Navigating the shadows: Afghanistan’s terrorism landscape three years after the US withdrawal and its international implications

At a July 2023 press conference, President Joe Biden somewhat angrily defended his record on the counterterrorist threat from Afghanistan: “Do you remember what I said about Afghanistan? I said al Qaeda would not be there. I said it wouldn’t be there. I said we’d get help from the Taliban. What’s happening now? What’s going on? Read your press. I was right.” Later, in January 2024, US Special Representative for Afghanistan Thomas West testified that “the Taliban’s sheltering of al-Qa’ida leader Ayman al-Zawahiri in a safe house in Kabul was a flagrant violation of their security commitments,” but added that “since then, we assess that the Taliban have undertaken efforts to fulfill their security commitments with regard to al-Qa’ida.” West’s statements echoed September 2023 remarks made by Christy Abizaid, then director of the National Counterterrorism Center, that al-Qaeda “is at its historical nadir in Afghanistan and Pakistan, and its revival is unlikely.”

But the facts on the ground paint a different reality and challenge these somewhat optimistic depictions of the Taliban’s cooperation, al-Qaeda’s reemergence, or the capacity of the Islamic State-Khorasan Province (ISKP; sometimes written as ISIS-K or ISIL-K) to direct external attacks from Afghanistan that could threaten American interests. In April, the Federal Bureau of Investigation’s (FBI) Director Christopher Wray warned, “The foreign terrorist threat and the potential for a coordinated attack here in the homeland, like the ISIS-K attack we saw at the Russia Concert Hall a couple weeks ago, is now increasingly concerning.” The United Nations sanctions monitoring panel’s January 2024 report observes that the Taliban’s “efforts against ISIL-K appear to be more focused on the internal threat posed to them than the external operations of the group.”

The UN monitoring team’s follow-on report, from July 8, also acknowledges that “while the Taliban have done much to constrain the activities of Al-Qaida and their affiliates, [UN] Member States remarked that its reorganization and training activities, as well as new travel into Afghanistan, indicate that the group still uses Afghanistan as a permissive haven under the Taliban, raising questions about Al-Qaida’s intent.” The Taliban was also reported to be leveraging al-Qaeda’s Afghanistan-based affiliate, al-Qaeda in the Indian Subcontinent (AQIS), to facilitate attacks by the Tehrik-i-Taliban Pakistan (TTP) inside Pakistan.

The US-Taliban dynamics

Currently, despite lacking formal diplomatic relations, the US-Taliban relationship has been largely “de-risked” for two main reasons. First, the Taliban’s staying power — military, political, and religious — has made its rule more predictable compared to the previous Afghan government. Second, the US recognizes that achieving any kind of success in dealing with groups like the Taliban requires establishing some level of predictability through direct or indirect engagement. In other words, a better-governed territory and centralized rule is preferable to chaos and civil war.

From a threat perspective, the reality is that the Taliban controls a country with a significant presence of both regional and non-regional militant groups. Although this threat might now seem minor to some compared with the utility of continuing a forever war, it has the potential to escalate rapidly. This is due in part to external groups collaborating with some Taliban leaders, who are seeking to exploit the rising anti-American sentiment in the region.

While quantifying the exact risk is challenging due to limited information, these conditions are likely to lead to increased domestic radicalization driven by various grievances. Internally, this radicalization is fueled by a surge in Taliban-sponsored religious education, especially through the expansion of jihadist madrassas within Afghanistan. As a result, a new generation of militants is emerging that may be even more dangerous than the current Taliban is perceived to be.

The fight against terrorism in Afghanistan is one of the few areas where the interests of regional and non-regional countries converge. However, the challenge lies in the diverse forms of terrorism around the world and within Afghanistan itself, with each country facing different threats. For instance, a group threatening China might not pose the same risk to Russia, Iran, or Pakistan. This specificity and variation in threat profiles necessitates tailored bilateral engagements with the Taliban from each country, serving as a form of insurance for the Taliban regime.

These engagements include frontloading diplomatic concessions, such as transferring control of overseas Afghan missions to the Taliban, hosting sanctioned Taliban leaders for high-profile meetings, or granting diplomatic cover to the Taliban in international forums. Additionally, there are commercial and technical engagements with legal foundations, such as signing mining, oil, and natural gas contracts, which have enriched select Taliban leaders.

The Taliban also continues to seek intelligence and logistical support from regional countries to combat ISKP, positioning Afghanistan as both a counterterrorism partner and a victim of terrorism. These discreet military-technical agreements with third countries end up supporting the Taliban’s security services beyond their ostensible counterterrorism mission, including through the provision of surveillance and communication equipment, media engagement, and cash support.

