S E C R E T // NOFORN // 20320915

JTF-GTMO MATRIX OF THREAT INDICATORS
FOR ENEMY COMBATANTS

(S//NF) Below are indicators used in JTF-GTMO detainee assessments to determine a
detainee‟s capabilities and intentions to pose a terrorist threat if the detainee were given
the opportunity. The indicators are not all-inclusive and are written primarily with the
JTF-GTMO detainee in mind, though they can be tailored to other theaters. These
indicators are used in assessments in concert with each other, and need to be read in the
context in which they are placed within an assessment. While some individual indicators
may be sufficient alone to provide an accurate assessment of the detainee‟s threat, others
may require additional indicators or multiple occurrences of the same indicator for
reliability and confidence. In all, the indicators are designed to point to the threat a
detainee would pose if he were to be released from custody, and the intelligence that a
detainee potentially possesses, not as evidence to prove a detainee’s guilt or innocence.
(U) How to use these indicators
(S//NF) JTF-GTMO primarily uses three types of indicators to assess a detainee: 1) the
detainee himself provides acknowledgement of a fact; 2) another detainee, document,
government, etc. provides an identification of the detainee; and 3) analysis of the
detainee‟s timeline, activities, and associates in context with other known events and
individuals. A fourth method may be available for a few select detainees in their SCI
addendum, where special intelligence provides more specific information about a
detainee.
Examples of these three types of indicators are:
o 1) The detainee admitted being in Tora Bora;
o 2) ISN 252 identified detainee from Tora Bora;
o 3) Detainee claimed he met a group traveling to Pakistan and joined them
and was eventually captured with them. Analysis will show that the
detainee‟s statements describe the events of the escape from Afghanistan
and subsequent capture of the large al-Qaida force that was led out of Tora
Bora by Ibn al-Shaykh al-Libi, which indicates the detainee was in Tora
Bora with this group.
(S//NF) Many indicators can provide support to several categories, though they may not
be listed separately under each category. For instance, capture details can provide
indicators for membership and affiliation. They can also provide indications of
participation in and support to hostilities, and indications of past or intended acts of
aggression in support of or as a member of an organization. Sub-bullets in JTF-GTMO
assessments are provided as indicators and supporting intelligence for an overall

S E C R E T // NOFORN // 20320915

 S E C R E T // NOFORN // 20320915
assessment articulated in the primary bullet under which they fall, and should not be
considered in isolation from the assessment they support.
(S//NF) For instance, the assessment that a detainee is a member of al-Qaida may be
supported by three bullets stating his name was found on al-Qaida documents, another
detainee identified him as a fighter on the front lines, and he acknowledged receiving two
weeks of training at al-Faruq. Taken in isolation, receiving training at al-Faruq does not
necessarily prove the detainee was a member of al-Qaida. When considered with the
other two bullets, however, it is a valid supporting statement that the detainee was a
member of al-Qaida, and together they create a strong level of confidence in the
assessment. At the very least, receiving training at an al-Qaida camp indicates affiliation
with and support for that organization.
(S//NF) HUMINT information – the primary source of intelligence for the assessments –
is most often single-source. Single-source reporting about one indicator, when combined
with other indicators, can provide sufficient details for analysis and assessment.
However, these assessments are tempered by analysis of HUMINT sources‟ potential
efforts to mislead US intelligence collectors. A HUMINT source may provided
misleading information for a number of reasons, such as out of a desire to discredit a
detainee, to protect a detainee, or to protect the source himself against incrimination
through association – some sources may only be able to provide incriminating
information about a detainee by indicating they themselves were in an incriminating
situation.

(U) Capture
(S//NF) Details of the detainee‟s capture can provide indicators of membership and
participation in or support to hostilities against US and Coalition forces.
Transferred to US custody following hostilities on suspicion of extremist
membership or on suspicion of participation in or support to hostilities
Captured by US or Coalition forces during or immediately following hostilities1
Captured with a weapon or reported in possession of a weapon shortly before
capture
Sustained wounds before or during capture
Capture while attempting to cross the border or at a checkpoint
Captured attempting to enter Afghanistan following 11 September 2001
Surrendered to Pakistani authorities2
Captured by local villagers or in a hospital, such as several wounded al-Qaida
fighters transferred to JTF-GTMO, and turned over to authorities
1

“US or Coalition forces” indicate any forces either controlled by the US or cooperating with the US in
Afghanistan
2
At times detainees have claimed to have “surrendered” as a show of their peaceful intentions and
cooperation, when in fact they were captured through force or the threat of force.

S E C R E T // NOFORN // 20320915

 S E C R E T // NOFORN // 20320915
Captured by US or Coalition forces in a raid on a suspected compound or safe
house. The raid may have followed a tip-off of detainees or his associates‟
activities, or based on suspicion about the occupants or the facility itself.
Captured abroad by foreign government law or intelligence officials
Captured in disguise or in the company of disguised individuals, or members of
detainee‟s group used disguises to facilitate their escape
Captured with other al-Qaida or extremist group members, including identified
detainee groups:3
o Front line fighters - surrendered to or captured by Northern Alliance General
Dostum‟s forces4
o “Dirty 30”5
o Captured in Afghanistan/Pakistan border regions with a group of Arabs
around the November 2001 through February 2002 timeframe6
o Karachi 6--detainees captured on 11 September 2002 in Karachi safe houses
o Algerian 6
o Syrian detainees
o Abu Zubaydah‟s Faisalabad safe houses detainees
Operated or captured in an area dominated by al-Qaida or Taliban forces or
network operatives, or a key battle/campaign area including, but not limited to:
o Gardez, AF
o Kabul, AF, especially the Wazir Akbar Khan district
o Kandahar, AF
o Konduz, AF
o Khwaja Ghar, AF
o Mazar-e-Sharif, AF
o Taloqan, AF
o Tora Bora, AF7
o Zormat, AF
3

