Murder on Maneuver: Exploring Green-on-Blue Attacks in Afghanistan

Abstract

Green-on-blue attacks have a devastating psychological, tactical, and operational effect on military operations in Afghanistan. In spite of this, no empirical research has offered a data-driven examination of these attacks, leaving a gap that this article aims to address. By analyzing a large (yet inevitability incomplete) open-source database developed on these attacks, we present data on the perpetrators and victims of these attacks. We also investigate whether green-on-blue attacks are related to the number of civilian casualties in that area; finding that (unlike wider insurgent violence) they are not. Instead, we find that it is the number of troops present within a Regional Command that is positively correlated with the likelihood that a green-on-blue attack will occur. We discuss the implications of these findings with reference to future issues of force protection.

Keywords

green-on-blue insider attack fratricide counter insurgency social categorization theory

Since May 2007, green-on-blue attacks, or “insider attacks,” in Afghanistan have killed over 140 coalition troops and injured over 180 (Roggio & Lundquist, 2013). Green-on-blue attacks function as a case-specific version of blue-on-blue attacks or “friendly fire,” where friendly military forces fire upon each other accidentally. In the case of green-on-blue attacks of interest here, “green” represents the members of the Afghanistan National Security Forces (ANSF; or in some cases, an insurgent imposter) targeting “blue” forces or the members of the International Security Assistance Force (ISAF). Blue-on-blue attacks primarily involve air-to-ground or artillery fire and mostly take place during active combat situations (Shrader, 1992). Green-on-blue attacks, however, usually involve small arms fire and occur on ISAF bases (Ahmad, 2017). Therefore, it is feasible to form an assumption that while blue-on-blue attacks are inherently accidental, green-on-blue attacks do not seem to share the same accidental characteristics.

Within the wider discussion of green-on-blue attacks in Afghanistan, there is a fundamental disagreement between those who state that victims know (and often work with) their perpetrator (e.g., Bordin, 2011) and those who view such attacks as predominantly perpetrated by strangers (Sageman, 2013). To further confound the issue, little open-source data exist on such attacks or their perpetrators, and with the exception of Armstrong (2013), no theoretical explanations have been forwarded to clarify the underlying psychological mechanisms at play.

With this in mind, the first goal of this article is to analyze data (collected via open-source data coding) that focus on green-on-blue attacks in Afghanistan: the perpetrators, the victims, and the attack tactics. Second, beyond the proximate motivation for these attacks (e.g., personal or insurgent), no research has sought to identify any environmental indicators for these attacks. As such, this article tests if wider correlates of insurgent violence (namely, the number of civilian casualties caused by international forces; see Condra, Felter, Iyengar, & Shapiro, 2010) also predict the occurrence of green-on-blue attacks in Afghanistan.

Literature on Green-on-Blue Attacks in Afghanistan

Green-on-blue attacks emerged as a threat to ISAF personnel in 2007, before surging in frequency and lethality in 2011 and 2012 and declining throughout 2013 (Long, 2013). Green-on-blue attacks posed a renewed challenge to the efforts for achieving peace in Afghanistan because these attacks undermined the morale of ISAF troops and the scope for a combined strategy between ANSF and ISAF. These attacks also had far-reaching repercussions for the country’s transition to much-needed peace and stability (Long, 2013). Furthermore, regardless of whether the Taliban actually orchestrated these attacks, the Head of the Supreme Council Mullah Omar immediately supported them, claiming that the Taliban “cleverly infiltrated” the ranks of the enemy and released videos praising the heroic perpetrators. The Taliban’s use of green-on-blue attacks as propaganda, and their strategic re-structuring to encourage defections, amplified the message that these attacks were becoming increasingly successful at tactical and operational levels throughout the final stages of ISAF’s campaign in Afghanistan. Since the surge of green-on-blue attacks in 2011 and 2012, trust between ISAF and ANSF, as well as ANSF’s readiness to assume full security responsibility, significantly decreased (Dyrud & Moradian, 2012).

The Taliban’s claims for responsibility in green-on-blue attacks were often exaggerated. The North Atlantic Treaty Organization (NATO) estimated that only 25% of green-on-blue attacks were the result of Taliban infiltration (Tupper, 2013), emphasizing that the majority stemmed from personal grievances and escalated personal confrontations between members of the ISAF and members of ANSF (Bordin, 2011; Department of Defense [DoD], 2013; Roggio & Lundquist, 2012). Research by Dr. Marc Sageman, however, challenged this finding. Sageman’s findings, based on interviews with detained perpetrators, put collective grievances at the heart of such attacks, showing that in the vast majority of cases, ANSF attackers fired at “strangers” whom they did not work alongside (Sageman, 2013). According to Sageman’s research, none of the 49 recorded green-on-blue attacks were the result of a personal confrontation, and only seven of the perpetrators were co-opted by insurgent forces.

Currently, Armstrong (2013) has produced the only academic research that specifically explores the dynamics of green-on-blue attacks in Afghanistan. Developed using in-depth case studies of NATO efforts to partner with ANSF, this research found that cross-cultural friction and personal stress are clear contributing factors.

Secondly, Armstrong (2013) proposed there were three different “triggers” for attacks: enemy induced, threat or insult induced, and stress induced. Armstrong also proposed an analytical framework for green-on-blue attacks, which demonstrates the interrelation of perpetrator triggers, attacker motivation, and outcome. Here he identified that offenders with different motivations (anti-NATO/Western vs. reputational vs. religion vs. power vs. economic) will undertake different types of green-on-blue attack (“premeditated attack” vs. “violent behavioral response”). That said, it should be highlighted that Armstrong (2013) presented no behavioral data in support of these typologies.

