American and possibly British, Norwegian, and Australian special operations forces (SOF) were part of the reaction force that responded to the maternity ward attack in Kabul (Afghanistan) on 12 May 2020, according to Social Media Intelligence (SOCMINT). In the early hours of Tuesday, unidentified gunmen disguised as police officers stormed the Barchi National Hospital in Kabul. The attackers killed 24 people, including medical personnel, patients, and even two newborn babies. 



THE TIER ONE COUNTER-FORCE

In the SOF counterattack that ensued, the foreign and Afghan operators of the Crisis Response Unit (CRU) 222 managed to rescue 100 women and children, including three foreigners.

SOFs regularly operate without national identification and wear masks to conceal their identity for operation security (OPSEC) reasons and to preserve political deniability. Yet, there are still plenty of elements that can help identify a SOF group’s nationality, such as uniform camouflage patterns, gear, weapons, accessories, and other equipment pieces. 

Twitter users with knowledge of tactical equipment have recognized the country and units of the SOFs deployed on-site. As the tweets below show, one of the first special mission units identified is the Combat Applications Group(CAG) or 1st Special Forces Operational Detachment-Delta (SFOD-D), which is more commonly known as “Delta Force.” Specializing in counter-terrorism, hostage rescue, and counter-proliferation, Delta is among the most secretive and lethal American SOF groups.

Twitter users recognized the American SOFs by their distinctive night-vision goggles (NVGs), custom pistol stock, pouch, and holster.  Social media speculations also place British SOFs, likely the Special Air Service (SAS) alongside Delta in one of the photos.

The Norwegian Forsvarets Spesialkommando (FSK) is another foreign SOF group recognized by Twitter users. While less known than its anglophone counterparts, the FSK is one of the most experienced NATO special mission units. Besides Afghanistan, they also operated, and are probably still active in Syria and Iraq.  

As Twitter users pointed out, at least one Australian SOF was also present during the counter-terrorist raid. If indeed from the land down below, the operator was likely part of the Special Air Service Regiment (SASR), Australia’s equivalent of the British SAS. Australia is one of NATO’s closest strategic partners. Australian SOFs have seen extensive service alongside their Euro-Atlantic allies in the Global War on Terror.  

RESOLUTE SUPPORT MISSION 

Regardless of their exact unit or nationality, it is virtually certain that foreign SOFs played a significant role in neutralizing the terrorist threat in Kabul. Without them and their Afghan counterparts, the death toll would have been dramatically higher. 

The foreign SOFs are in Afghanistan as part of their respective national military deployments. Their objective is to conduct counter-terrorism missions and train, advise, and assist the Afghan National Army and Security Forces (ANASF). 

RSM Commands via NATO

Following the end of major combat operations, NATO initiated the Resolute Support Mission at the invitation of the Afghan government in 2015. RSM is a capacity-building operation and consists of 39 NATO and non-NATO participating states. RSM advisors train the Afghan National Army (ANA) and Air Force (ANAF) so that Kabul can defend itself after the end of NATO’s military mandate. The RSM also helped the ANA build its first-ever SOF component, including the Crisis Response Unit 222, that spearheaded the response to the maternity attack. 

Afghan CRU 222 operators via Recoilweb.com

Apart from the RSM, the U.S. SOFs are also engaged in Operation “Freedom’s Sentinel,” an overseas contingency counter-terrorism mission against ISIS’s regional franchise, the “Islamic State-Khorasan” (IS-K).

IS-K LIKELY BEHIND THE ATTACK

While the horrific attack is still unclaimed, “Islamic State-Khorasan” (IS-K) is the likely culprit. The Dashti Barchi Hospital sits in a predominantly Shia neighborhood – an area that IS-K has also attacked in the past. 

Afghan intelligence has captured the IS-K commander and two of his aides in Kabul, just a day before the attack. The senior operatives were likely in Kabul to oversee the execution of the mission. 

Another circumstantial piece of evidence linking the massacre to IS-K was a second attack on 12 May 2020. A suicide bomber killed at least 32 people at a funeral in Nangarhar province. While Afghanistan experiences sporadic countrywide violence daily, the funeral and hospital attacks may be connected. 



Shiite communities are IS-K’s main targets apart from political institutions, according to our assessment from 2019, which you can find here. The attack is consistent with IS-K’s strict interpretation of Sunni Islam, militant Salafism, which views Shiites and other Muslim sects as heretics. IS-K uses sectarian and takfiri violence to mobilize hardcore Salafists/ Deobandi and establish an Islamic State in South Asia, encompassing Afghanistan, Pakistan, and the Kashmir region. 

IS-K has refrained from taking credit for its attacks in the past. In this case, the unclaimed attack on the maternity ward likely aimed at sabotaging the Afghan-Taliban peace process. By not claiming the attack, IS-K wanted to cast suspicion on the Taliban. IS-K has no interest in seeing a reduction of violence in Afghanistan. IS-K consists of disenfranchised Pakistani Taliban, splinter groups from the Islamic Movement of Uzbekistan (IMU), and a few foreign fighters. The Taliban is not only IS-K’s main competitor on the extremist market but also its existential threat. 

Afghanistan conflict map as of 29 February 2020 via Al-Jazeera

The Taliban has publicly denied involvement in the attack. While many Taliban cells continue to defy the “reduction of violence” agreement with Kabul, it is unlikely that the group was involved in the maternity ward massacre. Afghan President Ghani has nevertheless ordered the Afghan military to resume offensive operations against all militant groups in Afghanistan, including the Taliban. President Ghani was likely concerned to look weak in the face of Tuesday’s bloodbath in the center of Kabul. 

The Afghan peace process remains as fragile as always. 

Incident Response Team
Latest posts by Incident Response Team (see all)
Incident Response Team

Related intelligence:

Russia: Novatek’s Ust-Luga Gas Complex under Drone Attack (Damage and Effects) Moldova & Transnistria Security Update #13 (December)