# Zambon v. Islamic Republic of Iran, Ministry of Foreign Affairs

> District Court, District of Columbia · July 19, 2022

URL: https://www.frixlaw.com/law-library/cases/6501028

## Case

- **Court:** District Court, District of Columbia
- **Decided:** July 19, 2022
- **Precedential status:** Published
- **Opinion:** Opinion
- **Judges:** Judge John D. Bates
- **Nature of suit:** Civil
- **Cited by:** 0 later opinions in the Frix Law Library

## Citator (automated)

- No negative treatment found by the automated citator. That is not the same as a confirmation that the case is good law; read the citing cases.
- Full citator and citing cases: https://www.frixlaw.com/law-library/cases/6501028

## How later opinions describe it (automated extraction)

- noting that the court in Peterson II departed upward where, for example, “victims suffered relatively more numerous and severe injuries, were rendered quadriplegic, partially lost vision and hearing, or were mistaken for dead”
- applying similar reasoning with respect to Syria’s support for a terrorist group

## Opinion text

UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA

AUGUST CABRERA, et al.,
Plaintiffs,

v. Civil Action No. 19-3835 (JDB)
ISLAMIC REPUBLIC OF IRAN,
Defendant.

MARK ZAMBON, et al.,
Plaintiffs,

v. Civil Action No. 18-2065 (JDB)

ISLAMIC REPUBLIC OF IRAN,
Defendant.

MEMORANDUM OPINION (FINDINGS AND CONCLUSIONS)

Between 2006 and 2019, a terrorist syndicate comprising, among other groups, al-Qaeda,

the Taliban, and the Haqqani Network perpetrated numerous terrorist attacks against American

servicemembers and civilians in Afghanistan. Some of these victims and their family members

have now brought this series of coordinated suits against the Islamic Republic of Iran (“Iran”)

under the terrorism exception to the Foreign Sovereign Immunities Act (“FSIA”), 28 U.S.C.

§ 1605A. Plaintiffs allege that Iran provided material support for the terrorist syndicate

responsible for these attacks and accordingly seek compensatory damages from Iran.

After Iran was properly served and it defaulted, the Court held a three-day evidentiary

hearing regarding the entry of default judgment against Iran. The evidence presented at the hearing

concerned eleven “bellwether” attacks and the claims of twenty-three “bellwether plaintiffs,” all
of whom were injured in the bellwether attacks or were family members of direct victims. After

the hearing, plaintiffs submitted declarations and supplemental argument regarding the damages

of the bellwether plaintiffs. Guided by the findings and conclusions in this Memorandum Opinion,

the Court will refer the claims of the other plaintiffs to a Special Master, who will prepare a report

and recommendation. At that time, the Court will issue additional instructions for liability and

damages proceedings concerning non-bellwether attacks.

This Memorandum Opinion will proceed in three steps. First, it will present the Court’s

findings as to the connections between Iran and the eleven bellwether attacks; the Court will also

briefly describe the personal histories and accounts of the four plaintiffs who testified at the

evidentiary hearing. Next, the Court will set forth its legal conclusions regarding Iran’s liability

for the plaintiffs’ injuries. 1 Finally, the Court will set forth its conclusions regarding the bellwether

plaintiffs’ damages.

I. Background

Plaintiffs filed these consolidated suits on August 31, 2018 (Zambon) and December 27,

2019 (Cabrera). As relevant to this Memorandum Opinion, plaintiffs generally allege that Iran

provided material support, in the form of “sophisticated weapons, critical training, financial

assistance, safe haven, and assistance with drug trafficking,” to a “terrorist syndicate” operating in

Afghanistan from 2006 to 2019. Pls.’ Proposed Conclusions of Law [ECF No. 70-2] (“Proposed

Conclusions”) at 1. 2 Plaintiffs assert that the broad goal of the syndicate was to “expel[] U.S.

forces from Afghanistan and overthrow[] Afghanistan’s democratically elected government”—a

1
The Court enters the findings and conclusions pursuant to 28 U.S.C. § 1608(e). That provision requires
plaintiffs under the FSIA to “establish[] [their] claim or right to relief by evidence satisfactory to the court” even
where, as here, the defendant has failed to appear after proper service.
2
Unless otherwise indicated, all docket entry citations will refer to the filings in Cabrera v. Islamic Republic
of Iran, No. 19-cv-3835. The Court will cite filings in Zambon v. Islamic Republic of Iran as “Zambon ECF No. #.”
2
goal it ultimately achieved in August of 2021. Id. Plaintiffs seek damages for the personal injuries

of surviving victims of the syndicate’s attacks, the personal injuries and deaths of victims who

were killed, and for loss of consortium, solatium, and the emotional distress suffered by the

families of those injured or killed. See Second Am. Compl. [ECF No. 30] ¶¶ 1702–09; Compl.