Detainees, who give substantially different accounts of their capture from the accounts of other detainees
with whom they were captured, or from additional reporting on the event, are assessed to be withholding
information possibly to protect themselves or others.
4
These Northern Alliance forces captured hundreds of Taliban, al-Qaida, and associate forces in the
Mazar-e-Sharif area following their rout on the front lines in Northern Afghanistan due in part to US
bombardment. Northern Alliance forces took the majority of the detainees to the Qala-i-Jangi fortress,
which was used as a holding facility. The combatants held at Qala-i-Jangi staged a violent uprising in late
November 2001. (see Deception at Qala-I Jangi Prison - USSOC - May 2005)
5
For additional information on the “Dirty 30” and the intelligence value of bodyguards, see Bodyguard
Profile INTSUM 23-OCT-2006 in JDIMS.
6
This time frame corresponds to the primary exodus from Afghanistan by al-Qaida and affiliate extremist
forces seeking to escape US and Coalition engagements. This includes the forces led out of the area by
UBL-appointed military commander in Tora Bora, Ali Muhammad Abdul Aziz al-Fakhri, aka (Ibn alShaykh al-Libi), ISN US9LY-000212DP. A large number of al-Qaida network forces were captured in
Tora Bora and along the Afghanistan-Pakistan border, or just inside Pakistan after they fled the hostilities
in Tora Bora. Many claim that they were simply passing through the area. However, other reporting places
them in fighting positions in the region prior to their attempted escape. For more information, see the
“Withdrawal from Tora Bora Analysis” in JDIMS.
7
ISN 252 stated a detainee was free to continue to Pakistan but decided to join the mujahideen and travel to
Tora Bora. He added, “If you were in Tora Bora, you were not innocent, you were there to fight.”

S E C R E T // NOFORN // 20320915

 S E C R E T // NOFORN // 20320915
Travel documents:
o Captured without documentation citing the loss, theft, or inability to retrieve
documents8
o Captured with false, forged, unauthorized or illegally obtained, or altered
documents
o Captured while awaiting receipt of travel documentation
At time of capture, detainee was in possession of a suspicious item such as:
o Casio watch (F-91W)9
o High-tech electronics10
o Military radio/transceiver (indicates a position of leadership)
o Satellite phone
o Large sums of money
o $100 US bill(s)11
o Information on al-Qaida facilitators (hand-written pocket litter (personal
effects))
o Information about other detainees (indicates an association with the detainees)
(U) Foreign Fighter, Commission of a Belligerent Act, Participation in Hostilities
(S//NF) The main focus of these indicators is on combat activities, though support for
such activities constitutes participation in hostilities, including either a completed act or a
demonstrated intention. JTF-GTMO defines the term fighter as a combatant who
participated in hostilities, attended training in preparations for hostilities, or who traveled
to the region with the intent of participating in hostilities. JTF-GTMO defines hostile act
as participation in armed conflict, or an individual‟s voluntary presence at a location at
which combat operations occurred, such as the front lines of battle or the Tora Bora
Mountains.
Detainee admitted participating in hostilities
Detainee attacked US or Coalition forces

8

Some fighters were directed to discard their passports during the egress. Others were informed to give
their passport to an individual who would attempt to smuggle the passports across the boarder to give to the
fighters at a later date. This was conducted in order to protect the individual‟s identity if captured.
9
(U//FOUO) The possession of a Casio F-91W model watch and the silver-color version of this model, the
A159W, is an indicator of al-Qaida training in the manufacture of improvised explosive devices (IEDs). A
JTF-GTMO identified the Casio watch as “the sign of al-Qaida, [which] uses the watch to make bombs.”
The Casio was known to be given to the students at al-Qaida bomb-making training courses in Afghanistan,
at which the students received instruction in the preparation of timing devices using the watch.
Approximately one-third of the JTF-GTMO detainees that were captured with these models of watches
have known connections to explosives, either having attended explosives training, having association with
a facility where IEDs were made or where explosives training was given, or having association with a
person identified as an explosives expert.
10
In cases where a detainee‟s background and training are not directly related to electronics, such items can
be an indicator of association with IED detonators.
11
A detainee without a job and in Afghanistan for any significant length of time is unlikely to have a $100
US bill. It is known that al-Qaida leadership passed out $100 US bills to assist the fighters when they fled
Afghanistan.

S E C R E T // NOFORN // 20320915

 S E C R E T // NOFORN // 20320915
Identified by other detainees or government agencies as having participated in
hostilities
Identified as a fighter (mujahid, “brother”)
Identified as carrying a weapon during hostilities12
Identified as serving in a leadership role during hostilities, including carrying
communication equipment during hostilities
Identified as providing logistical support, weapons, facilitation, or finances to
personnel or forces engaged in hostilities
Identified being at the front lines or other known battlegrounds, such as Tora Bora
Identified as voluntarily being in a location of hostilities (such as to visit a
relative)
Surrender or captured on the front lines or following hostilities
Travel for or shows commitment to violent jihad13
Travel to Afghanistan or Pakistan after 11 September 2001
Detainee is a non-Afghan and was in Afghanistan (or attempted to enter
Afghanistan) after June 200114
Received or sought weapons training in Afghanistan or Pakistan, often at an alQaida affiliated camp or on the battle front
Use of a common cover story, or unsubstantiated timeline and activities in
Afghanistan or the surrounding countries (cover stories are discussed in more
detail under al-Qaida)
Identified as a fighter in another jihad such as Bosnia and Herzegovina or
Chechnya
(U) General Membership Indicators
(S//NF) The following lists general indicators that can be applied to identify a detainee‟s
affiliation or membership in an organization. Membership and willful affiliation are also
direct indicators of support by the detainee to the organization. JTF-GTMO defines
member of or membership in as an individual within a social group, participating in the
group, or acting on behalf of the group to reach a common goal for the benefits and
interests of the participants; sharing certain characteristics, expectations, obligations with
other group members; receiving support from the group; or operating under a shared
12