Civilian Casualties as a Correlate of Insurgent Violence

Contemporary conflicts are often conducted among the civilian population, where gaining and maintaining the popular support of residents dictates the likelihood of strategic success (Boyle, 2010). From the counterinsurgent perspective, gaining population support requires the provision of services, material assistance, and restraint on the use of force to ensure minimal harm to the civilians they are meant to protect. Civilian casualties, therefore, present a dilemma because stability requires security, which usually requires the counterinsurgent force to target insurgents who may be operating within and around the civilian population. Thus, targeting insurgents invariably leads to civilian deaths and security must come at the cost of support or vice versa. Civilian casualties, therefore, represent a liability in the critical battle for “hearts and minds” and contravene counterinsurgency principles.

Additionally, civilian casualties have a significant effect upon ISAFs’ partnership with, and development of, the ANSF. In the long-term, developing the ANSF is the most important strategic goal (Williams, 2015). Yet civilian casualties caused by ISAF have had a significant impact on the working partnership between ISAF and ANSF personnel (Bordin, 2011). Research exploring issues among ISAF and ANSF interoperability identifies civilian casualties as a critically important issue (Bordin, 2011, p. 33). Among ANSF participants in Bordin’s study, civilian casualties appeared across virtually every focus group, and participants stated a notable lack of concern for the safety of civilians by ISAF, with an emphasis on killing insurgents and self-protection (Bordin, 2011, p. 34). Of greater concern is that even while ISAF-caused civilian casualties have been dropping, ANSF personnel were still prone to believe that ISAF had been the cause of the casualties, even when presented with extensive evidence to the contrary (Bordin, 2011, p. 34). Recently, Bohannon (2014) speculated on a specific link between civilian casualties and green-on-blue attacks in that “anger at civilian deaths caused by the military may be driving an increase in ‘green-on-blue’” (p. 724).

Civilian casualties also enrage the local population, encouraging insurgent recruitment (Condra et al., 2010). For example, in March 2007, an ISAF airstrike killed nine members of one Afghan family, resulting in protests by hundreds of Nangarhar University students (Dadkhah, 2008). Each tragedy unquestionably enflames the Afghan public’s emotions, erodes their goodwill by breeding resentment, and adds to the increasingly pessimistic mood of the populace (Condra et al., 2010). Anecdotally, civilian casualties are often associated with insurgent recruitment (see Nadery & Humayoon, 2008), and recent research has added statistical support to this view. Using civilian casualty and significant activities (SIGACT)¹ data from Iraq and Afghanistan, Condra, Felter, Iyengar, and Shapiro (2010) identified a “revenge effect,” finding that for every ISAF-caused incident that caused two civilian casualties (within an average-sized Afghan district), there was one more insurgent attack over the next 6 weeks. This relationship was found to be specific to Afghanistan and was not present in Iraq (where it was observed that the increased population density and urbanization may potentially mitigate insurgent recruitment). Of greater importance, then, is that the negative effect of civilian casualties on the population is subject to in-group distortion effects. ISAF-caused civilian casualties resulted in decreased support, yet this punitive perception was not transferred to the Taliban after they caused civilian casualties (Lyall, Blair, & Imai, 2013).

Given the interrelation between civilian casualties caused by ISAF and insurgent violence in Afghanistan, and the known role of civilian casualties as a grievance to members of the ANSF, it is viable to suppose that civilian casualties caused by ISAF may play a role in motivating members of the ANSF to commit green-on-blue attacks against their ISAF partners. Given this view, we propose the following hypotheses:
Hypothesis 1: As the number of civilian casualties caused by ISAF increases, the number of green-on-blue attacks will also increase.

Hypothesis 2: As the number of civilian casualties caused within a given Regional Command (RC) increases, the likelihood of a green-on-blue attack within that RC will also increase.

Data and Method

Green-on-Blue Database

Sample

One hundred and twelve cases of green-on-blue attacks were identified via open-source data searching. We define green-on-blue attacks in line with Long (2013) in that they are instances in which a member (or members) of the ANSF (or Taliban imposters) purposefully targets (successfully or unsuccessfully) a member (or members) of ISAF. Instances in which members of the blue forces were killed by accidental shootings and weapon errors from the green forces were not included in this study as these are not reflective of the wider “green-on-blue” phenomena that involve an individual with intent to kill.

This sample was identified from currently existing lists of green-on-blue attacks (e.g., Bordin, 2011) and then expanded through open-source searching for cases of green-on-blue attacks in Afghanistan (using open-source search tools and terms such as green-on-blue, “fratricide,” and insider attack and/or “insider threat”). From here, a series of cases were identified, which were confirmed to meet the definition of green-on-blue attacks provided above. This sample is larger than that reported by Roggio and Lundquist (2013), but it is similar in size to the number of insider attacks reported by the U.S. DoD (2013). Thus, when we talk about green-on-blue events, our unit of analysis is the “attack” itself (unless otherwise stated).

Overall, the sample of green-on-blue events for this project includes 112 events that occurred in Afghanistan between May 6, 2007, and October 26, 2013. All events included the targeting, or attempted targeting, of ISAF forces by members of the ANSF. This database also includes, where possible, those events that resulted in no casualties.

From these 112 cases of green-on-blue attacks, we identified 153 individuals who had perpetrated (or attempted to perpetrate) a green-on-blue attack and 157 members of ISAF personnel who had been the victim of a green-on-blue attack. For a full outline of these 112 cases of green-on-blue attacks, see Appendix A.

Data collection and analysis

To collect data for this project, a codebook of 87 variables was developed, which covered a range of binary, categorical, and string variables related to the green-on-blue event, perpetrator(s), and victim(s) (an outline of data pertaining to the perpetrators and victims is provided in Appendix B). This codebook was populated through extensive open-source searching. The data for this codebook came from open-source media reporting as well as government (“gray”) literature, and (although this was rarer) official reviews of a green-on-blue attack. Information sources were not exclusively written in English (online translators were used when needed), but most of the media reports were written in English due to the majority of victims being from the United States or United Kingdom. The variables in this codebook related to three distinct aspects of each green-on-blue attack: the attack itself (and its tactics), the victim, and the perpetrators. Specifically, this codebook contained data points for the following:

The green-on-blue attack

The codebook contained 33 variables pertaining to when, where, and how the green-on-blue attack unfolded. Two independent coders coded each observation separately. After an observation was coded, an independent member of the project team reconciled these results. The percentage similarity between coders was 87.6%. In line with similar research which uses open-source information to generate data points (e.g., Gill, Horgan, & Deckert, 2014; Horgan, Shortland, Abbascianno, & Walsh 2016), coding for this project required a “hard no” or a “hard yes.” Thus, the absence of a variable could not be used to infer that it was not there. Instead, for a variable to be coded as “absent,” there would need to be a statement which conformed this.