[Zambon ECF No. 1] ¶¶ 188–91, 193–95.

A. Service and Entry of Default

The FSIA sets forth the requirements for serving a foreign state. Section 1608(a) provides

four methods for effecting service: (1) by delivering a copy of the summons and complaint “in

accordance with any special arrangement for service between the plaintiff and the foreign state,”

(2) by delivering a copy of the summons and complaint “in accordance with an applicable

international convention on service,” (3) by sending copies of the summons and complaint, as well

as translations thereof, “by any form of mail requiring a signed receipt,” or (4) by sending the

documents to the Secretary of State, who then transmits them “through diplomatic channels to the

foreign state.” A plaintiff must move through the four service methods sequentially and may use

the fourth method only if the first three methods fail or are impossible. See id. § 1608(b); Barot

v. Embassy of the Republic of Zambia, 785 F.3d 26, 27 (D.C. Cir. 2015).

Because neither a “special arrangement,” 28 U.S.C. § 1608(a)(1), nor an international

convention, id. § 1608(a)(2), was available for effecting service in this case, see Karcher v. Islamic

Republic of Iran, 396 F. Supp. 3d 12, 15 (D.D.C. 2019), plaintiffs attempted to serve Iran by mail

under § 1608(a)(3), see Affidavit Requesting Foreign Mailing [Zambon ECF No. 7]; Affidavit

Requesting Foreign Mailing [ECF No. 13]. When those attempts at service failed, see Suppl.

Praecipe Regarding Service [Zambon ECF No. 11] (explaining that plaintiffs could not find a

carrier that would deliver to Iran); Min. Order, Apr. 14, 2020 (permitting plaintiffs to skip service

3
by mail because no carrier would deliver to Iran), plaintiffs transmitted their requests to the

Secretary of State for service through diplomatic channels pursuant to § 1608(a)(4), see Affidavit

Requesting Foreign Mailing/Diplomatic Service [Zambon ECF No. 12]; Affidavit Requesting

Foreign Mailing/Diplomatic Service [ECF No. 16]. Those attempts to serve Iran succeeded. See

Return of Service [Zambon ECF No. 16] (“Zambon Return of Service”); Return of Service [ECF

No. 19] (“Cabrera Return of Service”). After Iran failed to respond, plaintiffs sought an entry of

default, which the Clerk of Court entered on August 12, 2020 in Zambon, see Entry of Default

[Zambon ECF No. 20], and on October 16, 2020 in Cabrera, see Entry of Default [ECF No. 21].

In February 2021, the Cabrera plaintiffs amended their complaint to include additional plaintiffs

who were victims or family members of victims. See generally Second Am. Compl. Plaintiffs

sought an entry of default as to that amended complaint, which the Clerk of Court entered on June

6, 2022. See Entry of Default [ECF No. 76].

B. Pre-Hearing Proceedings

Shortly after the Clerk’s entry of default in October 2020, plaintiffs proposed a multiphase

case management plan, whereby they would move for a default judgment as to all plaintiffs, but

then present evidence of only certain bellwether claims to the Court, which would enter findings

and conclusions on liability as to those claims. See Pls.’ Mot. for Entry of Case Management

Order [ECF No. 22] at 2–10. Plaintiffs then proposed submitting additional liability evidence as

to a further subset—the bellwether plaintiffs—and appointing Special Masters to make liability

and damages determinations as to the remaining plaintiffs. See id. at 9–11. Put differently, the

Court would make findings of fact and liability conclusions on eleven bellwether attacks, and

would then make damages conclusions as to a subset of the victims injured in those attacks.

