ISIS-Khorasan in Afghanistan is a real security threat. However, examining this threat without taking the Taliban’s political and security behavior into account does not provide a complete picture of the situation. The issue is not merely the presence and activities of this group, but also how the Taliban deals with it, how it uses the ISIS threat for propaganda purposes, and how this issue is connected to the group’s domestic and foreign policies. The Taliban’s behavior in recent years has shown that it exploits the issue of ISIS-Khorasan in two different ways, according to its political and security needs.
Within Afghanistan, it tries to present an image of providing security and maintaining complete control over the country. At the regional and international levels, however, it highlights the danger posed by ISIS to present itself as an essential force in counterterrorism and attracts regional and international assistance. This duality becomes more significant when we consider that, alongside raising the ISIS threat, the Taliban increasingly speaks about terrorist groups’ use of social networks—an issue that could be connected to its efforts to expand surveillance over Afghanistan’s digital space.
To understand the current situation of ISIS-Khorasan, one must look back at the group’s background over the past two decades, during the period known as the republican era. During that period, ISIS suffered heavy blows as a result of extensive operations by Afghan security forces, supported by international forces. A large part of the group’s organizational and military structure was destroyed. Its bases, although they were not permanent front-line positions, were captured in several areas, and many of its members were killed or arrested. Following these pressures, some ISIS forces retreated to the border and tribal areas of Pakistan, while part of the group’s networks continued to operate on the other side of the border.
Despite this, ISIS-Khorasan was not completely destroyed, and its networks and connections remained intact. During the same period, according to officially confirmed information, there were contacts and coordination between some elements and factions of the Taliban and the Haqqani Network, on the one hand, and ISIS members, on the other. Even some attacks in major Afghanistan cities, for which ISIS usually claimed responsibility through statements, showed traces of Taliban members or the Haqqani Network, as well as some terrorist groups such as the Islamic Movement of Eastern Turkistan, Katibat Imam Bukhari, the Islamic Party of Uzbekistan, and Ansarullah of Tajikistan, which operated in coordination with the Taliban. A clear example of this coordination was the arrest of an individual in Kabul in May 2021.
He had been preparing to carry out terrorist attacks using magnetic improvised explosive devices attached to urban vehicles, mainly in western Kabul. He was arrested by my colleagues in the Criminal Crimes Investigation Directorate of the Ministry of Interior. The suspect confessed to being a member of the Taliban, particularly the Haqqani Network, while responsibility for such attacks was usually claimed by ISIS-Khorasan. This issue shows that relations between these two groups, contrary to the simplistic image sometimes presented, have always involved complexities and various connections.
With the fall of the republic and the Taliban’s takeover of Afghanistan, the country’s security situation changed fundamentally. The collapse of the previous security and intelligence institutions, the disappearance of specialized counterterrorism structures, the emigration or sidelining of experienced security personnel, and the severing of an important part of international security and intelligence cooperation created a major vacuum in the country’s security environment. Although the Taliban claimed that, by taking control of Afghanistan, it had ended the war and established security throughout the country, in practice, it could not prevent the revival and expansion of ISIS-Khorasan’s activities. The group’s cells became active again in various parts of the country, and information about its activities is available in provinces such as Kunar, Nuristan, Nangarhar, Logar, Zabul, Jowzjan, Faryab, Sar-e Pol, Badakhshan, and Ghor.
During the five years of the Taliban’s rule, ISIS-Khorasan has carried out several deadly attacks against ethnic and religious groups such as Hazaras, Shiites, and Sufis. In some cases, several high-ranking Taliban members, including Dawood Muzammil, the Taliban governor of Balkh; Khalil al-Rahman Haqqani, an important figure in the Haqqani Network and the Taliban’s Minister of Refugees; Mawlawi Mujib al-Rahman Ansari, one of the clerics who supported the Taliban; and several others in similar cases, were killed in attacks for which ISIS-Khorasan claimed responsibility.
However, the actual role of ISIS-Khorasan in these attacks, beyond the group’s own statements, has not yet been clarified. Some experts believe that the high-ranking Taliban members who were targeted may have fallen victim to internal rivalries within the group, with ISIS being used as an instrument. Contrary to the Taliban’s claims, the security threat posed by terrorist groups has not decreased with the Taliban’s rise to power. Instead, the Taliban itself has created new conditions for armed groups to operate.
Meanwhile, the Taliban’s responsibility for the country’s security situation cannot be overlooked. By seizing power, taking control of state institutions, and dismantling the security structures of the previous regime, the Taliban assumed responsibility for ensuring security in Afghanistan. Therefore, the expansion of ISIS-Khorasan’s activities under Taliban rule is directly linked to the group’s security record.
