CIA confirms suspect worked with CIA‑backed unit; report identifies NDS‑03 base at Camp Gecko
U.S. officials, including the CIA, confirmed that 29‑year‑old Rahmanullah Lakanwal — evacuated to the United States under Operation Allies Welcome in 2021 and later granted asylum — previously worked with a CIA‑backed Afghan partner unit identified in reports as NDS‑03, which operated from Camp Gecko in Kandahar. Lakanwal is accused of an ambush‑style attack near Farragut Square that critically wounded two West Virginia National Guard members (Spc. Sarah Beckstrom was later reported killed and SSgt. Andrew Wolfe remains hospitalized); he was shot, taken into custody, and the FBI is leading a probe being treated as a possible act of international terrorism.
📌 Key Facts
- Wednesday afternoon ambush near Farragut West/Farragut Square (about 2:15 p.m.), in broad daylight roughly two blocks from the White House: a lone gunman came around a corner and opened fire on high‑visibility National Guard patrols; nearby Guard members returned fire, ran over and held down the suspect, and the scene was secured by MPD, Secret Service and ATF.
- Victims: Army Spc. Sarah Beckstrom, 20, and Air Force Staff Sgt. Andrew Wolfe, 24, were wounded; Beckstrom later died and Wolfe remained critically injured (later reported to have woken from an induced coma).
- Suspect: identified as 29‑year‑old Afghan national Rahmanullah Lakanwal, who was shot during the incident, taken into custody and hospitalized with injuries not believed to be life‑threatening; it is unclear which responder fired the round that wounded him.
- Weapon and attack details: authorities say the attacker carried a .357 Smith & Wesson revolver (referred to as a revolver); investigators reported he fired multiple rounds, shot a female Guard member, reportedly took her weapon and continued firing before being subdued.
- Background and U.S. admission: Lakanwal was evacuated to the U.S. under Operation Allies Welcome in September 2021, had been living in Washington state with his wife and five children, applied for asylum in 2024 and was granted asylum in 2025; prosecutors say he drove cross‑country to carry out the attack.
- Afghan service and CIA link: the CIA and multiple U.S. officials confirmed Lakanwal previously worked with U.S. government partner forces in Kandahar; advocacy group AfghanEvac and reporting identify his unit as the CIA‑backed 'Zero Unit' NDS‑03, said to have operated from Camp Gecko.
- Investigation and charges: the FBI is leading a nationwide probe being treated as a possible act of international terrorism, executing search warrants coast‑to‑coast and reviewing his Afghan partner‑force ties and U.S. associates; U.S. prosecutors charged him with multiple counts including assault with intent to kill while armed and a firearm‑during‑a‑crime‑of‑violence offense (with possible upgrade if fatalities occur).
- Aftermath and context: USCIS paused processing Afghan immigration requests pending vetting review; political leaders including President Trump called the shooting an 'act of terror,' ordered 500 additional Guard troops to D.C. and criticized prior vetting; advocates and caseworkers say Lakanwal showed post‑arrival deterioration (isolation, job loss, 'manic' travel), DHS suggested possible post‑arrival radicalization while the FBI has not confirmed ideological motive and is also probing reported contacts (including a possible Tablighi Jamaat link) as part of its inquiry.
📊 Analysis & Commentary (4)
"The Playbook column comments on the D.C. Guard shooting (the suspect’s CIA‑linked Afghan background), warns that both parties are rushing to politicize the attack, and urges caution and evidence‑based responses rather than instant partisan exploitation."
"A Wall Street Journal editorial condemns the ambush of two National Guard members and uses the suspect’s status as an Afghan evacuee to criticize U.S. resettlement and vetting policies, urging a reassessment of security procedures."
"The Politico piece links the D.C. shooting and the suspect’s CIA‑partner background to an immediate hardline immigration push and uses POLITICO poll data to argue that such security‑driven policies risk exposing and deepening emerging fractures between MAGA loyalists and the broader 2024 Trump electorate."
"The opinion piece rebuts media claims that Trump’s D.C. Guard deployment fueled the National Guard shooting, arguing instead that the shooter’s alleged admission as an Afghan evacuee after a rushed post‑withdrawal vetting is the relevant policy failure and that the Guard presence reduced crime."
📰 Sources (50)
- Introduces possible Tablighi Jamaat linkage being scrutinized by FBI/DHS as a radicalization vector post‑arrival in the U.S.
- Details of suspect’s communications to family ('with Tablighis') were provided to the FBI by his brother.