4
The Court largely accepted this proposal and ordered an evidentiary hearing, ultimately set

for October 18, 2021, see Revised Case Management Order [ECF No. 54] (“Second Revised

Order”) at 2, on a set of bellwether attacks that occurred in Afghanistan to be selected by plaintiffs,

see Case Management Order [ECF No. 28] at 2. These attacks were to “represent[] each of the

geographies and each of the attack types” at issue in this case. Id.; see also Revised Case

Management Order [ECF No. 45] at 2; Second Revised Order at 2. In advance of the hearing,

plaintiffs submitted the following list of bellwether attacks:

1. July 13, 2008 Complex Attack in Waygul District, Nuristan Province
2. August 16, 2009 IED-Triggered Complex Attack in Siawashan Village, Herat Province
3. April 11, 2010 IED in Arghandab District, Kandahar Province
4. August 6, 2011 Attack on Helicopter in Tangi Valley, Wardak Province
5. October 29, 2011 Vehicle-Borne Suicide Bombing in Kabul City
6. May 20, 2012 Suicide Vest Bomber in Tarin Kowt, Uruzgan Province
7. May 31, 2012 IED in Zombalay District, Helmand Province
8. June 18, 2013 Indirect Fire on Bagram Airfield, Parwan Province
9. July 15, 2013 82mm Recoilless Rifle Attack in Paktia Province
10. August 7, 2016 Kidnapping in Kabul City
11. June 10, 2017 Insider Attack in Pehka Valley, Nangarhar Province

List of Bellwether Attacks [ECF No. 57] (“Attack List”) at 2–4. At the bellwether hearing,

plaintiffs would present evidence on liability issues relevant to the specific attacks and to all attacks

generally. Second Revised Order at 2. After the Court coordinated litigation of the Afghanistan-

based claims in Zambon with the claims in Cabrera, see Order, May 27, 2021 [Zambon ECF No.

30], 3 plaintiffs moved for an entry of default judgment on September 20, 2021, see generally

Motion for Default Judgment [ECF No. 52] (“Default Motion”).

3
Zambon is also consolidated with Blunt v. Islamic Republic of Iran, No. 19-1696. See Min. Order, Dec.
23, 2020 (Zambon).
5
C. Bellwether Hearings

After granting plaintiffs’ motion to pre-admit 152 exhibits, see Order, Oct. 1, 2021 [ECF

No. 56], the Court held a three-day evidentiary hearing from October 18 to 20, 2021, where

plaintiffs presented evidence supporting Iran’s liability in each of the eleven bellwether attacks.

Plaintiffs put on five fact witnesses and three expert witnesses. The expert witnesses were Mr.

William F. Roggio, Dr. Colin Clarke, and Lt. Col. Steven Wood (Ret.). The fact witnesses were

Col. Thomas McGrath (Ret.), commander of the Afghan Regional Security Integration Command

from May 2007 to August 2008; two servicemembers injured in bellwether attacks, Sgt. Jared

Satoshi Lemon and Cpt. Ryan Gregory Timoney; one civilian kidnapping victim, Mr. Kevin King;

and Ms. August Wildman, the wife of a servicemember killed in a bellwether attack.

During the bellwether hearings, the Court admitted an additional 24 exhibits, including

reports from each of the three experts, military service records, and sealed medical records of some

testifying plaintiffs. Plaintiffs subsequently submitted proposed findings of fact, see generally

Proposed Findings of Fact [ECF No. 70-1] (“Proposed Findings”), conclusions of law, see

generally Pls.’ Proposed Conclusions of Law [ECF No. 70-2] (“Proposed Conclusions”), and

supplemental information and briefing on the damages of the bellwether plaintiffs, see generally

Proposed Findings of Fact Concerning Damages [ECF No. 72] (“Proposed Damages Findings”);

Pls.’ Suppl. Br. & Proposed Conclusions of Law Concerning Damages [ECF No. 73] (“Proposed

Damages Conclusions”), as well as a motion to adopt an administrative plan for litigation of non-

bellwether claims, see generally Pls.’ Mot. to Appoint Special Masters & Adopt Admin. Plan

Concerning Special Masters [ECF No. 74] (“Special Masters Mot.”).

6
D. Expert Qualifications and Methodology

Plaintiffs’ three expert witnesses and their reports are important to this case because they

form the backbone of plaintiffs’ claim that Iran is responsible for plaintiffs’ injuries, and because

they provide important context for the bellwether attacks. Accordingly, the Court will briefly

summarize the experts’ qualifications, the methodologies they employed, and the main topics they

discussed and on which they reported.

1. Mr. William F. Roggio

The Court qualified Mr. Roggio as an expert “in the field of Middle Eastern terrorism.”

Tr. I [ECF No. 62] at 21:21–25. 4 Roggio is a senior fellow at the Foundation for Defense of

Democracies where he edits the Foundation’s Long War Journal, a publication he established in

2007 to report on the global “war on terror.” Tr. I at 17:4–18, 18:13; see Expert Report of William

F. Roggio [ECF No. 59-1] (“Roggio Report”) ¶¶ 1–2. He began tracking the Taliban and al-Qaeda

in the 1990s, first as a servicemember, and then while embedded as a journalist with American,

Canadian, and Iraqi military forces in Iraq. Tr. I at 17:21–18:15; see Roggio Report ¶¶ 2–5. The

Long War Journal tracks state sponsors of terrorism, including Iran; Roggio has written or edited

“well over 5,000” articles for the Journal, roughly 35–40 percent of which “focused on terrorism

in Afghanistan” and 75 percent of which “involved Iran-backed terrorism.” Tr. I at 19:3–11.