Al-Qaida and other extremist organizations use the term “brother” to identify a member or associate of
their organization. It is synonymous with the term mujahid when discussing hostilities. Mujahid (plural
mujahideen) is the Arabic term for religious fighter, often seen in reporting as jihadist.
13
(U//FOUO) Detained “shoe bomber” Richard Reid stated, “Muslims who say that jihad has nothing to
do with violence or the defense of Islam, were not true Muslims. Linguistically, jihad translated into
English as „struggle.‟ However, the sharia [Islamic Law] definition of jihad, which allows for violent
combat, was not the same as the linguistic translation.” He also noted, “The current jihad being waged by
al-Qaida and other mujahideen was a defensive jihad…. Any Muslim who does not acknowledge that the
world was currently in a state of defensive jihad, in which participation was mandatory, was either ignorant
or a hypocrite.”
14
Although similar to the post 11 September travel, this is an independent indicator that, while not
determinative, can be linked to other indicators to provide a more accurate assessment. Attempted travel
into Afghanistan, even if unsuccessful, is an indicator of support to those forces that were participating in
hostilities.

S E C R E T // NOFORN // 20320915

 S E C R E T // NOFORN // 20320915
hierarchy of leadership.15 JTF-GTMO defines the term associate or association with as
an individual who had a working or personal relationship with a member of an
organization, or who participated in activities with or on behalf of an organization, but
who is not himself categorized as a member of that organization. These individuals are
often members of another allied terrorist organization. An example of an associate based
on this definition would be a facilitator who provided the travel arrangements or forged
documentation for a member of another organization.16
(S//NF) A detainee‟s admission of membership in a terrorist group, particularly al-Qaida,
is taken as sufficient evidence of that membership. However, where such an admission is
absent, multiple identifications by other sources that a detainee was a foreign fighter in
Afghanistan provide corroboration and a high degree of reliability and confidence in the
assessment that a detainee was affiliated with a group supporting foreign fighters, though
such corroboration is not necessarily a requirement for an assessment.
Admitted membership or identified as a member by other associates, members,
media, or documents
Facilitated, recruited, or provided other support to the organization or its members
Affiliated with known members of the organization, especially if claimed
associations to other non-members cannot be confirmed
Detainee has familial ties to a terrorist organization, or non-governmental
organization that supports terrorism
Occupied facilities operated by, or on behalf of, the organization
Engaged in activities for which the organization is known
Shares a common ideology or political goals with the organization
Operated or captured in or around an area of where a terrorist organization was
active during the relevant time frame
Captured or arrested while attempting to cross and international border illegally
(i.e., US-Mexico or Afghanistan-Pakistan) due to extensive extremist use of false
documents or other surreptitious means such as avoiding boarder posts or
traveling in disguise
Attempted US entry through legal means (but denied), especially with a poorly
developed story for purpose of US visit as in the case of ISN SA-063, a 20th 11
September hijacker17
Non-cooperative at GTMO18
15

Swearing bayat( oath of allegiance) to Usama Bin Laden (UBL) or being identified as a member of alQaida by Khalid Shaykh Muhammad, for instance, is not the sole basis for supporting a determination of
membership in al-Qaida..
16
The term affiliate or affiliation identifies an individual who was a either a member or an associate of an
organization. This includes an individual that was a member, had a working or personal relationship with a
member, or participated in any activities with an organization.
17
See information relating ISN 063 in “911 Staff Report on Terrorist Travel 21-AUG-2004” in JDIMS.
This document provides details on his attempted US entry as well as his passport.
18
Cooperation is rewarded and is explained to the detainee as his best path to repatriation. Noncooperation is seen as an indicator that the detainee is willingly withholding information of law
enforcement and intelligence value in support of the detainee‟s assessed affiliate organizations and personal
associates who may still be at large and fighting against US and Coalition forces. The detainee‟s

S E C R E T // NOFORN // 20320915

 S E C R E T // NOFORN // 20320915

(U) Member of, or affiliation with, al-Qaida and the al-Qaida Network
(S//NF) The following provides the primary indicators for assessing a detainee‟s
membership or affiliation with al-Qaida.
Identification
o Detainee was identified as or admitted membership in al-Qaida
o Detainee‟s name or alias was found on al-Qaida membership lists, computer
hard drive, other electronic media, or documents found with known al-Qaida
or support elements; or on media or documents which identify al-Qaida
personnel or support elements
o Name found on receipts or associated with al-Qaida equipment or facilities
owned, rented, or used by al-Qaida.
o Name found in US Government or international intelligence or law
enforcement databases as a member of al-Qaida
o Acknowledged or identified as serving under al-Qaida leadership
o Associated with or recognized by al-Qaida network leaders, network
operatives, or key members including, but not limited to:
Usama bin Laden (UBL)
Khalid Shaykh Muhammad (KSM), (ISN
US9KU-010024DP)
Abu Hafs “the Mauritanian” / Muhammad
Atif (religious advisor)
Abu al-Layth al-Libi
Abu Muhammad al-Masri
Abu Musab al-Zarqawi or The Zarqawi
Network
Abu Yasir al-Jazaieri (facilitator)