At the same time, Taliban leaders argue that the West, particularly the US, should decouple normalization efforts from issues the Taliban considers internal, such as the regime’s treatment of women and their educational rights. Conceding to this unethical demand would constitute not only an abdication of US responsibility to uphold human rights broadly but would have ramifications concerning American influence in Afghanistan and beyond. And allowing the Taliban to decide which terrorist groups it will confront poses significant risks, given its own long-standing ties with al-Qaeda, the TTP, and other terrorist organizations.

Nevertheless, understanding the wax and wane of terrorism warnings and the Taliban’s relationships with locally active militant groups it hosts is crucial. For example, the Taliban’s relationship with al-Qaeda involves a layered approach with various permission structures and protocols, especially following the US killing of al-Zawahiri in Kabul. A major challenge for the Taliban appears to be managing its political relationship with al-Qaeda while institutionalizing elements that best fits its own narrative — essentially, the Taliban’s version of wishful thinking.

Complicating the relationship is the fact that so many al-Qaeda members have married into Afghan families and tribes over three-plus decades as to have become largely intertwined within the Taliban’s own fabric, itself hardly monolithic. The Taliban recognizes that al-Qaeda’s leadership includes both reliable and less reliable figures, many of whom are preoccupied with their own internal rivalries. Despite ongoing leadership transitions within al-Qaeda, the terrorist group still prioritizes its enemies based on their perceived threat level.

While the Taliban currently does not appear to be on al-Qaeda’s threat list, this is likely because their arrangement reportedly provides sanctuary to al-Qaeda’s senior legacy leaders, even if it restricts them from planning operations from Afghanistan. It is at least plausible that, regardless of the truth, the Taliban believes it has contained al-Qaeda and is meeting its commitments to the US while not turning its back on its guests. This arrangement serves as a crucial leverage point for the Taliban, so it is in the interest of al-Qaeda members not to disabuse their hosts of this illusion.

The Islamic State threat

ISKP, like its parent Islamic State core, draws strength as a jihadist melting pot. The aforementioned July 8 UN report explained that ISKP was shrewdly “using Afghan nationals to conduct attacks in Pakistan, Pakistani nationals to conduct attacks inside Afghanistan, Tajik nationals to conduct attacks in Iran (Islamic Republic of) and the Russian Federation and has used a Kyrgyz national to carry out an attack in the Taliban’s heartland of Kandahar.”

Sanaullah Ghafari (alias Shahab al-Muhajir), the enigmatic ISKP leader who the Taliban believe to be a 29-year-old Afghan Tajik who once served in the Afghan national army, is the subject of a $10 million Rewards for Justice bounty. The Taliban erroneously claimed in June 2023 to have killed Ghafari, who has since strengthened the group’s presence in northern Afghanistan with the aim of infiltrating the Central Asian states as well as Russia, Pakistan, and India.

The group’s January 3, 2024, attack in Kerman, Iran, that killed at least 95 and wounded more than 200 along with the March 22, 2024, attack on the Crocus City Hall near Moscow that killed 144 demonstrated the group’s ability to plot and execute external operations even within surveillance states, and from afar. The involvement of Tajikistani nationals in the Crocus City Hall attack, who had traveled to and from Turkey, further showcased the terrorist group’s ability to deploy operatives into Europe.

ISKP has long been committed to conducting attacks abroad. Abdul Rahman al-Logari, the ISKP suicide bomber who killed 170 Afghans and 13 US service members at Abbey Gate in August 2021, had previously been arrested in 2017 in India while planning an attack there. ISKP’s influence has evidently inspired Europe-based extremists to target a Taylor Swift concert in Austria and another who conducted a deadly knife attack in Germany at a crowded city fair, resulting in three deaths and eight injuries.

The al-Qaeda threat

The UN reported that several ethnic-Arab al-Qaeda members have traveled to Afghanistan for training and to facilitate communication between the group’s presumed current amir, Egyptian national Mohammed Salahaldin Abd El Halim Zidane (better known by his alias Sayf al-’Adl), its affiliates, and the Taliban. Sayf al-’Adl, for whom Rewards for Justice is offering a bounty of up to $10 million, almost certainly became the group’s leader after the US drone strike, reportedly conducted by the Central Intelligence Agency (CIA), killed Ayman al-Zawahiri in a Taliban-provided Kabul safehouse.

Although US intelligence likely knows whether Sayf al-’Adl is in Afghanistan or remains in Iran, Washington is understandably not saying. But since becoming amir, despite the absence of public acknowledgment, ’Adl’s profile poses too high a risk for Iran, where he is thought to have been hiding since roughly 2003. Iran gave ’Adl, along with other al-Qaeda leaders, operatives, and their families, shelter for years, keeping them initially under house arrest before releasing them in 2015.