Roggio’s work has also been published in various other publications including The New York

Times, The National Review, and Politico, Roggio Report ¶ 4, and he has testified before Congress

five times on terrorism-related issues, id. ¶ 6; Tr. I at 20:20–21:3. At the hearing and in his report,

Roggio addressed the history of the terrorist syndicate in Afghanistan, the history of Iran’s support

4
The transcripts of the bellwether hearings are continuously paginated. For ease of reference, the Court will
cite the transcripts both by volume (e.g., Tr. I, II) and by page and line number.
7
for global terrorism, and Iran’s support for the terrorist syndicate operating in Afghanistan. See

Tr. I at 22:3–24; Roggio Report ¶¶ 8–10. Roggio relied on a wide array of evidentiary sources,

including proclamations from terrorist groups, U.S. government reporting, scholarly analyses, and

contemporaneous press reporting. Roggio Report ¶¶ 11–22; Tr. I at 23:7–24:4.

2. Dr. Colin Clarke

The Court qualified Dr. Clarke as an expert in “Middle Eastern terrorism.” Tr. II [ECF

No. 63] at 136:19–23. Dr. Clarke is the Director of Policy and Research at the Soufan Group, an

intelligence consulting firm specializing in “[t]errorism, insurgency, . . . [and a] whole range of

national-security-type topics and issues.” Id. at 130:22–131:9; see Expert Witness Report, Dr.

Colin Clarke [ECF No. 59-2] (“Clarke Report”) at 1–3. Before his work at the Soufan Group, Dr.

Clarke served as an adjunct and assistant professor teaching courses on terrorism and insurgency,

worked as a political scientist for the RAND Corporation advising federal government actors, and

presented research around the world, including to the U.S. military. Tr. II at 132:2–133:5. As a

part of his work, Dr. Clarke travelled to Afghanistan to work on an interagency task force

researching the confluence of Afghan officials and terrorists in corrupt activities such as drug

trafficking. Id. at 133:6–22. In the present case, Dr. Clarke’s research centered on providing “a

history and overview of the Taliban, including its organizational structure . . . to describe the

relationship between Iran and the Taliban,” and assessing whether the Taliban was involved in

particular attacks. Tr. II at 134:19–25; Clarke Report at 1. In rendering his opinion, Dr. Clarke

examined primary and secondary sources and employed a “comparative analysis method” to

determine whether his conclusions were “consistent with those of other scholars and practitioners.”

Clarke Report at 4; see Tr. II at 135:1–136:1.

8
3. Lt. Col. Steven Wood (Ret.).

The Court qualified Lt. Col. Wood as an expert in “attack attribution analysis.” Tr. IV

[ECF No. 66] at 361:15–17, 362:2–8. Lt. Col. Wood is currently the Director of Corporate

Development for Data Machines Corporation, an artificial intelligence company. Expert Report

of Steven A. Wood, LTC, USA (Ret.) [ECF No. 59–3] (“Wood Report”) ¶ 1. He has “extensive

experience in intelligence and weapons analysis related to U.S. counterterrorism operations,”

especially in Afghanistan. Wood Report ¶ 1. Lt. Col. Wood served in the U.S. Army for 22 years,

including service in the Joint Improvised Explosive Device Defeat Organization (“JIEDDO”), and

in Combined Joint Task Force Paladin, a military command in Afghanistan “dedicated to the

counter-IED fight.” Tr. IV at 353:8–355:9; Wood Report ¶ 2. He also worked as Director of

Operations for the Advanced Geospatial Intelligence office at the National Geospatial-Intelligence

Agency, where he “developed and managed processes for targeting Afghan insurgent groups and

their logistics supply chain.” Wood Report ¶ 3; Tr. IV at 355:12–356:6. Throughout the mid-to-

late 2010s, Lt. Col. Wood repeatedly deployed to Afghanistan to serve as an intelligence and

operations advisor. Wood Report ¶ 3; Tr. IV at 356:14–357:18.