- Gov. Patrick Morrisey announced that shooting victim SSgt. Andrew Wolfe has woken from an induced coma.
- Medical-status update provides a new development in the same incident connected to Rahmanullah Lakanwal.
- A former Afghan commando told CBS Lakanwal led an Afghan special forces unit in the south and worked closely with international troops.
- The commando said Lakanwal was deeply troubled by a close friend and fellow commander’s death in 2024 after an unsuccessful U.S. asylum bid.
- Adds personal context: prolonged isolation, reported 'manic episodes,' and family hardship in 2023–2024 as documented by caseworker emails.
- Noem states DHS believes Lakanwal’s radicalization occurred after he arrived in the U.S., adding a timeline detail to prior reporting on his background.
- She indicates investigators are engaging with people from his U.S. community who are providing information.
- AP-reviewed emails show an advocate warned months earlier that Lakanwal had 'not been functional' since March of the prior year, citing quitting work, isolating in a dark room, and unresponsiveness to family.
- The advocate reported alternating 'periods of dark isolation and reckless travel,' including abrupt trips to Chicago, Arizona, and Washington, D.C., sometimes described as 'manic' episodes lasting 1–2 weeks.
- USCRI staff traveled to Bellingham in March 2024 after warnings but made no meaningful contact; the advocate believed Lakanwal declined help.
- Additional context that he abandoned English classes, cycled through short-term jobs, and his children at times arrived at school unbathed or in the same clothes for days.
- FBI continues to examine motive and has not confirmed any ideological influence; DHS Secretary Kristi Noem has suggested possible post-arrival radicalization.
- DHS Secretary Kristi Noem said the suspect was 'radicalized since he's been here in this country' and suggested ties in his U.S. community/state, offering no further details.
- Noem alleged Biden-era vetting was limited and contrasted it with current biometric and social-media checks she says are now in place.
- Samantha Vinograd stated there is no indication the shooting was a vetting failure and explained the scope and limits of the vetting system.
- Reiterates Lakanwal served in a CIA-backed Afghan 'Zero Unit' before entering the U.S. under Operation Allies Welcome in 2021.
- Provides new context on his post-arrival deterioration, including inability to hold a job and isolation patterns that prompted outreach to a refugee services nonprofit.
- AP cites sources and AfghanEvac that suspect Rahmanullah Lakanwal worked in a CIA‑backed Afghan Army unit, aligning with prior confirmations.
- Trump’s remarks escalate the incident’s framing as a 'terrorist attack' and criticize Afghan resettlement policy.
- Prosecutor Jeanine Pirro detailed the weapon and present charges, saying motive remains unknown.
- Confirms the deceased victim’s identity: Army Spc. Sarah Beckstrom.
- Confirms the second victim’s status: Andrew Wolfe remains in critical condition.
- Places the casualty update on Thursday night following the Wednesday ambush.
- A victim in the Farragut Square-area ambush has died: West Virginia National Guard member Sarah Beckstrom, 20.
- Trump disclosed the death during a Thursday evening call with service members.
- Investigators say the suspect drove across the country to carry out the attack.
- Prosecutors plan to charge the Afghan national with three counts of assault with intent to kill.
- The two National Guard members remain in critical condition.
- Victims identified as Army Spc. Sarah Beckstrom, 20, and Air Force Staff Sgt. Andrew Wolfe, 24; both remain in critical condition.
- U.S. Attorney Jeanine Pirro announced charges: three counts of assault with intent to kill while armed, plus a firearm during a crime of violence.
- Officials reiterate the suspect, Rahmanullah Lakanwal, arrived in 2021 under Operation Allies Welcome and was granted asylum earlier this year; a Guard member shot him to end the attack.
- CIA Director John Ratcliffe issued a statement blaming Biden-era Operation Allies Welcome vetting, saying the suspect "and so many others" should not have been allowed to come to the U.S.
- Article reiterates that Rahmanullah Lakanwal worked with a CIA partner force in Kandahar and adds that he was granted asylum in April under the Trump administration, according to #AfghanEvac.
- New personal detail: a former landlord says Lakanwal lived in Bellingham, Washington, with his wife and five children.
- #AfghanEvac outlined asylum vetting steps (fingerprinting, iris scans, background check, interview, risk assessment) that would have applied to Lakanwal.
- Scale/context update: about 76,000 Afghans were brought to the U.S. under Operation Allies Welcome, with initial processing at U.S. military bases (JB McGuire‑Dix‑Lakehurst, Fort McCoy, Fort Bliss).