’Adl’s recent public statements also suggest he is in Afghanistan. In the latest issue of pamphlets released by al-Qaeda’s official media wing, As-Sahab, entitled “This is Gaza: A War of Existence, Not a War of Borders,” ’Adl called on supporters to migrate to Afghanistan, where he encouraged them to gain training, experience, and knowledge to be able to carry out attacks against “Zionist” and Western targets. He also praised and encouraged “sleeper cells” in Western countries as a “deterrent force” against further Western “crimes.”

Likely, ’Adl is joined in Afghanistan by Hamza Salih bin Sa’id al-Ghamdi, for whom the Rewards for Justice program has offered a bounty of up to $5 million. Ghamdi is a Saudi national and former Osama bin Ladin bodyguard and subsequently Zawahiri’s but, until recently, has remained out of the public light, and for good reason. Ghamdi was likely Zawahiri’s primary caretaker during his 20 years in hiding, and most probably he married one of the deceased amir’s daughters. It is reasonable to believe that Ghamdi was nearby when two Hellfire missiles pulverized Zawahiri on his Kabul balcony. Ghamdi’s role as a member of al-Qaeda’s shura council, its leadership group, was disclosed in a letter published by As-Sahab, in which he pledged to abide by al-Qaeda’s line of succession, inferring loyalty to ’Adl.

Al-Qaeda’s current deputy amir is most likely Muhammad Abbatay, better known as Abd al-Rahman al-Maghrebi, for whom Rewards for Justice is offering up to $7 million. Maghrebi is the longtime director of As-Sahab, and one of Zawahiri’s sons-in-law. He served as the terrorist group’s general manager in Afghanistan and Pakistan for years but eventually fled to Iran. Maghrebi is an experienced communicator, manager, and publicist, quite possibly the diplomat of the group. Although the above-cited UN monitoring report suggests that Maghrebi remains based in Iran, it also notes that he and ’Adl have reportedly traveled to Afghanistan from time to time. This could be true, but the Iranians would be keeping a close eye on the pair — their travel would require Tehran’s approval and facilitation and pose quite a risk, as each trip could expose their presence and Iran’s support.

Better managing the US-Taliban relationship

For now, no one is fully satisfied with the status quo, including the Taliban, which faces resistance to its policies and struggles to ensure the longer-term stability and longevity of its regime. Nevertheless, the Taliban has managed to consolidate internal divisions and strengthen a hardline consensus within the group, though it remains vulnerable. Considering the realities of politics, the US should avoid overreach and instead approach the Taliban issue with a pragmatic value proposition, assessing which leaders or factions might be more flexible and whether these relationships need to be renegotiated. One critical aspect of this is understanding and managing the so-called Kandahar complex, the region from which the original Taliban leaders and some former Afghan leaders emerged, and which is known for a particularly conservative form of political Islam. For now, the Taliban has effectively merged clerical and executive powers and redefined their role within the new regional order. Engaging the Taliban could garner insights concerning the group’s power dynamics, vulnerabilities, and strengths, which in turn might better inform US policy toward the current Afghan regime.  This approach could facilitate a more nuanced understanding of the Taliban’s behavior, ambitions, and paranoia, rather than relying on over-simplified interpretations. That said, the permanence of the US-Taliban relationship is not guaranteed and will last only as long as it is convenient for both sides.

In terms of counterterrorism, beyond al-Qaeda, the Taliban wields the convening and convincing influence to bring other militant groups to the table, even with a price. ISKP stands out as the exception due to its broader agenda. However, as the ISKP threat intensifies, it is plausible the Taliban might seek closer cooperation with the US, potentially leading to a trade-off where the Taliban exchanges counterterrorism support for political security.

The obstacles to closer cooperation could include unrealistic Taliban expectations and reticence to appropriately reciprocate. The Taliban is likely to seek more than the US is willing to provide, such as actionable targeting information, and might include requests for training, technical collection equipment, and funding for operations. In return, it is doubtful the Taliban would share information concerning al-Qaeda and its partner groups, offer operational details substantiating the veracity and reliability of its reporting, or grant permission to conduct surveillance and reconnaissance operations — i.e., drone flights — as doing so might allow the US to hear and see things beyond ISKP.

Apart from the politically problematic optics, US intelligence would require all manner of CIA executive and Department of Justice legal waivers to support an organization known for human rights abuses, corruption, and active collaboration with groups threatening the US, its allies, and interests — several members of which are wanted by US authorities for murdering Americans. Those waivers are hard enough to obtain even for America’s friends and typically require a substantial and credible contribution toward saving lives.