Lt. Col. Wood rendered opinions about the operations of the terrorist syndicate in

Afghanistan from 2007 to 2019, the syndicate’s responsibility for each of the eleven bellwether

attacks, and whether Iran’s support enhanced the syndicate’s ability to commit its attacks. Wood

Report ¶ 7. He relied on similar primary sources as those used by Mr. Roggio and Dr. Clarke,

particularly information provided by terrorist groups and analysis from U.S. government reports,

in addition to secondary sources like press reports and academic articles. Wood Report ¶ 9.

9
II. Legal Standard

Although a more thorough discussion of the legal framework applicable to default actions

under the FSIA will follow, the Court will begin by setting out the relevant legal and evidentiary

standards. Federal Rule of Civil Procedure 55(b) provides that, where damages sought from a

defaulting party are not for a sum certain or readily susceptible to computation, “the party must

apply to the court for a default judgment.” The entry of a default judgment “is not automatic,”

Mwani v. bin Laden, 417 F.3d 1, 6 (D.C. Cir. 2005); in the context of the FSIA, a court may not

enter a default judgment against a foreign state “unless the claimant establishes his claim or right

to relief by evidence satisfactory to the court,” 28 U.S.C. § 1608(e); accord Roeder v. Islamic

Republic of Iran, 333 F.3d 228, 232 (D.C. Cir. 2003).

“‘[T]he FSIA leaves it to the court to determine precisely how much and what kinds of

evidence the plaintiff must provide,’ and ‘[u]ncontroverted factual allegations that are supported

by admissible evidence are taken as true.’” Karcher, 396 F. Supp. 3d at 21 (alterations in original)

(first quoting Han Kim v. Democratic People’s Republic of Korea, 774 F.3d 1044, 1047 (D.C. Cir.

2014); and then quoting Thuneibat v. Syrian Arab Republic, 167 F. Supp. 3d 22, 33 (D.D.C.

2016)). In default-judgment cases involving terrorism, courts should liberally construe the Federal

Rules of Evidence to ensure that state sponsors of terrorism cannot “effectively immunize

themselves by killing their victims, intimidating witnesses, and refusing to appear in court.” Han

Kim, 774 F.3d at 1048. “[I]ndeed, the quantum and quality of evidence that might satisfy a court

can be less than that normally required.” Owens v. Republic of Sudan, 864 F.3d 751, 785 (D.C.

Cir. 2017) (internal citation omitted), vacated & remanded on other grounds sub nom. Opati v.

Republic of Sudan, 140 S. Ct. 1601 (2020).

10
III. Findings of Fact

At this stage in the litigation, the issue before the Court is whether Iran is liable for the

eleven bellwether attacks against U.S. servicemembers and nationals in Afghanistan between 2008

and 2017. The following findings of fact are based on testimony presented at the bellwether

hearing and the evidence submitted before and during that hearing; the Court was also guided by

plaintiffs’ thorough proposed findings of fact. The following findings will be divided into three

major categories: (A) the existence of a terrorist syndicate operating in Afghanistan during the

relevant time period; (B) Iran’s material support for that syndicate; and (C) the syndicate’s

responsibility for each of the bellwether attacks in this case. 5

A. The Terrorist Syndicate Operating in Afghanistan

From at least 2006 to 2019, multiple terrorist groups operated in Afghanistan, most

prominently including the Taliban. Tr. I at 25:24–26:21 (Roggio); see Roggio Report ¶¶ 27–28,

31, 33. Many of these groups—including the Taliban, the Haqqani Network, the Kabul Attack

Network, and al-Qaeda—made up a terrorist “syndicate,” see, e.g., Tr. I at 25:24–26:21 (Roggio);

Roggio Report ¶¶ 23, 32–33, which Dr. Clarke defined as “a group of terrorists or terrorist

organizations combined to promote a common interest,” Clarke Report at 12. The syndicate at

issue here “came together to attack Western and Afghan government targets.” Id.; accord Roggio

Report ¶ 23 (“The Syndicate provided a superstructure that organized and facilitated a range of

terrorist attacks in Afghanistan.”). In 2009, then-Secretary of State Hillary Clinton explained that

the U.S. government saw these groups “not as separate independent operators that occasionally

5
The Court’s subject-matter jurisdiction also depends in part upon these findings because a foreign state is
not entitled to sovereign immunity against suits seeking damages for “the provision of material support or resources”
for acts of “extrajudicial killing” or “hostage taking.” 28 U.S.C. § 1605A(a)(1). The Court will address its jurisdiction
under 28 U.S.C. § 1605A and § 1330 below, after setting forth its findings of fact.
11
cooperate with one another, but as part of a syndicate of terrorism. . . . [T]he level of operational

cooperation, training, equipping, financing has grown exponentially.” Afghanistan: Assessing the

Road Ahead: Hearing Before the S. Comm. on Foreign Rels., 111th Cong. 24 (2009) (statement

of Sec. Hillary Clinton, U.S. Dep’t of State); see Roggio Report ¶ 28; Tr. I at 26:22–28:7, 50:19–

51:6 (Roggio); Clarke Report at 12.