For example, the lack of reporting if the soldier knew their attacker before the attack could not be used as evidence that they did not (even though we may assume that if they did, this would be reported). Instead, for us to confirm that the soldier and the attacker did not have a previous relationship, open-source reporting would have to include a phrase such as “the soldier had no relationship with the attacker prior to the attack.” This is an important point because it likely skews the data presented here because it means that the number of “NOs” presented in this research is likely a smaller number than the true number of NOs, whereas the number of “YESs” is likely a truer reflection of the real number (based on the view that in most cases the presence of something is more newsworthy than its absence; see Horgan, Shortland, Abbasciano, & Walsh, 2016).

Independent Variables

RC

Data are grouped by RC (North, West, South, East, and Capital). To estimate the fixed effects of each RC, we include a dummy variable for each. The dummy variable for each RC is abbreviated with the first letter of that area. For example, the RC for the North is abbreviated as RC-N.

Civilian casualties and victims

This research used civilian casualty data collected by the Civilian Casualty Tracking Cell/Mitigation Team and released via Science (Shortland & Bohannon, 2014). This is the official database of civilian deaths and injuries between 2008 and 2014 and contains the number of civilians killed and injured by ISAF per month within each RC (North, South, Southwest, Capital, East, and West).²

Troop density

As troop presence in Afghanistan increases, the opportunity to commit a green-on-blue attack does as well (i.e., if the number of ISAF troops in Afghanistan equals zero, it is impossible to perpetrate a green-on-blue attack). Troop density figures were obtained from ISAF placemat reports and UK Ministry of Defense progress reports for Afghanistan. Data were integrated across these two sources because individually neither one included sufficient data points for analysis. Comparison of sequential months within and between the two data sets showed high levels of internal reliability, supporting the validity of integrating these two data sets. While ISAF frequently did not publish RC troop estimates, particularly during the 2011–2012 period, when RC figures were reported by ISAF, they were considered estimates.³ As such, for months missing RC totals, we estimate troop figures based on the disposition of forces when the country total was of a similar level and use a last observation carried forward method.

Strategic adaptation

We include a dummy variable called “strategic adaptation” to control for the period during which the Taliban formally announced that they had begun to actively recruit green-on-blue attackers and ISAF began to institute new policies designed to reduce the occurrence of green-on-blue attacks. It is our assumption that the formal announcement by the Taliban that green-on-blue attacks were a new “strategy” would increase the likelihood that they would occur, as such this dummy variable was included to control for this.

Dependent Variable

Green-on-blue attacks

For every month within each RC, the presence or absence of a green-on-blue attack was coded dichotomously (1 = at least one green-on-blue attack and 0 = no green-on-blue attacks). This allows a model to be constructed that provides the probability of at least one green-on-blue attack occurring within a given month and within a given RC. Furthermore, a binary coding allows for the possibility of unrecorded green-on-blue attacks in months in which at least one green-on-blue attack occurred. This is an issue that has been raised in public media sources (e.g., Roggio & Lundquist, 2012). Binary coding for the presence of a green-on-blue attack, rather than the number of attacks, is therefore more robust against issues of reporting accuracy.

Results

Descriptive Summary of Green-on-Blue Attacks

The worst year for green-on-blue attacks was 2012, with 48 attacks countrywide and 12 in August 2012 alone. RC-S saw the most green-on-blue attacks with 51, followed by RC-E with 32. RC-C, RC-N, and RC-W experienced fewer green-on-blue attacks with 8, 7, and 14, respectively.

Green-on-Blue Attacks and Civilian Casualties

The correlation between ISAF civilian casualties and insider attacks at the country level was calculated and revealed an r = .118 (p < .05), thus there is a small, positive correlation between these factors. Partial correlations were calculated for the association between ISAF civilian casualties and insider attacks. All of the partial correlations were small and not significant, meaning that when controlling for RC, the partial correlations between ISAF civilian casualties and insider attacks are not statistically significantly different than zero.

In order to estimate a model investigating the effects of civilian casualties on the occurrence of green-on-blue attacks, panel data were used organizing variables by month and RC. For these data, we examined the occurrence of green-on-blue attacks within each RC at the month level. While we realize that this is a relatively “crude” degree of analysis, the recency of this phenomenon precludes the use of more granular data. For example, while Condra et al. (2010) are able to use SIGACT data (a far more temporally and geographically defined degree of analysis), these data are not available for the time frame we are interested in (specifically the years after 2010).

Our analysis of green-on-blue was accordingly restricted by the quality of the data sets which cover civilian casualties during the most prominent years of green-on-blue attacks (2011–2013). The most suitable data set, therefore, is the ISAF civilian casualty data (published by Bohannon, 2011; Shortland & Bohannon, 2014). Additionally, troop-density numbers are released in this format (by month and RC). Consequently, this restricted our analysis to RC by month. For the purpose of this analysis, green-on-blue attacks represented the number of green-on-blue attacks that occurred within a given RC within a given month (from the first of the month until the first of the next month).

Logistic Regression

The dichotomous outcome measure for the presence/absence of at least one green-on-blue attack was examined using a logistic regression model. First, the model was run including the predictors of interest, as presented in Table 1. Additionally, the odds ratios and 95% confidence interval were calculated for Model 1 (see Table 2). A second model was then calculated, which included an interaction effect between the number of ISAF-caused civilian casualties and troop density (see Table 1).

Table 1.
Logistic Regression Models 1 and 2.