Ayman al-Zawahiri
Nashwan Abd al-Razzaq Abd al-Baqi, aka
(Abd al-Hadi al-Iraqi), (ISN US9IZ010026DP)
Abd al-Qadus (Tora Bora commander and
training camp commander)
Abu Doha
Abu Musab al-Suri
Abu Qatada

Zayn al-Abidin Muhammad Husayn, aka
(Abu Zubaydah), (facilitator) (ISN US9GZ010016DP)
Ahmad Ressam
Baraqat Yarkas
Riduan Bin Isomuddin, aka (Hambali), (ISN Hamza al-Ghamdi
US9ID-010012DP)
Ali Muhammad Abdul Aziz al-Fakhri, aka
Jaffar al-Jazaieri
(Ibn al-Shaykh al-Libi), (ISN US9LY000212DP)19
Luqman
Marwan (recruiter)20
Sharqawi Abdu Ali al-Hajj, aka (Riyahd the Sayf al-Adl (commander)
cooperation can lead to the arrest of these individuals, and his refusal is therefore assessed as support to
those organizations.
19
Believed to be in Libyan custody.
20
Marwan Muqbil, aka (Marwan Ahmad Muqbil Salih), aka (Marwan Qassim Jawan), aka (Abu Ali alYafii)

S E C R E T // NOFORN // 20320915

 S E C R E T // NOFORN // 20320915
Facilitator), (ISN PK9YM-001457DP)
Sami Essid (Cell leader and facilitator)
Swift Sword, aka (Yusuf al-Iyari)
(facilitator)
Yazid Sufaat (anthrax researcher)

Sulayman Abu Ghayth (spokesman)
UBL bodyguards
Radical religious figures (such as Shaykh
Jabril, Shaykh Muqbil Wadi, Abu Hamza
al-Masri)

Other facilitators, financiers, recruiters, and
other force multipliers as identified in
assessments and intelligence reporting
o Recognized or identified by other known or assessed al-Qaida members
Detainee has familial ties to al-Qaida members
Volunteered to perform special tasks for al-Qaida (e.g., martyrdom operations,
special training, etc.)
Swore bayat to UBL21
Detainee‟s travel arrangements, funds, weapons or other support provided by alQaida
o Al-Qaida funded travel to Iran, Pakistan, or Afghanistan
o Another individual paid for travel tickets or provided travel expenses
o Another individual provided travel documents (visa, passport, etc.)
o Another individual assisted in obtaining travel documents expressly for the
purpose of traveling to Iran, Afghanistan, or Pakistan (not including travel
agency assistance)
o Passport or personal effects left at a safe house
o Travel, particularly to South Asia, on a student visa without requisite previous
education, without actual university enrollment, or without actually attending
an educational institution following travel
o Travel on a medical visa without a medical need, or without actually receiving
medical treatment (see cover stories)
o Stayed at an al-Qaida safe house or guesthouse
o Al-Qaida provided food, clothing, weapons
Traveled to Pakistan or Afghanistan using a common al-Qaida global terrorism
network transit routes
o From country of residence through Syria or Turkey to Iran then Afghanistan
or Pakistan (this route was primarily followed by persons from North Africa,
East Africa, Europe, Lavant, North West Saudi Arabia, and Yemeni‟s from
Hudaydah. Many North African‟s first made their way through London.
 Layovers of several days to several weeks in Damascus, SY, Tehran, IR,
Meshhad, IR, Zobul, IR, Tayyebat, IR, or Zahedan, IR
o Flight from country of residence through UAE to Pakistan (this route was
primarily followed by Gulf Arabs (including Saudi Arabia and Yemen)
 Flights into Karachi, PK, with overland transit to Quetta, PK, then
Kandahar, or Kabul (via Kandahar, Khowst, or Peshawar)
21

Includes those who are assessed to have sworn bayat.

S E C R E T // NOFORN // 20320915

 S E C R E T // NOFORN // 20320915


Flights into Lahore, PK, or Islamabad, PK, with overland transit to
Afghanistan via Peshawar or Khowst
o Flights from Asia terminated in Karachi, Lahore, or Islamabad with overland
transits as noted above
o Transit including a stay at al-Qaida, Taliban, or extremist guesthouse,
supporting hotel, mosque, university/madrassa, or NGO office:22
 Karachi (especially those in Gulshin-Iqbal and Sadar Bazaar areas),
Lahore, Islamabad, Peshawar, and Quetta, PK
 Hotels in Karachi (Dubai, Embassy, Emirates, Furan, Gulf, Mashriq,
Mehran, Mustafa)
 Herat, Kandahar, Kabul, Jalalabad, Logar, Khowst, AF
 Taliban Guesthouse or office, Daftar Taliban, in Quetta, PK
 Other facilities as noted in assessments and intelligence reporting
o Detainee has traveled on, or at some time possessed, false documents;
especially with known or suspected al-Qaida or al-Qaida-associated forged
stamps
Attempt to egress from Afghanistan or Pakistan through Chah Bahar, IR,
especially when route of travel for ingress was through Pakistan23
Association or affiliation with mosques or Islamic institutes where known alQaida members were recruited, facilitated, or trained including, but not limited to:
o Abu Bakr International University in Karachi, PK24
o Al-Khayr Mosque in Sana‟a, YM
o Al-Sunna (aka Assunna) Mosques in Quebec, CA
o Dimaj Institute in Sadaa, YM
o Finsbury and Bakers Street (Four Feathers) mosques in the UK
o Leannec Mosque in Lyon, FR
o Islamic Cultural Institute Mosque in Milan, IT
o Makki Mosque in Karachi, PK (Jama‟at Tablighi mosque)
o Wazir Akbar Khan Mosque in Kabul, AF
Assessed to be a member of, or affiliated with, the 55th Arab Brigade (aka the
UBL Brigade, aka the al-Qaida Brigade, etc.) in Afghanistan
o Served under brigade leadership such as Mullah Thakir, Abd al-Hadi al-Iraqi,
and Abd al-Salam al-Hadrami
o Occupied known brigade positions or facilities such as the Omar Sayf Center,
the Bilal Center, and unspecified front line kitchen or rest area
o Associated with known brigade members on the front lines
o Claimed to be a cook or a guard in the rear area, support lines, or positions
o Identified on the front lines or known to have visited the front lines

