Afghan Airlift and Taliban Takeover As Seen Through OSINT
Amid the Afghan government’s collapse and subsequent Taliban takeover of Kabul, it was a race against time for the U.S. and NATO allies to evacuate their citizens, and Afghans at risk, out of the country.
The result? Over 120,000 civilians were extracted in nearly two weeks, making it the largest airlift operation ever recorded. For many reasons, the Afghan airlift was a historic and dramatic event, and thanks to Open-Source Intelligence (OSINT), we were able to follow the evacuation as it unfolded.
Here’s our TOP FIVE tools used to monitor the Afghan airlift.
5. TRADITIONAL NEWS REPORTING
Boots on the ground remain an invaluable asset even in today’s OSINT-permissive information environment. Local correspondents and on-the-scene reporters like CNN’s Clarrisa Ward had braved the Taliban’s medieval crowd control and lived under the constant threat of IS-K terror attacks to deliver a definitive account of the situation in Kabul.
As an OSINT analyst, it’s your job to take the open-source information (OSINF), even that sourced from the press, and bring it to the next level: intelligence.
#Afghanistan #Kabul @CNN‘s @clarissaward interview of so called senior #ISIS_K SS commander geolocated.
Hotel location: 34.536182° 69.129601° pic.twitter.com/eDBFu7RUjh
— Col卫纳夜格.巴特(Retd) @Raj47 (@rajfortyseven) August 29, 2021
4. SATELLITE IMAGERY
What better way to understand the situation on the ground than by looking at Hamid Karzai International Airport from space? At first glance, open-source GEOINT was not as impactful as it was in other events. Analysts needed on-demand very high-resolution (VHR) imagery to observe the crowds gathered at Kabul airport, which is not freely available. However, Maxar Technologies was kind enough to publish some VHR shots showing clogged intersections and crowds occupying the runway at Kabul airport.
New high-res #satellite imagery (10:36 am local time, August 16) of the chaotic scene underway at #Kabul’s Hamid Karzai International Airport in #Afghanistan as thousands of people converged on the tarmac & airport runways as countries attempt to evacuate personnel from the city. pic.twitter.com/L6lhlVms54
— Maxar Technologies (@Maxar) August 16, 2021
High and medium resolution imagery was still useful for a number of purposes like spotting aircraft on the tarmac and gaining situational awareness.
Situational awareness means understanding your environment, and often comes up in connection to OSINT. Satellite imagery of almost any resolution is helpful when trying to profile an area for whatever reason. Say, for example, you were one of those private rescue groups that flew into Kabul to extract company employees or Afghans at risk. In that case, satellite imagery would have been vital to plot the mission: understanding the road network – spotting choke points and shortcuts – and minimizing exposure.
This also applies to when you’re thousands of kilometers away and just want to show your audience the lay of the land.
3. LIVE STREAMS
News organizations and private citizens had set up shop on Kabul’s northern hilltops and pointed their cameras at Hamid Karzai International airport. The objective? Provide a constant live feed of the airport. The live streams were accessible on Facebook and Youtube.
OSINT analysts leveraged these feeds to spot “ghost flights” (aircraft that don’t appear on plane trackers) landing in Kabul. Many of the cameras pointed at the airport had long lenses allowing for easy observation of air and ground activity. One could identify aircraft by their air force insignia painted on the tail, and, after August 31st, viewers could spot Taliban cars sprinting on the runway.
Like any OSINT resource, the live feeds didn’t reveal answers themselves. But with a bit of time investment, persistence, and some cross-referencing, you – the analyst – could draw some interesting conclusions.
2. FLIGHT TRACKERS
It’s like flight trackers were invented for this event. Anyone with access to the internet could leverage this awesome capability to monitor and analyze air traffic connected with the Afghan evacuation.
Aviation aficionados have compiled lists of flights and aircraft involved in the air bridge from Kabul to the Gulf states. The example attached shows just one list from August 16th, which documented over 100 flights.
#KabulAirlift – Aircraft Tracking Sheet – Version 1.4 (18:15BST 16/08/2021)
Data collected via @flightradar24, @ADSBexchange and @planefinder
Created with help from the amazing @vcdgf555 (go give them a follow if you don’t already!)#Afghanistan #Taliban pic.twitter.com/qjNWeV25w5
— DefenceGeek (@DefenceGeek) August 16, 2021
Some analysts went the qualitative way and chose to focus on individual aircraft or flight groups.
One could have tuned in any time and noticed a flock of cargo planes and aerial tankers moving in synchrony from Qatar, and other Gulf states, to Kabul, via Pakistani airspace (and vice-versa).
Another option was to zoom in on Kabul. There you would have spotted one or two aircraft flying in a holding pattern (doing donuts), awaiting permission to land. Some had to wait for over an hour to land. Others never got to land and nearly ran out of fuel. The latter aircraft had to be rerouted to third countries to refuel. (*cough cough* German Air Force A400 in Uzbekistan).
Who could blame ATC? In the end, there were five guys in a tent.
1. SOCIAL MEDIA (ESPECIALLY SNAPMAP)
Flight trackers and Snapmap almost deserve to share the first spot. But I’m giving Snapmap the #1 position for the unique role it played in this entire conundrum. Afghans at the airport used Snapmap (and overall social media) to broadcast an up-and-personal account of their tragedy.
Outside Kabul airport. Source: SnapMap. #kabulairport #Kabul pic.twitter.com/p3CnHDgLRK
— Som Patidar / सोम / سوم (@patidarsom) August 19, 2021
Throughout late August, shocking videos of people flocking the runway and falling from airplanes emerged on social media, either on Snapmap (reshared on Twitter), TikTok or Twitter. Other videos showed Taliban fighters beating people that were trying to reach the airport, and the aftermath of the IS-K bombing near Kabul airfield.
Scenes of absolute desperation in #Kabul airport today: Afghan civilians chase & cling to US C-17 plane in last attempt to flee Afghanistan.
At least one body fell from aircraft wing, after a stampede by runway. Very dark moment for country: pic.twitter.com/PrNqsHo0Wc
— Joyce Karam (@Joyce_Karam) August 16, 2021
While the Afghan airlift ended on August 31st, this will not be the last international event to be heavily monitored using OSINT techniques and tools, rather this is the norm.
As more ways of observing air, ground and sea activity will likely emerge in the next years, all aspiring analysts or researchers should be well versed in OSINT collection and analysis.
by Vlad Sutea