Model (1) (2)

Constant −23.8752* (4.717) −22.6643* (5.5035)

ISAF CIVCAS at t −0.0046 (0.0138) −0.1109 (0.2603)

Log₂ troops 1.6864* (0.3639) 1.5937* (0.4229)

Strategic adaption 0.4558 (0.3403) 0.4582 (0.3397)

RC-North −0.3823 (0.5832) −0.3528 (0.5862)

RC-East −1.2806 (0.8065) −1.1168 (0.8946)

RC-South −2.6221* (1.0970) −2.4717* (1.1523)

RC-West 1.4280** (0.5483) 1.3887* (0.5560)

ISAF CIVCAS at t × troops 0.0071 (0.0174)

Observations 350 350

Nagelkerke R ² 0.250 0.250

LR x ² 62.38* 62.56*

Note. Standard errors are in parentheses. GOB = green-on-blue; ISAF = International Security Assistance Force; CIVCAS = civilian casualties; RC = Regional Command.

p ≤ .001, p ≤ .01, p ≤ .05.

Table 2.
Model 1 Odds Ratios and 95% Confidence Intervals.

Variables Odds Ratio Lower Bound Upper Bound

Constant 4.28e-11 4.13e-15 4.45e-7

ISAF CIVCAS at t 0.9954 0.9688 1.0228

Log₂ troops 5.4002 2.6464 11.0197

Strategic adaption 1.5774 0.0896 3.0734

RC-North 0.6823 0.2176 2.1397

RC-East 0.2779 0.0572 1.3501

RC-South 0.0726 0.00846 0.6238

RC-West 4.1703 1.4238 12.2146

Based on these analyses, we cannot support Hypotheses 1 and 2. Our analysis showed that there was no significant relationship between ISAF-caused civilian casualties and the occurrence of green-on-blue attacks, within the same RC and the same month, when additional factors were included in the model. Model 1 (see Table 1) shows that ISAF-caused civilian casualties are not significantly associated with the occurrence of a green-on-blue attack when other factors are taken into account.⁴ Table 2 shows that for every unit increase in ISAF civilian casualties, the odds of a green-on-blue attack decrease by 0.05%, holding all other factors constant. This relationship is not significant.

The number of troops within an RC is significantly positively related to the occurrence of a green-on-blue attack. Holding all other factors constant, for every 2-fold increase in troop density, the odds of a green-on-blue attack occurring increase by a factor of 5.40 (see Table 2). Additionally, there is some evidence that each RC interacts differently with green-on-blue attacks. Specifically, when holding troops and civilian casualties constant, both RC-S and RC-W were significantly associated with the occurrence of a green-on-blue attack. In Model 2 (see Table 1), an interaction effect between ISAF-caused civilian casualties and troop density showed no effect on the significance of the model.

Discussion

This research explored whether green-on-blue attacks were associated with the number of civilian casualties caused by international forces, and hence, the degree to which such attacks may reflect patterns of wider insurgent violence (see Condra et al., 2010). Our analysis does not support the proposed hypotheses about the correlation between civilian casualties and insider attacks in Afghanistan. We discuss the theoretical implications below, especially as they pertain to the psychological factors that likely motivate them. We also discuss the limitations of this research and directions for future in this area.

It is clear that green-on-blue attacks pose a substantial and almost inexorable threat to force protection, the ISAF-ANSF partnership, and (arguably) the strategic success in Afghanistan and other future collaborative missions. The analysis of the inevitably limited first open-source database showed the heterogeneity of both green-on-blue perpetrators and their victims, suggesting a demographic diversity that is similar to that seen in other insurgent actors (e.g., Reinares, 2004), as well as “lone wolf” terrorists (Gill et al., 2014).

Our analyses did not find a statistically significant relationship between the number of civilian casualties caused by ISAF and the occurrence of a green-on-blue attack within a given month and within a given RC. This finding implies that green-on-blue attacks do not follow the same pattern as wider insurgent violence (which are correlated with civilian casualties; see Condra et al., 2010).

Instead, this research found that as the number of troops within an RC increased, so did the likelihood that a green-on-blue attack would occur. A possible explanation for this is that areas with a greater troop density may also have a greater insurgent presence, thus increasing the likelihood of infiltration. However, this finding is also unlikely, given the effect (or lack thereof) of the strategic adaptation variable. The coefficient was small and positive (about 0.45–0.46) in both models but had no significant effect on green-on-blue attacks. There are two possible explanations for this finding: Firstly, the strategic adaptation of the Taliban had no effect on the likelihood that a green-on-blue attack would occur, and secondly, that any positive effect this had was mitigated by the increasing counter-methods applied by ISAF (see Reed, 2012). However, what this does mean is that it seems that a Taliban willingness to conduct green-on-blue was not related to their occurrence. This then places the causal mechanisms for green-on-blue attacks as internal to the ISAF/ANSF dynamic.

An alternative potential explanation for the finding that increased troop density increases the likelihood that a green-on-blue attack will occur builds on Sageman’s (2013) and Armstrong’s (2013) research on contributing factors for green-on-blue attacks. Armstrong (2013) proposes that cross-cultural friction plays a role in contributing to green-on-blue attacks, and Sageman (2013) demonstrates that the majority of ASNF attackers fired against strangers. Our data (which should be viewed with reservations given the availability of data) provide preliminary support to the view that green-on-blue attackers were more likely to target strangers or out-group members. This is in line with theories of interpersonal violence that show it is far easier to dehumanize and aggress against “faceless strangers” than those we know (Staub, 1989).

In-groups are often created based on culture, religion, values, and ways of life, viewing members of the out-group less positively (Dixon & Levine, 2012). This supports the potential explanatory utility of self-categorization theory, which implies that, depending on social context, people can identify themselves in multiple ways and can even recategorize former out-group members as in-group members (and vice versa). In the situation of interest, an increase in troop density (while increasing the opportunity to commit a green-on-blue attack) may increase the amount of “cultural frictions” that occur between ANSF and ISAF. Cultural differences and their influence on conflict are increasingly being focused on by organizational psychologists and conflict management research.

