One former NDS official said its investigation into the GRU program, which had led to arrests of a dozen members of the Azizi network, was hampered by the Afghan government for undisclosed reasons, “possibly due to corruption and other Russia-aligned interests.” Moreover, U.S. ambiguity as to the existence and nature of the program dissuaded the NDS from dedicating more counterintelligence resources to chasing it up. All that became moot when the last American soldiers boarded their C-17 cargo planes home in late August 2021. The Taliban swept back to power, and the NDS ceased to exist. Previously detained members of the GRU-run network were released, and many were exfiltrated to Russia and given new identities.
Russian attempts to recruit assets within the Taliban — and to generally destabilize the U.S. nation-building project — began almost immediately after the establishment of the Afghan Interim Administration in December 2001. Initially, the Russians sought accomplices among the preexisting networks in the local security and military apparatus established during the Soviet occupation of Afghanistan. These lost much of their utility after American-led reforms and lustration at the Afghan Defense and Security Forces (ANDSF). That’s when Russia turned to Iran for help, according to the former NDS officials. The Islamic Revolutionary Guards Corps (IRGC) acted as go-between for Moscow and the Taliban commanders, funneling Russian weapons and money to them. Subsequently, the GRU established direct contacts with the Pashtun insurgency.
The contours of this three-way relationship were limned by Gen. John Nicholson, the commander of U.S. forces in Afghanistan, in a BBC interview in March 2018. Nicholson alleged that Russian weapons smuggled into Afghanistan from neighboring Tajikistan were finding their way into Taliban hands. He further accused Russia of inflating the number of Islamic State jihadists in Afghanistan in order to “legitimize the actions of the Taliban and provide some degree of support to the Taliban.” In December 2016, Nicholson stated that both Russia and Iran had established ties to the deposed Islamist government.
In mid-August 2020, the Trump administration leaked intelligence to CNN suggesting that a foreign government was responsible for paying bounties to Taliban fighters linked to the Haqqani Network, an autonomous outcropping of the Taliban led by Afghan warlord Siraj Haqqani, the son of an anti-Soviet guerrilla once supported by the CIA. The U.S. “identified payments linked to at least six attacks carried out by the militant group just last year alone,” including the December 2019 assault on Bagram. Though the foreign government in question remained classified, two U.S. sources told CNN it was not Russia but Iran that had paid for this operation. Tehran’s alleged subvention was cited as one reason Trump decided to assassinate Gen. Qassem Soleimani, the head of the IRGC’s expeditionary arm, the Quds Force, in a missile strike near Baghdad International Airport in January 2020.
The Quds Force under Soleimani’s command financed and oversaw a long-running campaign of pro-Iranian militia attacks on U.S. forces in Iraq, which the Pentagon estimated killed more than 600 American servicemen.
According to Charles Kupperman, a deputy national security adviser during Trump’s first term, “the issue of bounties [in Afghanistan] is foggy concerning the Russian-Iranian relationship.” He added that there was an unwritten rule in the Trump White House not to attribute malign activity to Russia so as to avoid antagonizing the president, who was outspoken in his praise for his Russian counterpart.
“Everyone had a pretty good suspicion that there were Iranian and Russian plots to kill our forces in Afghanistan,” Kupperman told The Insider. “But it was always going to be easier to publicly pin the blame on Iran because of Trump’s reluctance to take a hard line with Putin. And our intelligence community didn’t want to face the perennial question of, ‘Okay, the Russians are hurting us, so what are we going to do about it?’”
Douglas London said that during his time at CIA he saw the Iranians “hedging their bets. They have no love for the Taliban, but as they saw the Taliban doing better, particularly out west where the Iranians have interests and access, Tehran started to reach out more to the Taliban. They provided military aid. They were dealing with individual Taliban commanders who were more proximate to them.”
The route Nicholson described, which saw Russian materiel pour into Afghanistan from Tajikistan, was hardly a coincidence.
Unit 29155 maintains a forward operating presence at Russia’s 201st Military Base in Dushanbe. When Biden met with Putin at their summit in Geneva in June 2021, Putin trolled the American president by teasingly offering to allow U.S. counterterrorism forces to be hosted at the 201st after the American pullout from Afghanistan, according to former U.S. Ambassador to Russia, John J. Sullivan. “As Putin chuckled, General Gerasimov’s eyes widened,” Sullivan wrote in his recent memoir, Midnight in Moscow, referring to Russia’s Chief of the General Staff. “This clearly was an unscripted moment and an apparent effort at humor by Putin, because it was so utterly improbable, and indeed there was never any follow-up.”
The former NDS officials said that there had been consensus in the country’s security circles about Russia’s destabilizing role in supporting the Taliban against the ANDSF and coalition forces. That consensus was apparently shared by the CIA’s expansive Kabul Station. The tricky part was predicting where pure espionage and influence operations ended and covert action began.