- Fox identifies the specific CIA‑backed 'Zero Unit' as NDS‑03 and says it operated from Camp Gecko (Mullah Omar’s former compound) across Kandahar, Helmand and Uruzgan.
- Afghan Evac says Lakanwal entered the U.S. in 2021 under Operation Allies Welcome and was granted asylum in April 2025 under the Trump administration.
- A senior U.S. official says CIA vetting would have checked NCTC databases and kept identities confidential; notes Afghans sometimes forged birth dates to meet age requirements.
- U.S. Attorney Jeanine Pirro and FBI Director Kash Patel publicly criticized vetting at a Nov. 27 press conference.
- Timeline detail: Lakanwal reportedly began working with the CIA around 2011, likely as a minor.
- Identifies the two wounded West Virginia National Guard members by name and age: Spc. Sarah Beckstrom, 20, and Pfc. Andrew Wolfe, 24; both remain in critical condition.
- States both Guardsmen had been stationed in D.C. since August and were deputized less than 24 hours before the attack to conduct presence patrols.
- Reports suspect Rahmanullah Lakanwal drove from Washington state to carry out the attack and was shot by another Guard member before being taken into custody.
- Includes Trump’s video statement labeling the shooting an 'act of terror' and pledging to 'reexamine every single alien' who entered from Afghanistan under Operation Allies Welcome.
- Notes Defense Secretary Pete Hegseth’s announcement of 500 additional National Guard troops to D.C. (contextual to the incident).
- Officials identified the two wounded Guard members as USAF Staff Sgt. Andrew Wolfe, 24, of Martinsburg, W.Va., and U.S. Army Specialist Sarah Beckstrom, 20, of Summersville, W.Va.
- Wolfe is assigned to the Force Support Squadron, 167th Airlift Wing, West Virginia Air National Guard; Beckstrom is assigned to the 863rd Military Police Company, 111th Engineer Brigade, West Virginia Army National Guard.
- Service entry dates: Wolfe entered service Feb. 5, 2019; Beckstrom on June 6, 2023.
- Medical status update: both remain in critical condition; Beckstrom’s father says she has a 'mortal wound' and is unlikely to recover.
- Both had been deployed to Washington, D.C., since August as part of the Trump administration’s crime‑crackdown deployment.
- AfghanEvac identifies the specific Afghan unit as NDS-03, described as operating at the CIA’s direction.
- CIA Director John Ratcliffe said the suspect was admitted to the U.S. due to his prior work with the U.S. government, including the CIA.
- Timeline details: evacuated to the U.S. in Aug. 2021 under humanitarian parole; asylum was granted in April 2025.
- Immigration status details: the suspect had SIV chief of mission approval but had not yet obtained lawful permanent residence.
- FBI Director Kash Patel said the suspect’s relationship with partner forces in Afghanistan will be a central focus of the probe and alleged vetting failures by the prior administration.
- AfghanEvac emphasized extensive vetting for this population and cautioned against broad-brush judgments; founder Shawn VanDiver’s on‑record quote included.
- CBS reports President Trump publicly weighed in on the D.C. National Guard shooting.
- CBS says the suspect, Rahmanullah Lakanwal, previously worked with the U.S. government, including the CIA.
- CBS reiterates the suspect entered the U.S. in 2021.
- Officials say the suspect, 29-year-old Rahmanullah Lakanwal, now faces several D.C. charges of assault with intent to kill while armed.
- Authorities characterized the incident as an 'ambush' attack.
- Two National Guard members remain in critical condition, per the latest update.
- Victims identified: Specialist Sarah Beckstrom, 20, and Staff Sgt. Andrew Wolfe, 24; both remain in critical condition.
- U.S. Attorney Jeanine Pirro said the suspect, Rahmanullah Lakanwal, drove across the country and carried out an 'ambush‑style' attack with a .357 Smith & Wesson revolver.
- Video shows the assailant 'came around the corner' and immediately opened fire; at least one Guard member exchanged gunfire.
- Troops subdued the gunman by running over and holding him; his injuries are not believed to be life‑threatening.
- Additional charge detailed: possession of a firearm during a crime of violence (along with assault with intent to kill while armed).
- West Virginia Gov. Patrick Morrisey initially stated the Guardsmen were killed, then retracted amid 'conflicting reports.'
- Lakanwal has been living in Washington state with his wife and five children, according to a former landlord.
- Approximate deployment size noted: nearly 2,200 Guard members were in D.C. for the mission.
+ 30 more sources