Conflict is often associated with issues of values and identity (Cartwright & Cooper, 2000; Mayer, 2010). Conflict often begins when individuals or groups perceive differences and oppositions between themselves and others over interests, beliefs, needs, and values (De Dreu, Harinck, & Van Vianen, 1999). The differences between ISAF and ANSF (especially in terms of interests, norms, and beliefs) are well known (see Bordin, 2011), supporting the importance of culture clashes and green-on-blue attacks as a unique manifestation of wider cross-cultural organizational conflict. For example, hybridized codes (e.g., accent, manners, and cultural differences in nonverbal behavior; Kyriakides, Virdee, & Modood, 2009) can perpetuate intergroup differences and a sense of out-groupness that are conducive to attacks against those who are not seen as in-group members (Dixon, Levine, Reicher, & Durrheim, 2012). As such, it may be that increases in “out-group” troop density amplify the presence of such hybridization codes, strengthening a sense of “us” and “them” and facilitating the ease with which a green-on-blue perpetrator views members of ISAF as a member of the out-group. ISAF soldiers may be seen as the enemy out-group by those members of the ANSF who commit such attacks, rather than as members of the in-group by those who do not commit such attacks (Turner, Hogg, Oakes, Reicher, & Wetherell, 1987).

Future Research

Given the tactical and operational impact of green-on-blue attacks and high likelihood that future operations will continue to involve partnership with indigenous forces, a viable postulation is that green-on-blue attacks may not be an “Afghanistan-specific” phenomenon. It is imperative that future research continues to focus on the social, organizational, and environmental factors that may play a part in motivating an individual to “turncoat.” For example, there are a host of other variables that may motivate green-on-blue attacks that are not accounted for in this research. Arrests, destruction of property, and culturally offensive behavior were also stated to be top-tier grievances with the ANSF (see Bordin, 2011). Interviews with detained perpetrators of green-on-blue attacks highlight the role that events such as the burning of Qurans by Florida-based pastor Terry Jones and the slaughter of Afghan civilians by Staff Sergeant Bales played in their decision to turncoat (see CAPS, 2013).

In order to support future force protection, research needs to begin to unpack the many diverse reasons for which members of the ANSF become motivated to undertake a green-on-blue attack. Similar to research on wider involvement in terrorist violence, research will need to employ a multimethod approach that investigates statistical markers and correlates of green-on-blue attacks while also focusing (through qualitative research) on the individual, organizational, and environmental factors that pushed or pulled members of the ANSF toward undertaking a green-on-blue attack.

In response to the emergence of green-on-blue attacks, ISAF and NATO took several steps to mitigate the perpetration of such attacks. Firstly, “guardian angels” (i.e., officers who watch for possible green-on-blue attackers) were employed to provide security to those accompanying Afghan forces. Secondly, the number of joint patrols between ISAF and ANSF servicemen in Afghanistan was greatly curbed. Finally, background checks were improved to mitigate the risk of green-on-blue incidents (DoD, 2013). These security measures are viewed as responsible for the overall decline in the number of successful attacks during 2013. It is essential that future research further explores the effectiveness of these tactics, with special attention being paid to some of the potential psychological drivers we have identified above.

Study Limitations

Firstly, and most obviously, data available via open-source news reports will be inevitably incomplete and suffer a general paucity of certain types of information (such as sociodemographic data for the perpetrator). In addition, the nature of material reported in the media is likely to be biased with certain types of information being more likely to be reported and therefore overrepresented in this sample. For example, Horgan, Shortland, Abbascianno, and Walsh (2016) found that the type of terrorism that an individual engaged in affected the quality and quantity of media reporting on that individual. To apply this point here, it is perhaps viable to propose that issues such as “known relationships” to their victims were more hotly reported in the media, given that a significant degree of the political and popular narrative around these types of events was centered on the degree to which the attackers did or did not know their victims.

Furthermore, while green-on-blue attacks began to appear in 2007, it was not until later that they became widely reported on, suggesting that there is likely a bias in the quality and quantity of reporting between the earliest cases and the more recent ones. However, for many of the early cases, the results of formal investigations are released, providing a fuller picture of the event and increasing the degree of confidence we can place in data relating these cases. In coding data for this research, researchers required a “hard” yes or no. Meaning that for a data point to be coded as present, there had to be evidence stating this directly (and that the absence of reporting could not be used to infer an absence of this variable). In practice, therefore, many cases may exist where the absence of a relationship goes unreported, likely decreasing the number of NOs counted in the data, whereas the number of YESs will be a more accurate representation.

In addition, the troop’s variable may not be an ideal metric for “opportunity.” In 2012, ISAF began to institute measures that restricted interaction between ANSF and ISAF personnel in many situations. Restricting access to weapons on post and limiting the number of partnered operations represent attempts to reduce the opportunity to perpetrate a green-on-blue attack. The troop variable does not fully measure these changes in procedure or access that ANSF personnel have to ISAF personnel or weaponry (regardless of force density). For example, during the period in which these security procedures were implemented, the ISAF contingent in Afghanistan was at its highest levels, while opportunity was perhaps at one of its lowest points. In future research (and dependent upon access to data), metrics such as partnered operations would be an important addition.

Conclusions

In spite of the 157 killed in green-on-blue attacks in Afghanistan, academic research has offered little in support of explanation and prevention, prompting us to attempt to fill at least a part of this knowledge gap. We provided the first analysis aimed at helping predict such attacks, revealing a complex, rather than a simple and “neat,” picture. In doing so, we present important data about the nature of such attacks (e.g., who perpetrates them, how, and whom is targeted).