22

The European mosques served both al-Qaida and the North African extremist groups (see Algerian
Extremist Recruitment in Europe 31-MAY-2004, Homeland Security Focus Report on Terrorist
Recruitment 21 Oct 2005, Recruiting For Jihad Europe, and the NGIC-2002-00713-HT Bin Landens Terror
Network in Europe).
23
Al-Qaida attempted to extract some Yemeni‟s by boat from Chah Bahar to Oman
24
For additional information on the significance of the Abu Bakr and Dimaj institutes, see the Abu Bakr
University Analysis in JDIMS – References – DAB.

S E C R E T // NOFORN // 20320915

 S E C R E T // NOFORN // 20320915
o Foreigner speaking a language other than those used in Afghanistan claiming
to have fought for the Taliban
Use of common al-Qaida cover stories25
o Humanitarian
 Assisting the poor
 Charity work
 Missionary work
o Religious
 Attending training for jihad in Chechnya or Bosnia
 Religious obligation
 Teaching or studying the Koran or Islam; Dawa26
 To live in, or experience, a true Islamic nation
o Social/economic
 Honey or merchandise purchase, sales, or trade
 Met a traveler and simply went with him
 To find a job
 To find a wife
 To visit a relative
 Vacationing
o Detainee‟s denials about ever having traveled to Afghanistan, coupled with
reporting or analysis to the contrary
o Detainee has poorly detailed or unconvincing travels, activities, and
associates. Cover story is not logical, contains gaps, or detainee cannot
provide the names of places visited or personnel with whom he associated
who could verify the detainee‟s claims
o Conducted no significant activities during a lengthy stay in Afghanistan (such
as claims that he stayed in a house and just studied the Koran)
o Fled country of residence for fear of incarceration or prosecution
o Fled with Arabs without realizing they were armed combatants; just “followed
the crowd”
o Innocent bystander sold to US forces;27 as an attempt to “prove” their
innocence (to further hide their actual involvement with extremism), some alQaida detainees claimed they were unjustly captured and sold for a bounty, or
were unable to pay a solicited bribe

25

ISN 254 stated that he is incapable of telling anything but the truth because he is a Muslim and true
Muslims do not lie. When an interrogator explained to ISN 254 that another detainee had initially claimed
to have gone to teach the Koran, and then he changed his story, indicating that he went to a training camp
instead, ISN 254 explained that the other detainee didn‟t lie, he just told the other side of the story.
26
Cover stories listing dawa or to teach the Koran are particularly suspect when the individual does not
posses the requisite education and religious knowledge to perform this duty. Additionally, studying the
Koran is easier and more supportive in the detainee‟s local Islamic community, making travel for this
purpose unlikely unless the individual can prove he actually enrolled in a course of study in Pakistan.
Studying the Koran or Islam is a common cover story, especially since such religious training was actually
instructed at al-Qaida training camps and guest houses.
27
JTF-GTMO has no official confirmation that any of the JTF-GTMO detainees were sold to US forces for
a bounty.

S E C R E T // NOFORN // 20320915

 S E C R E T // NOFORN // 20320915
o Forced conscription; this is an attempt to show they were unwilling
participants, a cover story to remove incrimination
o Medical attention in Pakistan28
o Cover story has changed
o Assumption and use of an alias29
o Other cover stories as identified in assessments and intelligence reporting
Attended events sponsored by al-Qaida or attended by al-Qaida members, such as
the UBL‟s son‟s wedding
Employment of known counter interrogation and resistance techniques taught to
al-Qaida cadre (i.e., in the “Manchester Document”)
o Repeating a cover story by rote is considered an indicator of resistance
techniques, i.e., techniques consciously used to resist divulging information to
US officials. These techniques were taught in al-Qaida camps and detainees
receive additional guidance in resistance during detention.
o “It‟s in my file.” Detainee‟s use this resistance technique to keep from
answering questions. This prevents the interrogator from verifying control
questions necessary in determining the detainee‟s veracity. This also prevents
the detainee from being caught in a lie, especially when he is unsure of what
information he has given in the past. Detainees will use this technique even
for questions they have not been asked in the past.
o Refusal to cooperate. Some detainees will discuss mundane issues with
interrogators in order to appear cooperative but do not answer intelligence
questions. Other detainees may attempt to control the interrogation session by
voicing and maintaining focus on perceived offenses to the detainees or
through false or exaggerated claims of abuse or problems with the guard
force. Such tactics prevent the interrogator from asking intelligence
questions. Others will feign medical issues or will refuse to even
acknowledge the interrogators presence.
o As an attempt to show cooperation without divulging information, detainees
will interpret the questions with limited definitions. A detainee has pointed
out that being asked if you know an individual is not the same as meeting or
seeing the individual, knowing an individual implies familiarity while meeting
an individual implies limited contact. Likewise, working for an individual
was not the same as helping or being employed by the individual, with a
distinction between the receipt or non-receipt a salary and whether or not the
salary was on an ad hoc or regular schedule. The questions actually posed to
the detainees impact their interpretations of the question and subsequently
their answers.
28