The members of the terrorist syndicate operating in Afghanistan (“the Syndicate”)—the

Taliban, al-Qaeda, the Haqqani Network, and the Kabul Attack Network—shared close strategic,

tactical, and operational coordination, which enabled each group to make its operations more lethal

for American forces. Tr. I at 25:24–26:21 (Roggio). And they shared a common goal: re-

establishing the Islamic Emirate by driving the United States and its allies out of Afghanistan by

“driving up the cost for U.S. presence . . . by killing and wounding American troops.” Id. at 26:11–

21; Roggio Report ¶ 23; accord Clarke Report at 82; Tr. II at 162:11–18 (Clarke); Wood Report

¶ 95.

There were four major players in the Syndicate: the Taliban, the Haqqani Attack Network,

the Kabul Attack Network, and al-Qaeda.

1. The Taliban

The Taliban was originally founded in 1994, in the aftermath of the Soviet Union’s

occupation of Afghanistan, by a group of students who had studied at religious schools in Pakistan.

Tr. II at 137:25–138:13 (Clarke); Roggio Report ¶¶ 36–37. Mullah Mohammad Omar organized

these students into a Sunni jihadist fighting force and mobilized them to overthrow the Afghan

government and impose Sharia law. Tr. I at 29:23–30:15 (Roggio); Roggio Report ¶ 37. From its

home in the Kandahar Province, in southeastern Afghanistan, the Taliban began to seize territory;

in 1996, the group captured the capital city of Kabul and proclaimed the Islamic Emirate of

12
Afghanistan. Tr. I at 30:16–17 (Roggio); Roggio Report ¶ 39. After Osama bin Laden was

expelled from Sudan in 1996, he returned to Afghanistan, where the Taliban provided him and the

rest of al-Qaeda with a safe haven in exchange for financial support. Tr. II at 139:21–140:3

(Clarke); see Roggio Report ¶¶ 86–89. By September 2001, the Taliban de facto controlled the

country, though they did not function as a government. Roggio Report ¶ 39, 41.

After the terrorist attacks against the United States on September 11, 2001, the Taliban

refused to surrender bin Laden to the United States. Roggio Report ¶ 42; Tr. I at 49:23–50:18

(Roggio). This ultimately led to the American invasion of Afghanistan on October 7, 2001.

Roggio Report ¶ 42; Tr. II at 140:15–18 (Clarke). By December, the Taliban had withdrawn from

Kabul and were effectively defeated; the group’s leadership and fighting forces fled to countries

including Iran and Pakistan. Tr. II at 140:16–23 (Clarke); Roggio Report ¶ 42. In December 2001,

the United Nations authorized the formation of the International Security Assistance Force

(“ISAF” or “Coalition”) to maintain security in Kabul and support the Afghan government’s

efforts to rebuild; NATO took command of ISAF in August 2003. Roggio Report ¶ 43. In January

2004, Afghanistan ratified a new constitution and formed the Islamic Republic of Afghanistan, led

by President Hamid Karzai. Id.

The Taliban was not invited to participate in the process of drafting the constitution or

forming the government. Roggio Report ¶ 43. Neither the UN nor the United States ever

recognized the Taliban as the lawful government of Afghanistan, and from 2006 to 2019 (the time

period relevant to the attacks at issue in this litigation), the lawful government of Afghanistan was

the Islamic Republic of Afghanistan. 6 Roggio Report ¶ 41; Tr. I at 31:10–12 (Roggio). Neither

6
Indeed, even before September 11, 2001, only Pakistan, Saudi Arabia, and the United Arab Emirates ever
recognized the Taliban as the government of Afghanistan. By late November 2001, all three had withdrawn their
recognition of the Taliban. Roggio Report ¶¶ 41–42.
13
that lawful government nor any regularly constituted Afghan court ever authorized any Syndicate-

led terrorist attack against U.S. forces. Tr. I at 31:10–18 (Roggio).