In addition, we suggest that green-on-blue attacks may not adhere to the same patterns and predictors as wider insurgent violence. These analyses reinforce the importance of future research in this area. We propose the potential utility of exploring “identity” and perceptions of in-group and out-group. However, there are a host of limitations with the data presented here, and while bearing these limitations in mind, it is clear that our analysis poses many questions for future research. In the absence of any other data or analysis in this area, open-source information should not be discounted from scientific analysis. Elsewhere, a host of open-source data collection efforts have recently been undertaken to explore underresearched areas of national security. Given the paucity of analysis and research on green-on-blue attacks in Afghanistan, coupled with the potential threat such attacks could pose in the future, leveraging open-source data to construct an empirical analysis of the nature of the attacks, perpetrators, and victims is an important first step.

Model	(1)	(2)
Constant	−23.8752*** (4.717)	−22.6643*** (5.5035)
ISAF CIVCAS at t	−0.0046 (0.0138)	−0.1109 (0.2603)
Log₂ troops	1.6864*** (0.3639)	1.5937*** (0.4229)
Strategic adaption	0.4558 (0.3403)	0.4582 (0.3397)
RC-North	−0.3823 (0.5832)	−0.3528 (0.5862)
RC-East	−1.2806 (0.8065)	−1.1168 (0.8946)
RC-South	−2.6221* (1.0970)	−2.4717* (1.1523)
RC-West	1.4280** (0.5483)	1.3887* (0.5560)
ISAF CIVCAS at t × troops		0.0071 (0.0174)
Observations	350	350
Nagelkerke R ²	0.250	0.250
LR x ²	62.38***	62.56***

Variables	Odds Ratio	Lower Bound	Upper Bound
Constant	4.28e-11	4.13e-15	4.45e-7
ISAF CIVCAS at t	0.9954	0.9688	1.0228
Log₂ troops	5.4002	2.6464	11.0197
Strategic adaption	1.5774	0.0896	3.0734
RC-North	0.6823	0.2176	2.1397
RC-East	0.2779	0.0572	1.3501
RC-South	0.0726	0.00846	0.6238
RC-West	4.1703	1.4238	12.2146

Footnotes

Appendix A

Table A1.

Outline of 112 Instances of Green-on-Blue Attacks.