The Taliban cannot, on the one hand, dismiss all the security achievements of the previous regime and claim that genuine security was established following the fall of the republic, while, on the other hand, attributing responsibility for the current security situation solely to external factors or enemy propaganda when confronted with ISIS attacks and activities.
The reality is that, under Taliban rule, ISIS-Khorasan has not only been able to carry out deadly attacks and maintain its networks, but has also used the emerging security gaps—which can, in fact, be described as security loopholes—to rebuild its weakened structure, reconstruct its financial system and human-resource management chain, and even expand them. ISIS-Khorasan’s regional attacks in Iran, Pakistan, and Russia are clear examples of the group’s increased capabilities.
However, the contradiction in the Taliban’s behavior is not limited to its security record. It is also clearly evident in the group’s official narrative regarding ISIS. Within Afghanistan, the Taliban consistently seeks to portray the entire country as being under its control, claims that terrorist groups have no effective presence in the country, and suggests that no threat to regional countries or the wider world originates from Afghan territory.
Yet, the same group highlights the threat posed by ISIS-Khorasan at regional and international meetings and warns of the expansion of its activities. This dual approach should be understood as part of the Taliban’s broader political and diplomatic strategy. Domestically, denying or downplaying the threat allows the Taliban to reinforce its claims of having established security and to consolidate its rule. Internationally, emphasizing the same threat enables the group to present itself as an indispensable partner in the fight against terrorism, thereby seeking greater attention, cooperation, and political and security concessions.
The statements made by the Taliban’s intelligence chief at the “Shanghai Plus” meeting in Uzbekistan about ISIS-Khorasan’s use of Telegram, TikTok, and other social networks are an example of this policy. The importance of these statements lies not only in the warning about ISIS’s propaganda activities, but also in the choice of topic and audience. The Taliban raises concerns about ISIS’s use of digital platforms while itself making extensive use of these same networks for propaganda, the dissemination of political narratives, the mobilization of supporters, the threatening and intimidation of opponents, and the influencing of public opinion. In other words, the Taliban, on the one hand, has an active and organized presence in the digital space, while, on the other hand, it presents rival groups’ use of this same space as a security threat. This raises an important question: Is the Taliban’s concern solely about ISIS’s propaganda activities, or is the group seeking to use the issue of counterterrorism to pave the way for broader control over the digital space?
To answer this question, one must pay attention to the Taliban’s propaganda structure and how the group uses social networks. After returning to power, the Taliban has extensively used media and digital tools, contrary to the image of a traditional movement lacking communication capabilities. The group has an organized presence on social networks and uses various platforms to publish official messages and political propaganda, defend its performance, and attack its opponents.
The Al-Mirsad media outlet, which is connected to the Taliban’s intelligence apparatus, is one of the important examples of this propaganda structure. By publishing content in Afghanistan’s languages and several regional and international languages, this media outlet also tries to convey the Taliban’s narrative to audiences outside the country. The activities of such media outlets show that digital propaganda is not a marginal activity for the Taliban, but rather part of the group’s organized policy for managing public opinion and advancing its political and security goals.
In recent years, the Taliban has also extensively used platforms such as X (formerly Twitter) and TikTok to publish its messages, display its power, promote its claimed achievements, and respond to critics through propaganda. There are documented reports that the Taliban’s intelligence directorate pays thousands of Afghanis to social media influencers, creates pseudonymous user accounts—often under girls’ names—and even establishes media outlets on social networks such as Facebook and YouTube that appear to be independent. Through these accounts and outlets, it produces and publishes radical content that aligns with the group’s narrative.
This extensive presence takes place while the same group has restricted independent media, put pressure on journalists, and severely narrowed the space for free information. Even recent reports indicate that a specific department within the Taliban’s intelligence directorate operates to monitor and suppress media activists. Therefore, the Taliban does not have a problem with the digital space itself. The group’s main problem is with those parts of the digital space that are outside its propaganda and security control and that provide opportunities to publish opposing views, expose government performance, and organize public protests.
After the Taliban’s takeover, social networks became one of the few spaces through which Afghan citizens could discuss the country’s political, economic, and social situation, criticize the Taliban’s policies, and inform public opinion about human rights violations and imposed restrictions. Under conditions in which independent media face censorship, threats, and restrictions, and civil protest and free political activity are not possible, the importance of these platforms for Afghan society has doubled. Social networks are not only a means of communication, but also a space for documenting and publishing the realities of life under Taliban rule and conveying citizens’ voices to the international community. For this reason, controlling this space has gained political and security importance for the Taliban.
Reports about the identification and tracking of Facebook users and the arrest of individuals who have published critical content about the Taliban reveal part of this process. Through its security and intelligence apparatuses, the Taliban monitors citizens’ online activities. In some cases, content published on social networks has become the basis for identifying and arresting individuals. Such actions show that repression in Afghanistan is not limited to restricting the media, gatherings, and political activities; it has also extended into the digital space. A citizen who, under normal circumstances, should be able to express views about the current situation in their surroundings and country without fear of arrest now faces the danger of being identified, threatened, and punished for an online post or comment.