But as the lawful Afghan government took form, “the Taliban—with the help of Iran, Al

Qaeda, Pakistan, and other jihadist allies—plotted its comeback.” Roggio Report ¶ 44. Its three

primary goals were to expel the United States and NATO forces, to undermine and defeat the new

Afghan government, and to reestablish the Islamic Emirate of Afghanistan. Id. From its extensive

infrastructure of training camps, command centers, and supply depots just across Afghanistan’s

southeastern border in Pakistan, the Taliban began to launch offensives against NATO, U.S., and

Afghan forces. Id. These attacks increased in frequency and spread throughout the country: by

2006, ISAF was engaged in military operations across southern Afghanistan, and by 2008, Taliban

insurgency was spreading across the country. Id. ¶¶ 44–45. In 2009, the United States responded

with a troop surge, adding 30,000 troops to the almost-70,000 already present in Afghanistan. Id.

¶ 45. Although the surge was temporarily effective, the Taliban regained its foothold quickly after

the United States began to withdraw forces in 2011. Id. ¶¶ 45–46.

The Taliban is organized under an emir, who also functions as a faith leader (originally

Mullah Mohammad Omar, now Mullah Hibatullah Akhundzada). Tr. I at 32:15–20 (Roggio); Tr.

II 141:4–7, 144:23–145:1 (Clarke). Under the emir is a leadership council called the Rahbari

Shura, also known as the Quetta Shura. Tr. I at 32:22–33:4 (Roggio); Tr. II at 141:7–15 (Clarke).

The Rahbari Shura provides strategic guidance to other, lower-level shuras and Taliban groups

based on guidance from the emir. Tr. I at 32:22–33:4 (Roggio); Tr. II at 142:6–12 (Clarke); Roggio

Report ¶¶ 51–57. During the times relevant to these events, the Rahbari Shura also collected and

disseminated funds and resources to regional shuras and other groups. Tr. II at 145:7–12 (Clarke).

The Rahbari Shura exerts “a significant or high level of control” over the Taliban; when it issues

14
“key directives on how to fight, on how to implement Sharia law or what to do with the courts, . . .

these directives are followed.” Tr. I at 33:7–16 (Roggio).

Below the Rahbari Shura are other regional shuras, headed by leaders from the Rahbari

Shura. Tr. I at 34:21–35:6 (Roggio); Tr. II at 141:5–10 (Clarke). Within their regions, these lower

level shuras direct military and support operations and take political actions like appointing local

governors. Roggio Report ¶ 51; Tr. I at 35:12–25 (Roggio). The Miranshah (also spelled

“Miramshah”) Shura, formed in 2002 or 2003, pledged fealty to the Rahbari Shura. Tr. II at

141:20–142:5 (Clarke). It was based in Pakistan, on the southeastern border of Afghanistan, but

its influence spread over time to include Loya Paktia, Ghazni, Logar, and Wardak Provinces of

Afghanistan, as well as Kabul. Tr. I at 39:21–40:5 (Roggio); Tr. II at 148:13–24 (Clarke); Clarke

Report at 49. Among the leaders of the Miranshah Shura were Jalaluddin Haqqani and later his

son, Sirajuddin (“Siraj”) Haqqani, whose terrorist group, the Haqqani Network, is discussed

further below. Tr. II at 141:20–23 (Clarke).

In 2005, the Taliban formed the Peshawar Shura to exert control over the northern and

northeastern regions of Afghanistan—specifically in Nangarhar, Laghman, Kunar, Nuristan,

Wardak, Parwan, and Kapisa Provinces—as well as in Kabul in collaboration with the Miranshah

Shura. Clarke Report at 12–13, 29; Tr. II at 148:5–10 (Clarke). Sirajuddin Haqqani installed his

brother, Khalil Haqqani, as leader of the Peshawar Shura. Clarke Report at 14. Next, in 2007, the

Mashhad Shura opened as an office of the Rahbari Shura in Iran. Tr. II at 155:4–24 (Clarke). This

shura served both diplomatic and terrorist functions, liaising between the Taliban and the Islamic

Revolutionary Guard Corps (“IRGC”). Clarke Report at 31. The Mashhad Shura grew into its

own regional shura and, with Iranian support, opened Taliban bases in Iran and began to operate

in western and northwestern Afghanistan. Id.; Tr. I at 105:14–24 (Roggio). Finally, in 2015, an

15
element of the Peshawar Shura broke off to form the Shura of the North, headed by the former

head of the Peshawar Shura’s military commission. Tr. II at 155:20–24 (Clarke); Clarke Report

at 32. By 2017, the Shura of the North claimed authority over northeastern Afghanistan and had

expanded its operations into Laghman and Nangarhar Provinces. Clarke Report at 32–33. In

addition, this shura received significant financial support from Iran. Id. Other groups within the

Taliban’s leadership structure worked as committees with specific tasks, including defense,

finance, and intelligence, implementing strategy and directives in their topical areas. Tr. I at

34:24–35:11 (Roggio).