N	Year	Province	ANSF Perp.	Attack By	CF Nation	KIA	WIA	Perp. Status
1	2007	Kabul	ANA	SAF	US	2	2	Killed
2	2007	Herat	ANA	SAF	US	1	0	Detained
3	2007	Helmand	ANA	SAF	ISAF (US?)	0	0	Detained
4	2008	Kunar	AUP	SAF	US	1	0	Killed
5	2008	Paktiya	AUP	SAF	US	1	4	Killed
6	2008	Paktiya	AUP	SAF + Gren.	US	1	0	Killed
7	2009	Balkh	ANA	SAF	US	2	2	Killed
8	2009	Kabul	AUP	CMD IED	US	2	0	Detained, escaped
9	2009	Kapisa	AUP	SVBIED	US	3	1	TBC
10	2009	Kabul	AUP	SAF	US	0	1	Detained
11	2009	Wardak	AUP	SAF	US	2	3	Escaped
12	2009	Helmand	AUP	SAF	UK	5	6	Escaped
13	2009	Khost	AUP	SAF	US	0	1	Killed
14	2009	Badghis	ANA	SAF	US+ITA	1	2	Detained
15	2010	Wardak	CIV	SAF	US	2	1	TBC
16	2010	Balkh	AU	SAF	SWE	2	1	Killed
17	2010	Ghazni	ANA	SAF	POL	0	1	Escaped
18	2010	Kandahar	ANA	SAF	ISAF (TBC)	0	0	Killed
19	2010	Helmand	ANA	SAF/RPG	UK	3	4	Escaped
20	2010	Balkh	ANA	SAF	US	2	1	Killed
21	2010	Badghis	AUP	SAF	ESP	2	0	Killed
22	2010	Kapisa	ANA	RPG	FRA	0	0	Escaped
23	2010	Zabul	AUP	IDF	ISAF (TBC)	0	0	Detained
24	2010	Kandahar	ANA	SAF	US	0	0	Killed
25	2010	Helmand	ANA	SAF	US	2	0	Escaped
26	2010	Kandahar	AUP	SAF/Threat	US	0	0	Killed
27	2010	Nangahar	AUP	SAF	US	6	0	Killed
28	2010	Paktiya	ANA	SIED	US	2	6	Killed
29	2010	Kandahar	ANA	SAF	CAN	0	0	NA
30	2011	Helmand	AUP	Threat	US	0	0	Killed
31	2011	Badghis	ANA	SAF	ITA	1	1	Escaped
32	2011	Baghlan	ANA	SAF	GER	3	6	Killed
33	2011	Kandahar	Sec Gg.	SAF	US	2	4	Killed
34	2011	Faryab	ABP	SAF	US	2	0	Killed
35	2011	Kabul	AAF	SAF	US	9	0	Killed
36	2011	Logar	ANA	RC-IED	US	0	8	Escaped
37	2011	Helmand	ANCOP	SAF	US	2	2	Detained
38	2011	Paktika	ANA	SAF	US	0	1	Escaped
39	2011	Takhar	ANA	SIED	GER	2	4	U/K
40	2011	Uruzgan	ANA	SAF	AUS	1	0	Killed
41	2011	Farah	AUP	SAF	ISAF (TBC)	0	0	Detained
42	2011	Helmand	ANA	SAF	US	0	1	Killed
43	2011	Panjshir	NDS	SAF	US	2	1	Killed
44	2011	Helmand	ANA	SAF	UK	1	2	Escaped
45	2011	Paktika	AUP	SAF	US	1	0	Killed
46	2011	Zabul	NDS	Grenade	US	0	0	Killed
47	2011	Kandahar	ANA	SAF + RPG	US	2	4	Detained
48	2011	Kandahar	ANA	SAF	AUS	3	7	Killed
49	2011	Uruzgan	ANA	SAF (?)	AUS	0	3	Escaped
50	2011	Farah	ANA	SAF	US	0	4	Killed
51	2011	Kapisa	ANA	SAF	FRA	2	0	Killed
52	2012	Zabul	ANA	SAF	US	1	3	Killed
53	2012	Kapisa	ANA	SAF	FRA	5	13	Detained
54	2012	Helmand	ANA	SAF	US	1	0	Detained
55	2012	Kandahar	AUP	SAF	US+ALB	1	2	Detained
56	2012	Nangahar	ANA	SAF	US	2	0	Escaped
57	2012	Kabul	AUP	SAF	US	2	0	Escaped
58	2012	Kandahar	ANA + CIV	SAF	US	2	2	Two killed, one detained
59	2012	Kabul	ANA	SAF	US	0	0	Detained
60	2012	Helmand	ANA	SAF	UK	2	1	Killed
61	2012	Pktika	ALP	SAF	US	1	0	One killed, one detained
62	2012	Kandahar	ANA	SAF	BUL	0	0	Killed
63	2012	Kandahar	AUP	SAF	US	0	2	Killed
64	2012	Kandahar	ANA	SAF	US	1	4	Killed
65	2012	Helmand	ANA	SAF	US	1	1	Killed
66	2012	Kunar	ANA	SAF	US	1	2	Escaped
67	2012	Helmand	AUP	SAF	UK	2	0	One killed, one Detained
68	2012	Kandahar	AUP	SAF	US	1	8	Two killed, one escaped
69	2012	Kandahar	AUP	SAF + SIED	US	2	12	Escaped
70	2012	Helmand	ANCOP	SAF + PKM	UK	3	1	Detained
71	2012	Wardak	ANA	SAF	US	0	5	Escaped
72	2012	Herat	AUP	SAF	UK+US	3	1	Killed
73	2012	Faryab	ANA	SAF	US	0	2	Killed
74	2012	Kandahar	ALP	SAF	US	0	1	One detained, one escaped
75	2012	Paktiya	ANA	SAF	US	1	3	Two escaped
76	2012	Laghman	ANA	SAF	US	0	2	Killed
77	2012	Helmand	AUP	SAF	US	3	1	Escaped
78	2012	Helmand	CIV	SAF	US	3	1	Detained
79	2012	Helmand	ANA	SAF/RPG	US	0	6	Two killed, one detained
80	2012	Nangahar	AUP	SAF	US	0	1	Escaped
81	2012	Farah	ALP	SAF	US	2	1	Killed
82	2012	Kandahar	ANA	SAF	US	0	2	One killed, one detained
83	2012	Kandahar	AUP	SAF	US	1	1	One killed, one escaped
84	2012	Laghman	ANA	SAF	US	2	0	Killed
85	2012	Uruzgan	ANA	SAF	AUS	3	2	Escaped
86	2012	Helmand	ANCOP	SAF	UK	2	1	One killed, one detained
87	2012	Zabul	AUP	SAF	US	4	2	One killed, five escaped
88	2012	Helmand	ANA	SAF	LEB	0	6	Detained
89	2012	Wardak	ANA	SAF	US	2	3	Killed
90	2012	Kandahar	NDS	SIED	US+CAN	2	6	Killed
91	2012	Helmand	AUP	SAF (?)	UK	2	1	One killed, One escaped
92	2012	Uruzgan	AUP	SAF	US	2	0	Escaped
93	2012	Farah	ANA + AUP	SAF	ITA	1	3	One killed, one escaped
94	2012	Helmand	AUP	SAF	UK	2	0	Escaped
95	2012	Herat	ANA	SAF	US	0	0	Detained
96	2012	Badghis	ANA	SAF / GREN	ESP	0	1	Detained
97	2012	Helmand	ANA	SAF	UK	1	0	Killed
98	2012	Kabul	AUP	SAF	US	1	0	Detained
99	2012	Herat	ANA	RPG	ESP	0	0	Escaped
100	2013	Helmand	ANA	SAF/LMG	UK	1	6	Killed
101	2013	Kapisa	ANA	SAF + MG	US	1	4	Killed
102	2013	Wardak	ANA	SAF + PKM	US	2	10	Killed
103	2013	Ghor	ANA	RPG	LIT	0	2	Detained
104	2013	Farah	ANA		US	2	3	Killed
105	2013	Paktika	ANA		US	3	3	Killed
106	2013	Kandahar	ANA	SAF	SLO	1	7	Escaped
107	2013	Paktiya	ANA	SAF	US	3	1	Killed
108	2013	Paktiya	ANA	SAF	US	1	0	Killed
109	2013	Zabul	ANA	SAF	US	1	1	Killed
110	2013	Helmand	CIV		US	0	0	Killed
111	2013	Paktika	ANA		US	1	1	Escaped
112	2013	Kabul	NDS	SAF	AUZ/NZ	0	2	Killed

Note. ANSF = Afghanistan National Security Forces; CF = Coalition Forces; KIA = Killed in Action; WIA = Wounded in Action; IED = Improvised explosive device; CMD IED = Command wired IED; SVBIED = suicide vehicle-borne IED; SAF = Small arms fire; TBC = To Be Confirmed; NDS = National Directorate of Security; ANCOP = Afghan National Civil Order Police; U/K = Unknown; ANA = Afghanistan National Army; CIV = Civilian; AUP = Afghan Uniformed Police; IDF = indirect fire; RPG = rocket propelled grenade.

Appendix B

Declaration of Conflicting Interests

The authors declared no potential conflicts of interest with respect to the research, authorship, and/or publication of this article.

Funding

The authors received no financial support for the research, authorship, and/or publication of this article.

ORCID iD

Neil Shortland

Notes

References

Ahmad

(2017, 4 4). Dress like allies, kill like enemies. New York, NY: West Point, Modern War Institute.

Armstrong

(2013). With an eye open and a round chambered: Explaining the Afghan ‘Insider Threat’ and its implications for sustained partnership. Journal of Intervention and Statebuilding, 7, 1–18.

Bohannon

(2011). Counting the dead in Afghanistan. Science, 331, 1256–1260.

Bohannon

(2014). The rising toll. Science, 345, 723–724.

