks, rose so rapidly that the ISAF Commander directed that a Red Team political and military behavioral scientist conduct a study to determine any commonalities between the attacks and possible means to identify attackers before they strike. Additional details of the insider threat can be found in the Insider Threat Handbook recently published by the TRISA-Threats OEA Team.
While the Taliban continues to claim that their agents successfully infiltrated both the Afghan National Police (ANP) and the Afghan National Army (ANA) with the sole purpose of launching these attacks, the evidence does not support the claim. In fact, at the time of the study‘s completion in May 2011, investigators could not find one valid case where a Taliban member infiltrated the ANSF to launch an attack. Almost half of the attacks occurred in only three of Afghanistan‘s provinces: Helmand, Kabul, and Kandahar. Many of the other provinces did not contain a single green on blue incident.
Of the five broad categories, disgruntled ANSF members or individuals who recently faced a personal disagreement with an ISAF soldier accounted for 40% of all the attacks studied. About 15% of the attacks were by an ANSF member co-opted by the Taliban through threats against the individual or his family, blackmail, or bribery. Taliban members who disguised themselves as ANP officers or ANA soldiers accounted for about 10% of the attacks. In about 35% of the attacks, the evidence could not substantiate the exact reasons for the attack. Prior to 12 May 2011, investigators could not attribute even a single insider attack to a Taliban who infiltrated into the ANSF.