Senior al-Qaida facilitator Abu Zubaydah stated he provided forged documents for Arab “brothers”
certifying that their travel to Pakistan was for official business or medical treatment. He also stated that alQaida sought to use individuals with bona fide medical conditions as couriers, because they could obtain a
valid medical visa. Senior al-Qaida facilitator Abu Bakr Muhammad Bulghiti, (aka Abu Yasir al-Jazaieri),
said mujahideen who traveled for a prolonged periods of time to Pakistan or Afghanistan needed an
explanation for their travel when returning to their home country. Therefore, it was common to obtain an
authentic document showing medical treatment by bribing a doctor at a hospital in Pakistan.
29
Extremist organizations direct their personnel to assume an alias for security purposes. Detainees have
also falsely denied having an alias.

S E C R E T // NOFORN // 20320915

 S E C R E T // NOFORN // 20320915
Provided other material support to al-Qaida, e.g., recruiter, facilitator,
propagandist, forger, financier, etc.
o Associated with evidence of facilitation (movement/transit; paid for travel,
arms, or supplies) or received such facilitation (beyond basic travel facilitation
to Afghanistan)
o Member of NGO other organization listed as providing support to terrorism
Presence or attendance at al-Qaida and affiliated training camps in Afghanistan or
Pakistan including, but not limited to:30
o Al-Faruq (several al-Faruq Camps were in existence since the late 1980s)
o Camp Malik
o Derunta Camp
o Khaldan Camp
o Tarnak Farm
o Torkham/Libyan Camp
o Mes Aynak Camp
o Training on the front lines
o Received specialized al-Qaida training (e.g., bomb making, surveillance, etc.;
implies having previously received basic training, which was a prerequisite
for advanced training)
o Received training with or under other al-Qaida personnel
o Received training at a guesthouse or an unspecified or unknown training camp
o Other training facilities as identified in assessments or intelligence reporting
Non-Afghan carrying a weapon in Afghanistan
Detainee has extensive international travels, especially if poorly detailed,
unconvincing, or implausible31
Other indicators as noted in assessments and intelligence reporting
(U) Member of, or affiliation with, the Taliban or Anti-Coalition Militia (ACM)
(S//NF) The following provides the primary indicators for assessing a detainee‟s
membership or affiliation with the Taliban or ACM elements other than al-Qaida.
Detainee admitted be Taliban
Identified as a leader or member in the Taliban32
Acknowledged or identified as serving under Taliban leadership
Name found on Taliban documentation, such as membership lists
Detainee has familial ties to Taliban officials
30

Some detainees have acknowledged their presence at a training camp, but deny receiving training in an
attempt to show they were not affiliated with al-Qaida, even when confronted with reporting to the
contrary. It is unlikely a detainee would visit a training camp, but then refuse to receive training for fear of
being branded a spy. Follow-on training (advanced training) is an additional indicator of recruitment for alQaida membership. Basic training at an al-Qaida camp is an indicator for membership in al-Qaida, but
should not be used as the sole determinant factor for such an assessment.
31
International travels can be an indicator of facilitator, courier, recruiting and operations activities such as
surveillance of targets.
32
The identification of detainee as a governor, for instance, should be considered with the fact that
governors commanded troops.

S E C R E T // NOFORN // 20320915

 S E C R E T // NOFORN // 20320915
Associations with Taliban or ACM leaders
o Mullah Muhammad Omar
o Al-Tayib Agha
o Jalaluddin Haqqani
o Khirullah Said Wali Khairkhwa (ISN US9AF-000579DP)
o Mullah Berader
o Mullah Dadullah Lang
o Mullah Fazil
o Mullah Muhammad Fazl (ISN US(AF-000007DP)
o Wakil Ahmad Muttawakil (ISN US9AF-000548DP)
o Various Taliban Ministries
o Other leadership and key members as identified in assessments and
intelligence reporting, including those assessed to have been conduits between
Usama Bin Laden and the Taliban
Associations with non-Taliban ACM organizations
Association with Pakistan ISID, especially in the late 1990s up to 2003
Attendance at Taliban training camps or received training from a Taliban
member, especially after 11 September 2001
Occupied Taliban support facilities
Captured with other Taliban
Possessed weapons, explosives, mines, etc.33
Use of common Taliban cover stories
o A simple farmer
o Arrest was the result of a personal feud with an individual with good ties to
the current Afghan government, US, or Coalition forces
o A conscript34
o Claimed to assist Taliban at the risk of personal harm
o Simply served as a cook or supply clerk
o Assumption and use of an alias
Affiliation with Afghanistan narcotics trafficking35
Provided financial support to Taliban forces
Provided intelligence or conducted surveillance in support of hostile forces
Provided logistical support, transportation, food services, etc
(U) Other Indicators Requiring Consideration

33

Possession of an AK-47 is common in the region for Afghans. Therefore, it is important to identify types
and quantities of weapons.
34
Though some detainee claims of conscription are true, the fact of conscription does not negate the fact of
membership in the Taliban. ISN 092 is an example of a detainee who successfully applied the conscription
cover story as a means to secure his release from US custody. He could not have done so without the
support of other detainees willing to withhold information about him.
35
Connections to narcotics can be a fundraising platform for the Taliban and ACM elements, but cannot
serve as the sole indicator for membership in the Taliban.