Bordin

(2011, 5 2). A crisis of trust and cultural incompatibility. Retrieved from https://nsarchive2.gwu.edu//NSAEBB/NSAEBB370/docs/Document%2011.pdf

Boyle

M. J.

(2010). Do counterterrorism and counterinsurgency go together? International Affairs, 86, 333–353.

Cartwright

Cooper

C. L.

(2000). HR know-how in mergers and acquisition. London, England: Chartered Institute of Personnel and Development.

Centre for Conflict and Peace Studies. (2013). Insider threat report: Understanding the motivations and contributing factors. Kabul, Afghanistan.

Condra

L. N.

Felter

J. H.

Iyengar

R. K.

Shapiro

J. N.

(2010). The effect of civilian casualties in Iraq and Afghanistan. Retrieved from https://esoc.princeton.edu/files/effect-civilian-casualties-afghanistan-and-iraq

10.

Connable

(2012). Embracing the fog of war: Assessment and metrics in counterinsurgency. Santa Monica, CA: RAND.

11.

Dadkhah

L. M.

(2008). Close air support and civilian casualties in Afghanistan. Small Wars Journal. Retrieved from http://smallwarsjournal.com/jrnl/art/close-air-support-and-civilian-casualties-in-afghanistan

12.

De Dreu

C. K. W.

Harinck

Van Vianen

A. E. M.

(1999). Conflict and performance in groups and organizations. In Cooper

C. L.

Robertson

I. T.

(Eds.), International review of industrial and organizational psychology (Vol. 14, pp. 369–414). Chichester, England: Wiley.

13.

Department of Defense. (2013). Progress toward security and stability in Afghanistan. Report to Congress in accordance with sections 1230 and 1231 of the National Defense Authorization Act (NDAA), Washington, DC.

14.

Dixon

Levine

(2012). Beyond prejudice: Extending the social psychology of conflict, inequality and social change. Cambridge, MA: Cambridge University Press.

15.

Dixon

Levine

Reicher

Durrheim

(2012). Beyond prejudice: Relational inequality, collective action, and social change revisited. Behavioral and Brain Sciences, 35, 451–466.

16.

Dyrud

Moradian

(2012). Trust fall: What’s behind the inside attacks on U.S. forces in Afghanistan? The 2014 timeline for withdrawal. Foreign Policy. Retrieved from http://www.foreignpolicy.com/articles/2012/10/02/trust_fall

17.

Gill

Horgan

Deckert

(2014). Bombing alone: Tracing the motivations and antecedent behaviors of lone-actor terrorists. Journal of Forensic Sciences, 59, 425–435.

18.

Horgan

Shortland

Abbasciano

Walsh

(2016). Actions speak louder than words: A behavioral analysis of 183 individuals convicted for terrorist offenses in the United States from 1995 to 2012. Journal of Forensic Sciences, 61, 1228–1237.

19.

Kyriakides

Virdee

Modood

(2009). Racism, Muslims and the national imagination. Journal of Ethnic and Migration Studies, 35, 289–308. doi:10.1080/13691830802586443

20.

Long

(2013). ‘Green on blue’: Insider attacks in Afghanistan. Survival: Global Politics and Strategy, 55, 167–182.

21.

Lyall

Blaire

Imai

(2013). Explaining support for combatants in wartime: A survey experiment in Afghanistan. American Political Science Review, 107, 1–20.

22.

Mayer

C.-H.

(2010). Cross-cultural business mediation: The model of identity-based managerial mediation in international management. In Busch

Mayer

C.-H.

Boness

C. M.

(Eds.), International and regional perspectives on cross-cultural mediation (Vol. 5, pp. 155–173), Studien zur Interkulturellen Mediation . Frankfurt, Germany: Peter Lang.

23.

Nadery

Humayoon

(2008, 10 4). Peace under friendly fire. The New York Times. Retrieved from http://www.nytimes.com/2008/10/05/opinion/05nadery.html?pagewanted=all&_r=0

24.

Reed

R. M.

(2013). Developing capacity or a culture of dependency: Are humanitarian assistance projects initiated by the provincial reconstruction teams reinforcing dependency or true capacity in the Paktia-Khost provinces of Afghanistan? Leavenworth, KS: Army Command and General Staff College Fort.

25.

Reinares

(2004). Who are the terrorists? Analyzing changes in sociological profile among members of ETA. Studies of Conflict and Terrorism, 27, 465–488.

26.

Roggio

Lundquist

(2012, 8 23). Foundation for defense of democracies. Retrieved from http://www.defenddemocracy.org/media-hit/green-on-blue-attacks-in-afghanistan-the-data

27.

Roggio

Lundquist

(2013). Green-on-blue attacks in Afghanistan: The data. The Long War Journal. Retrieved from http://www.longwarjournal.org/archives/2012/08/Green-on-blue_attack.php

28.

Sageman

(2013). The problem of “green on blue” attacks In Afghanistan—FPRI. Retrieved from https://www.fpri.org/multimedia/2013/05/the-problem-of-green-on-blue-attacks-in-afghanistan/

29.

Shrader

C. R.

(1992). Friendly fire: The price of war. Quantico, Virginia: Marine Corps University.

30.

Shortland

Bohannon

(2014). Civilian casualties in Afghanistan. Science, 345, 723–724.

31.

Staub

(1989). The roots of evil: The origins of genocide and other group violence. New York, NY: Cambridge University Press.

32.

Turner

J. C.

Hogg

M. A.

Oakes

P. J.

Reicher

S. D.

Wetherell

M. S.

(1987). Rediscovering the social group: A self-categorization theory. Oxford, England: Blackwell.

33.

Tupper

(2013, 3 11). What lies behind Afghanistan’s insider attacks? BBC News. Retrieved from http://www.bbc.co.uk/news/world-asia-19633418

34.

Williams

M. J.

(2015). State-building and the armed forces in modern Afghanistan: A structural analysis. International Politics, 52, 305–334. doi:10.1057/ip.2015.12