As it is, sharing even sanitized intelligence with the Taliban — which might be used to inflict violence and which provides insight into US collection capabilities (sources and methods) — requires scrupulous legal and operational scrutiny.  But such an exchange offers currency for the type of continued engagement and communications to which CIA Deputy Director David Cohen recently referred. The value of this engagement lies in the insights gleaned into Taliban dynamics and capabilities. Such value would be exponentially increased should the Taliban allow, and US political considerations permit, a sustained US diplomatic and intelligence community presence on the ground in some mutually acceptable form.

The status quo’s future prospects

The Taliban’s counterterrorism efforts against the local Islamic State affiliate in Afghanistan have been insufficient to stem the latter group’s growth or developing capabilities. ISKP is leveraging its attacks in Iran and Russia as well as inspiring terrorist operations elsewhere, such as in Austria and Germany, to increase its ranks, coffers, and global following, with an eye to furthering its ambitions for external attacks. This influx of resources will raise expectations among new recruits and supporters for more audacious operations, leading to growing pressure to act but also likely expanding the group’s options.

If seeking momentum in familiar territory, the group could advance additional centrally planned operations across Central and South Asia, Iran, and Russia in the near term, using operatives who are nationals from the target countries; or its members can blend into those nations’ expatriate labor communities. Attacks in Europe and the US might face greater challenges for centrally directed and staffed operations from attentive authorities and alert communities; but even these difficulties are far from insurmountable. Unsophisticated operations against crowds are cheap and pose limited logistical and communications requirements yet can inflict significant casualties. Moreover, ISKP will continue to leverage the pool of homegrown “lone wolves,” to whom the group appeals. 

Meanwhile, the Taliban’s protection inside of Afghanistan offers al-Qaeda room to recruit, raise funds, train, communicate, and manage external operations, whether centrally planned or undertaken by global affiliates. The group’s new amir, ‘Adl, tends to be patient, disciplined and likely focused on organization and control across the affiliates. His mentality has in the past been to pursue sensational, complex operations targeting transportation, including aviation, and symbols, such as embassies, over the less sophisticated tactics evoked by Anwar al-Awlaki and adopted by ISIS: attacking crowds, vehicle ramming, knife attacks, and small arms assaults. But the jihadist landscape has become more competitive, and al-Qaeda needs a win, an urgency reflected in its media arm, As-Sahab, which has intensified efforts to attract new recruits and encourage lone-wolf attacks.

Despite US affirmations concerning the Taliban’s counterterrorism cooperation, Supreme Leader Haibatullah Akhundzada’s few public comments do not inspire confidence. In a rare May 2024 audio statement concerning his ruling that women adulterers would be stoned, Akhundzada said, “Our message to the West is that we have fought against you for 20 years and will fight against you for another 20 years or more… I represent Allah, but you represent Satan. But the party of Allah will prevail.”

Today’s circumstances suggest that Afghanistan’s counterterrorism landscape has raised rather than mitigated threats to America’s homeland in the three years since the US withdrawal, owing to Taliban design and the absence of meaningful US influence. Americans may be forgetting Afghanistan, or hoping to, but the terrorist groups operating there are spending their time planning ways to remind us. Neglecting the Taliban will not change history and might provide Akhundzada precisely the isolationist circumstances and justification he seeks for his draconian rule. But Akhundzada is neither invincible nor untouchable, including from within the ranks of the Taliban itself.

The trick lies in finding the right balance — a challenge that will likely persist until the Taliban reaches consensus on a replacement for the hardline emir. On the one hand, this requires engagement that informs US understanding and advances its influence by developing relationships among the rather competitive Taliban factions; on the other hand, Washington must simultaneously avoid validating or supporting a repressive regime that harbors enemies of the United States. This type of shadowy juggling and nuanced maneuvering is precisely the area in which the US intelligence enterprise excels.  

Douglas London @DouglasLondon5 is the author of The Recruiter: Spying and the Lost Art of American Intelligence and served 34 years as a CIA operations officer, including multiple assignments as a Chief of Station. Mr. London ended his career as the Agency’s Counterterrorism Chief for South and Southwest Asia and teaches intelligence studies at Georgetown University’s School of Foreign Service.

Javid Ahmad is a scholar at the Middle East Institute and a senior fellow with the Atlantic Council in Washington, DC. He also teaches at The George Washington University. Follow him on X @ahmadjavid.

Photo by Marco Di Lauro/Getty Images