S E C R E T // NOFORN // 20320915

 S E C R E T // NOFORN // 20320915
(S//NF) The following are indicators that may not sufficiently demonstrate a detainee‟s
threat when taken separately. These indicators should be considered in light of the other
indicators and reporting from and about the detainee, his associates and his activities.
Detainee prescribes to militant Islam and is a committed jihadist likely to rejoin
the fight if released
o Uncooperative with interrogators
o Traveled to Afghanistan for jihad or religious obligation
o Long-term associations with extremist groups
o Participation in multiple jihads
o Received advanced training
o Threats against guard staff, US officials, the American public, other religions,
and Israel during detention
o Confirmed attacks or violence against US service members
o Served in a leadership or force-multiplier role
o Limited prospects following release
o Detainee has radical Islamic training through known facilities such as the
Islamic Institute in Kandahar or other identified mosques, madrassas or
teachers, such as Shaykh Issa al-Masri
o Detainee participated in one or more hunger strikes during detention
Detainee supported any extremist group through an NGO
Detainee‟s timeline cannot be confirmed and he admits, or is identified or
assessed to have spent weeks or months in Kandahar prior to November 2001,
where he could have attended al-Faruq
Detainee is not identified by senior extremist leadership – this can be an indicator
that detainee was not well known or not part of the organization
Detainee retracted earlier claims. Detainees retract claims after arriving at JTFGTMO when they realize that they will not be abused. Earlier periods of
captivity were productive in obtaining intelligence as detainees were not aware of
how the US would attempt to illicit information and they were taught ways to
resist torture leading them to assume it would be used against them.
Detainee‟s claims are out of context with known facts. For instance, a detainee
claims to be unemployed and poor, but was caught with $1,000 US after being in
Afghanistan for 6 months. Or, a detainee claims he went to teach Islam but he
does not have the requisite education to do so.
Detainee provided a false name, timeline, or biographical details upon capture
Detainee‟s ability to recognize and discuss individuals of interest to the
Intelligence Community, while claiming to be an innocent bystander or
unassociated witness
Detainee claims he never heard of al-Qaida before coming to JTF-GTMO. This is
unlikely; though it is possible al-Qaida may be referred to as the World Islamic
Front for Jihad Against the Jews and Crusaders in Arabic media, or simply the
UBL organization. It is more probable that detainees falsely make this claim as
an attempt to demonstrate they are not affiliated with al-Qaida.
(U) Associated Forces:

S E C R E T // NOFORN // 20320915

 S E C R E T // NOFORN // 20320915

(S//NF) Associated forces are those militant forces and organizations with which alQaida, the al-Qaida network, or the Taliban had or has an established working,
supportive, or beneficiary relationship for the achievement of common goals. Associated
forces are identified in intelligence reports and US government terrorism lists. These lists
include, but are not limited to:
The Department of State list of designated Foreign Terrorist Organizations
(FTOs)36
Department of State Country Reports on Terrorism, which include FTO and the
Other Groups of Concern list37
The Patriot Act Terrorist Exclusion List, also published by the Department of
State38
The Department of the Treasury Office of Foreign Assets Control Specially
Designated Nationals (SDN) list39
Additional guidance is provided by the National Intelligence Priorities
Framework (NIPF)40
Other terrorist organizations, terrorist support entities, and individuals identified
in assessments, intelligence reporting and US Government designated terrorism
lists
(S//NF) The following is a list of terrorist and terrorist support entities identified as
associate forces. This list is not all inclusive but provides the primary organizations
encountered in the reporting from and about JTF-GTMO detainees. Through associations
with these groups and organizations, a detainee may have provided support to al-Qaida or
the Taliban, or engaged in hostilities against US or Coalition forces.41
Afghan Support Committee (Afghan Support
Group) [ASC, ASG]
Al-Muhajiroun [ALM]43

Al-Itihad Al-Islami [AIAI]42
Al-Qaida Network44

36

http://www.state.gov/s/ct/rls/fs/37191.htm. This list is designed to heighten public awareness and
international concern of terrorist organizational activities and to support efforts to curb terrorist financing
37
http://www.state.gov./s/ct/rls/fs/2005/65275.htm. This list includes those organizations that are not
designated as an FTO under 8 USC Section 1189.
38
http://www.state.gov./s/ct/rls/fs/2005/32678.htm.
39
http://www.treas.gov/offices/enforcement/ofac/sdn/, used in determinations of asset freezing or
forfeiture.
40
http://www.fbi.gov/hq/nsb/nsb_faq.htm. The NIPF guides the operation, planning, and programming of
US intelligence analysis and collection.
41
Known or suspected of wittingly or unwittingly providing support or cover to al-Qaida or other terrorist
organizations, the nature of the association needs to be further refined before an EC determination can be
made. A full list of managers or employees of specific NGO branches and offices supporting al-Qaida or
other terrorist organizations has not yet been published.
42
This is the East Africa group, not the Itihad in Afghanistan connected to Rasul Sayyaf.
43
References to this should be specific in that it is an actual organization. Al-Muhajiroun/Muhajirun itself
is Arabic for “Emigrants” and can be used to describe those coming to Afghanistan to live, but also those
who came to participate in jihad.

