ISKP Goes Global: External Operations from Afghanistan

Over the past three decades, successive jihadist organizations have sought to conduct external operations beyond their local battlefields, often from safe havens abroad. The long list includes actors such as the Algerian Armed Islamic Group (when it hijacked Air France Flight 8969 in 1994), al-Qaeda (most infamously via the 9/11 attacks, but also through plots by local branches al-Qaeda in the Arabian Peninsula, al-Shabab, and al-Qaeda in the Islamic Maghreb), and the Islamic State (e.g., in Syria and Libya).

Today, the Islamic State’s Khorasan Province (ISKP) has adopted the same strategy in Afghanistan. Yet unlike many previous groups that relied on stable safe havens to gain more time and space for planning and training, ISKP has actually grown weaker in Afghanistan during the Taliban’s second year in power—while paradoxically expanding its external operations capacity. On the anniversary of the 9/11 attacks, the situation is a stark reminder that Afghanistan under the Taliban is a top vector for jihadist operations abroad.

ISKP Degraded Inside Afghanistan

Shortly after taking power, the current Taliban government established its internal security arm, the General Directorate of Intelligence (GDI), in October 2021. Yet the agency did not begin reporting arrests of ISKP members until July 2022. This gap partly stemmed from the Taliban’s desire to shore up its legitimacy by obfuscating reality and convincing the international community that the country was free of terrorist threats upon its takeover—a goal it pursued through vigorous disinformation.

For example, after U.S. Central Command issued a report in March 2022 noting that ISKP had grown under the Taliban, the GDI posted a tweet calling the news “intelligence propaganda.” A follow-up tweet continued this line of argument: “The khawarij [referring to ISKP] was an intelligence project of the occupiers [i.e., coalition forces] that completely disappeared after the end of the occupation, and currently [it] does not have a physical presence in any part of the country.” This was far from the truth, however, and the Taliban would soon have to contend with the reality of ISKP in Afghanistan. Since the GDI’s first reported ISKP arrest in July 2022, the Taliban has conducted thirty-six counterterrorism raids against the group.

During this period, ISKP attacks inside Afghanistan have measurably decreased, based on official IS claims of responsibility. In 2022-23, attacks decreased even more than they did in 2019-20, when the U.S.-led coalition and Afghan security forces took concerted action against ISKP and before the organization’s current leader, Shahab al-Muhajir, took the reins:

• August 2018-19: 400 attacks
• August 2019-20: 157 attacks
• August 2020-21: 275 attacks
• August 2021-22: 314 attacks
• August 2022-23: 69 attacks

This decline may stem entirely from the Taliban’s campaign to suppress ISKP’s local attack capabilities. Alternatively—or in addition—it might reflect a deliberate ISKP decision to change its attack patterns. The August 28 issue of the group’s Pashto magazine Khorasan Ghag (Voice of Khorasan) included an essay claiming that the decline is due to Shahab al-Muhajir’s “strategic silence policy.” Although verifying such claims is difficult, internal documents leaked in spring and fall 2020 showed that the parent IS organization deliberately underreported its claims of responsibility for attacks in parts of Syria, whether for strategic purposes (e.g., sowing discord among enemies) or practical reasons (e.g., lack of internet access to post claims). Something similar could plausibly be happening with ISKP in Afghanistan, though more time and data are needed to make that determination.

ISKP External Operations

In shifting from a local/regional focus to a more global posture, ISKP has pursued a two-pronged strategy. The first prong is an ongoing propaganda campaign. Unlike other IS branches, ISKP developed an independent media architecture via its al-Azaim Media Foundation, which produces content in Arabic, English, Farsi, Pashto, Tajik, Urdu, and Uzbek. Besides the Taliban, this content has taken aim at a wide range of foreign targets, from surrounding countries (India, Iran, Pakistan, Tajikistan, Uzbekistan) to Middle Eastern heavyweights (Israel, Saudi Arabia, Turkey, the United Arab Emirates) to great-power enemies further afield (China, Europe, Russia, the United States).

The second prong consists of planning and carrying out attacks abroad—either directed, guided, or inspired. Although the Taliban has repeatedly claimed that Afghanistan will not be used as a base for such plots, data compiled by The Washington Institute’s Islamic State Select Worldwide Activity interactive map project indicates that the incident rate has only picked up since the group took power.

For instance, ISKP elements continue to carry out attacks inside Pakistan and have previously launched cross-border rocket strikes against Tajikistan and Uzbekistan. The group has also attacked targets in the Maldives (February and April 2020) and Shiraz, Iran (October 2022 and August 2023; IS did not claim the second attack, but Iran named ISKP as the culprit). In addition, at least fifteen other ISKP plots have been interdicted by law enforcement in India (3), Iran (4), Germany (3), the Maldives (1), Qatar (1), and Turkey (3). Four of these plots emerged before the Taliban takeover, but the other eleven unfolded under its watch: five in 2022 and six so far in 2023. These findings indicate that the Taliban’s so-called “counterterrorism” efforts are limited to its immediate security needs and not those of other nations—an approach that runs directly counter to the government’s stated goal of garnering international support and official recognition.

Beyond attack plotting, authorities in various countries have also arrested ISKP members and supporters for recruiting and fundraising on a few occasions since 2020, including Britain (2), India (3), Turkey (1), Pakistan (1), and the United States (2). And in July 2023, the U.S. Treasury Department designated thirteen individuals in the Maldives for activity related to ISKP, including the local branch’s leader, Abdullah Sharif, and its representative to Afghanistan, Ali Shafiu. The map below shows the full scope of the group’s activities in various jurisdictions:

Open image

One of the most striking aspects of ISKP’s external operations networks is that Tajik nationals were involved in many of its attack plots, financing schemes, and recruitment efforts, specifically in Germany, Iran, and Turkey. Yet Tajikistan has not publicly disclosed anything like this activity on its own soil. The situation recalls Tunisia’s jihadist network prior to the country’s 2011 revolution, which involved fairly little jihadist activism locally but major mobilization abroad—a discovery that did not become fully apparent until Tunisians established an open political system.

Policy Implications

The global threat emanating from ISKP’s base in Afghanistan is real, whether in the form of direct attacks, efforts to guide individuals online, or attempts to inspire them via propaganda materials. If authorities had not thwarted so many of the plots described above, the international community would likely be putting far more pressure on the Taliban for seemingly allowing ISKP to conduct extensive terrorist operations from its territory. Unlike in 2001, when it was allied with the problematic jihadist actor in question (al-Qaeda), the Taliban clearly regards ISKP as an enemy. Yet it is difficult to take the government’s security claims seriously when it insists that foreign countries face no threats from Afghanistan. Despite its crackdown on ISKP attacks at home, terrorist plots abroad have verifiably increased in the two years since the Taliban takeover, suggesting that the government is either unable or unwilling to contain such operations. This situation will only further harm its chances of gaining legitimacy on the world stage

The situation also puts Washington in a difficult position. Many of ISKP's  plots have targeted close U.S. partners such as Germany, India, Qatar, and Turkey, yet authorities no longer have the same intelligence networks in place that they had prior to the withdrawal from Afghanistan. Washington should therefore consider resuming the approach it took when targeting al-Qaeda leader Ayman al-Zawahiri in July 2022—that is, focusing on drone strikes against ISKP members involved in external operations planning. Paired with the current intelligence-led law enforcement approach, this strategy could help limit ISKP's ability to conduct successful attacks abroad, in much the same way that U.S. efforts diminished the external operations capacity of other jihadist groups over the past two decades.

Aaron Zelin is the Richard Borow Fellow at The Washington Institute and founder of Jihadology.net.