Even some media and civil society activists living outside the country have been forced to practice self-censorship or create pseudonymous accounts because they fear Taliban retaliation against their families inside Afghanistan. One activist who now lives in America has changed the name on his user account for about six months and has removed any signs, such as a photo or text, which could reveal his identity. When I asked him why he had done this, he said, “I did this at the request of my brother and mother, who are in Kabul, because the Taliban have repeatedly threatened to arrest and torture my brother in Kabul because of what I openly wrote on social media.”
In such an atmosphere, the Taliban’s emphasis on ISIS-Khorasan’s use of social networks takes on a broader meaning. When the Taliban’s intelligence chief warns at an international meeting about ISIS’s activities on Telegram and TikTok, these remarks are not merely a security report about the propaganda methods of a terrorist group. They can also provide the political groundwork needed to request greater cooperation from technology companies and digital platforms. The Taliban can cite the ISIS threat to demand the identification of suspicious accounts, the blocking of content, the sharing of user information, and more direct cooperation between technology companies and security institutions. On the surface, such requests are made with the aim of countering terrorism. However, in Taliban-ruled Afghanistan, where there is no independent and effective oversight of the performance of security apparatuses, these tools can easily be used against ordinary citizens, journalists, civil activists, and political critics.
The main concern arises precisely at this point: tools designed to identify and curb terrorist activities are being placed in the hands of a group that is itself accused of suppressing freedom of expression and banning civil activities. If technology companies cooperate with the Taliban’s security apparatuses without legal guarantees and transparent mechanisms, users’ information and digital data could become tools for identifying opponents and expanding political surveillance. Under such conditions, the distinction between countering a terrorist threat and pursuing Taliban critics disappears, and any online activity can be interpreted as a security issue. In this way, the fight against ISIS may become a cover for expanding the Taliban’s control over citizens through the digital space.
This issue is also important within the framework of the Taliban’s regional relations. To gain international legitimacy and emerge from political isolation, the Taliban needs cooperation with regional countries. Counterterrorism, especially the fight against ISIS-Khorasan, is one of the most important areas through which the Taliban can present itself as useful and essential to these countries. Regional countries, especially China and Russia, have specific security concerns about the activities of armed groups, the spread of extremism, and the use of digital networks for propaganda and organization. By highlighting the danger posed by ISIS-Khorasan and raising the issue of the group’s activities on social platforms, the Taliban can attract greater intelligence and security cooperation. However, such cooperation, if carried out without attention to the rights of Afghan citizens and without oversight mechanisms, will certainly also help strengthen the Taliban’s repressive apparatus.
In fact, the Taliban seeks to place itself in two positions simultaneously: on the one hand, as a regime that claims to provide security and fight ISIS-Khorasan; and, on the other hand, as an actor that needs foreign cooperation and support to contain regional security threats. Within this framework, highlighting the ISIS threat in the digital space can provide two benefits for the Taliban. First, it can attract the attention and security cooperation of regional countries and technology companies. Second, it can provide the political and propaganda groundwork for expanding surveillance over citizens’ online activities. These two objectives are consistent with the Taliban’s overall policy of consolidating its power and limiting opportunities for opposition and protest.
Therefore, the issue of ISIS-Khorasan should be examined beyond a military confrontation between two terrorist groups. ISIS is a real threat, and responsibility for countering it lies with regional and global countries, according to the level of threat it poses. However, the Taliban cannot use this threat to hide its security failures, gain political legitimacy, or expand surveillance over citizens. The contradiction between denying the threat domestically and highlighting it abroad, the Taliban’s extensive propaganda activities on social networks, and its simultaneous efforts to control users and limit the voices of critics are all part of a broader picture of the group’s policies toward Afghanistan’s security and digital space.
Ultimately, the main danger is that the fight against ISIS could become a pretext for expanding digital surveillance and suppressing freedom of expression. The people of Afghanistan, who have already been deprived of political, media, and civil freedoms by the Taliban, should not also be placed entirely under the control of the Taliban’s intelligence apparatuses in the digital space. Technology companies and regional governments should also understand that cooperation with the Taliban in counterterrorism—although it may seem highly absurd, given that the Taliban itself is a terrorist group and serves as an umbrella for all terrorist groups based in Afghanistan—could lead to the strengthening of the repressive system and violations of the privacy of the Afghan people if it is not accompanied by guarantees for citizens’ digital rights. Countering ISIS is necessary. However, real security cannot be achieved by silencing the people, pursuing critics, and turning social networks into tools of political and security surveillance.