S E C R E T // NOFORN // 20320915

 S E C R E T // NOFORN // 20320915
Ansar al-Islam [AI]
Armed Islamic Group [GIA]
East Africa al-Qaida [EAAQ]
Eastern Turkistan Islamic Party [ETIP]
Gama‟a Islamia [GI]46
Harakat Al-Mujahideen [HUM]
Hezb-I-Islami-Gulbuddin (AMC Entity)
[HIG]
Hizballah
Islah Party
Islamic Movement of Tajikistan (ACM
Entity) [IMT]
Islamic Salvation Front [FIS]
Jaysh Al-Muhammad [JEM]
Libyan Islamic Fighting Group [LIFG]47
Moro Islamic Liberation Front [MILF]
Muslim Brotherhood [MB]48
Pakistani Inter-Service Intelligence
Directorate [ISID]

Anti-Coalition Militia [ACM]45
Council of Islamic Courts [CIC]
East Turkistan Islamic Movement [ETIM]
Egyptian Islamic Jihad, Islamic Jihad [EIJ]
HAMAS
Harakat-Ul-Jihad-I-Islami [HUJI]
Hezb-I-Islami-Khalis-(ACM Entity) [HIK]
Iranian Intelligence
Islamic Jihad Union (Islamic Jihad Group)
[IJU, IJG]
Islamic Movement of Uzbekistan [IMU]
Jama‟at Al-Islami [JI]
Lashkar-e-Tayyiba (and its political wing
MDI) [LT]
Maktab Al-Khadimat [MK]
Moroccan Islamic Combat Group [GICM]
North African Extremist Network49
Sabotage Battalion of Chechen Martyrs
[RSRSBCM]

44

Includes references of the Al-Qaida Movement, The al-Qaida Network, the Global Jihad Support
Network [GJSN], the UBL Network, and the North African Extremist Network, 55th Arab Brigade (alQaida‟s militant organization supporting the Taliban), and the organizations associated to them if they are
not listed separately in this table. The Global Jihad Support Network is composed of individuals, most of
whom are from North Africa, the Levant, or Saudi Arabia, and who reside in those countries, Europe, or
South Asia. The network provides various services, including logistics and fundraising, and helps move
operatives from country to country as needed.
45
This includes elements of numerous groups including al-Qaida, Taliban, HIG and other terrorist
organizations which are currently, and cooperatively, engaged in hostilities with US and coalition forces in
Afghanistan and Pakistan. This is a US term to identify those cooperative organizations, and the term is
not used by those organizations themselves.
46
The Gama‟a Islamiya can be spelled as Jama‟at al-Islamiyah. This is an Egyptian terrorist organization,
separate from the similarly spelled Asia-based JI, and the EIJ.
47
It is important to note that these organizations may be represented by their Arabic equivalents and aliases
in reporting.
48
The MB, aka (Ikhwan e Muslimin), is not a designated terrorist group, but does have ties to extremist
organizations.
49
Until the creation of the group designation "Global Jihad Support Network" (GJSN), the term used in the
IICT list, now the NIPF list, was the "North African Extremist Network" (NAEN). The IICT abolished the
use of NAEN when they created the GJSN. At the time, the LIFG was grouped into the NAEN and
subsequently was included in the GJSN with the terminology, ". . . composed of individuals, most of them
from North Africa. . .” The LIFG‟s separate designation in the IICT, like the other North African groups,
applies to those functions of the organizations operating on a national (their home country). The separate
designations do not apply to the international realm in support of the al-Qaida network and those
organizations which supported it in Central Asia where these detainees were arrested; instead the
NAEN/GJSN designation applies. JTF-GTMO, with EUCOM LNO assistance, is attempting to obtain a
list of the organizations that fall within the GJSN and an official explanation of its relationship to the North
African groups.

S E C R E T // NOFORN // 20320915

 S E C R E T // NOFORN // 20320915
Salafist Group for Call and Combat [GSPC]
Takfir wa Hijra [TAKFIR]
Tunisian Combat Group [TCG]
Yemeni Intelligence [PSO]
Active Islamic Youth NGO
Al-Akhtar Trust NGO
Al-Haramayn International Foundation NGO
(HIF, HIFA)

Benevolence International Foundation (Lajnat
Al-Bir Al-Islami) NGO [BIF]
Human Appeal International NGO
Jama‟at Al-Tablighi NGO [JT]50
Lajnat Al-Dawa Al-Islamiya NGO [LDI]
Muslim World League NGO
Rashid Trust NGO
Sanabil NGO
Taibah NGO
World Assembly of Muslim Youth NGO
[WAMY]

Salafiya Jihadia (SJ)
Taliban
Tunisian Islamic Front [precursor to
Tunisian Combat Group, TCG] [FIT]
Zarqawi Network (al-Qaida in Iraq)
African Muslim Association (sometimes
Agency) NGO (AMA)
Al-Furqan NGO
Al-Wafa Humanitarian Organization NGO,
al-Wafa al-Islamiya, Munathima Wafa lalA‟mal al-Agathia, Munathima Wafa lalA‟mal al-Ansania, Wafa
Global Relief Foundation NGO (GRF)
International Islamic Relief Organization
NGO [IIRO]
Kuwaiti Joint Relief Committee NGO
[KJRC]
Maktab al-Khidmat NGO [MK]
Qatari Joint Committee for Relief NGO
Revival of Islamic Heritage Society NGO
[RIHS]
Saudi High Commission for Relief NGO
[SHCR]
Ummah Tameer Nau NGO [UTN]

50

Affiliation with the JT, a proselytizing organization, has been identified as an al-Qaida cover story. AlQaida used the JT to facilitate and fund the international travels of its members.

S E C R E T // NOFORN // 20320915