Between June and August of 2020, the New York Times ran a series of stories about the GRU paying the Taliban to kill American troops. Based on interrogations of Taliban detainees and electronic intercepts showing “large financial transfers from a bank account controlled” by the GRU to one linked to the Taliban, U.S. intelligence attributed the program to Unit 29155. That in itself was a big clue as to the purpose of these transactions, as the Russian black ops unit engages exclusively in kinetic operations: assassinations, coups, sabotage, and cyberattacks. Unit 29155’s recruitment of foreign assets, such as a family of “illegals” in the Czech Republic or a group of paramilitaries in Montenegro, is done in pursuit of those activities.
The Insider has spent over a decade anatomizing and unmasking members of this special operations team, finding it responsible for multiple poisoning — of the Skripals, of a Bulgarian arms dealer, and of the arms dealer’s son and factory manager — and also of carrying out an abortive insurrection in Montenegro, along with bombings of ammunition depots and arms storage facilities across Bulgaria and Czechia. Earlier this month the European Union issued sanctions against Unit 29155 as a whole and against its commander, Andrey Averyanov, individually.
In late 2022, Unit 29155 was subsumed, along with two other sub-units dedicated to the GRU’s bespoke form of clandestine warfare, under the umbrella of a new organization. Its name is the Department for Special Activities, an apparent homage to a notorious Soviet-era KGB Department for Special Tasks, which was in charge of, among other things, the murder of Ukrainian nationalists in Europe and of Leon Trotsky in Mexico.
Uncut gems
The NDS uncovered the GRU-Taliban program in mid-2019 during interrogations of detainees. Afghan officials, the Times noted, had arrested suspected middlemen involved in the payments program — they were using the Afghan hawala system of informal money transfers to move the Russian cash to its intended recipients. “The money had been initially transferred to Tajikistan, China, and Pakistan, and then to Afghanistan,” one of the former NDS officials said.
Afghan intelligence launched a series of raids in 2019 in Kabul and northern Afghanistan, seizing “about $650,000” in the home of Rahmatullah Azizi, who had already escaped back to his base in Russia. Three former NDS officials told The Insider that all of the detained suspects hailed from the Afghan provinces of Kabul, Logar, or Kunduz. Their role had been that of couriers working on behalf of the GRU, which set up various firewalls to prevent the collapse or disclosure of the whole program in the event that one or several members were ever captured.
The U.S. intelligence community was not divided as to the fact that the GRU was sending money to the Taliban, nor on the topic of what NDS detainees were claiming in custody. Instead, the debate regarded the purpose of this operation. The CIA and the National Counterterrorism Center shared a “moderate” confidence that it constituted a fee-for-murder arrangement, “moderate” being a term of art used in the intelligence community indicating that “information is credible and plausible but not corroborated sufficiently to justify a higher level of confidence,” according to the Director of National Intelligence. The National Security Agency, which deals in signals intelligence, had “low” confidence, suggesting information is “scant, questionable, or very fragmented, so it is difficult to make solid analytic inferences.”
“There was no debate on what Russia was providing or that the Taliban used it in attacks against the U.S.,” Douglas London told The Insider. Part of the problem, as he saw it, was the sensationalism and inexactitude of the “bounties” allegation, which sounded like a plotline out of High Noon. The word the intelligence community preferred was “payments,” according to London, who affirmed the existence of the program — and Trump’s awareness of it — in a New York Times op-ed that ran in July 2020 after being cleared by the CIA’s Prepublication Classification Review Board. Another issue within the intelligence community was the veracity of what Taliban detainees told the NDS under interrogation, even if their statements broadly conformed to what U.S. signals intelligence had collected on GRU payments.
In a series of interviews with The Insider, London characterized what the GRU was doing as a “strategic incentives program” aimed at refocusing the Taliban’s guerrilla terrorism against Americans. The overriding objective, he said, was to erase the United States’ military and intelligence footprints in Central Asia, a region Russia considers to be within its own sphere of influence. This meant driving U.S. and NATO troops out of Afghanistan. The program developed gradually, but ultimately expanded into proxy warfare as Putin became increasingly hostile to Washington over the last decade.
In 2009, the Obama administration got Putin to agree, in principle, to allow the Pentagon to transit troops and weapons to Afghanistan using Russian airspace and rail systems. But the policy was only fitfully implemented. In 2014, as a winter protest movement in Ukraine gave way to Russia’s seizure of Crimea and its sponsorship of a dirty war in Donbas, the Kremlin pressured Kyrgyzstan to vacate the Manas Transit Center, a critical logistics hub that the U.S. Air Force had used to service operations in Afghanistan since 2001.
The NDS was able to identify the courier network’s ringleader, the aforementioned former Kunduz-based smuggler Rahmatullah Azizi, who is cited fleetingly in one of the New York Times articles on the GRU payments program. Azizi had been running a company in Afghanistan, registered in his father’s name, that specialized in the trading of precious and semiprecious gemstones. The NDS suspected that at least part of the GRU’s money was being smuggled into the country in gems in order to lend it a commercial veneer of plausible deniability. Afghanistan is home to as much as $1 trillion worth of mineral deposits, according to the U.S. government, and lately the Taliban has begun to ramp up foreign direct investment, including from Russia, in mining rights.