2. The Haqqani Network

The Haqqani Network, led by Jalaluddin and Siraj Haqqani, is a terrorist faction of the

Taliban which planned and executed terrorist attacks throughout Afghanistan, most prominently

in the eastern and southeastern regions of the country, in Paktia, Paktika, and Khost Provinces. Tr.

I at 37:9–38:15, 46:25–47:6 (Roggio); Tr. II at 138:24–139:7 (Clarke), 191:22–192:15 (McGrath);

Roggio Report ¶ 59. In September 2012, the State Department designated the Haqqani Network

as a Foreign Terrorist Organization (“FTO”), a designation that remains in place today. Roggio

Report ¶ 60; U.S. Dept’ of State, Bureau of Counterterrorism, Foreign Terrorist Organizations,

https://www.state.gov/foreign-terrorist-organizations/ (last accessed July 5, 2022). In contrast, the

Taliban itself is a Specially Designated Global Terrorist (“SDGT”) organization. Tr. I at 46:10–

12 (Roggio). But despite this apparent distinction, there is “no difference between the Haqqani

Network and the Taliban. They are one and the same.” Id. at 39:8–9. They share leadership

(including, as noted above, Jalaluddin and Sirajuddin Haqqani), id. at 37:16–20, 38:10–15, and the

two groups reject any distinction between themselves, id. at 39:8–18; Roggio Report ¶¶ 60, 73–

16
74; see Tr. II at 143:8–20 (Clarke). 7 For instance, in response to the designation of the Haqqani

Network as an FTO, the Taliban specifically disclaimed the view that the two groups are distinct.

Tr. I at 43:1–44:6 (Roggio); Roggio Report ¶¶ 65–67. The Taliban and the rest of the Syndicate

benefitted from the Haqqani Network’s expertise in conducting acts of terrorism, some of which,

like the use of suicide tactics, the Haqqani Network gleaned from al-Qaeda. Tr. I at 44:9–46:4

(Roggio); Roggio Report ¶¶ 78–80.

3. The Kabul Attack Network

The Kabul Attack Network, another subset of the Taliban and the greater Syndicate,

focused on conducting effective attacks in and around Kabul to achieve the Syndicate’s goal of

expelling American and Coalition forces and weakening the lawful Afghan government. Tr. I at

59:8–60:7 (Roggio); Tr. II at 149:6–12 (Clarke); Roggio Report ¶¶ 117–18. The Haqqani Network

and its leaders played a key role in the group. Roggio Report ¶ 120; Tr. II at 149:15–19 (Clarke).

In creating the Kabul Attack Network, the Syndicate “pooled its resources,” gathering and sharing

personnel, equipment, and safe houses to carry out high-profile attacks in Kabul “that would make

the news [and] cause discomfort in the United States” with targets including hotels, schools,

mosques, restaurants, military headquarters and convoys, and Afghan government buildings. Tr.

I at 59:23–60:7 (Roggio); see Roggio Report ¶¶ 118–22; Clarke Report at 12–13.

4. Al-Qaeda

Al-Qaeda is a Sunni jihadist organization that seeks to establish a global caliphate. Tr. I at

48:21–24 (Roggio). Founded by Osama bin Laden and Abdullah Azzam as the Soviet occupation

of Afghanistan ended, al-Qaeda sought to harness the network of Afghani mujahedeen fighters

7
The U.S. government often designates one element of a terrorist group before the group itself, like the
IRGC’s Qods Force (designated as an SDGT organization in 2007) and its parent group, the IRGC (designated in
2017). Roggio Report ¶ 76 & n.162.
17
into a unified force. Id. at 48:24–49:8; see Roggio Report ¶¶ 81–82. Al-Qaeda proclaimed that it

was at war with the United States and Israel in 1996 and 1998. Tr. I at 49:15–17 (Roggio); Roggio

Report ¶ 86. It has carried out terrorist attacks around the world, including the 1998 attacks on the

U.S. embassies in Kenya and Tanzania and the September 11, 2001 attacks on the United States.

Tr. I at 49:17–20 (Roggio). The U.S. State Department designated al-Qaeda as an FTO in October

1999. Roggio Report ¶ 91; Pls.’ Ex. 758 (press release on FTO designation of al-Qaeda). After

the events of September 11, 2001, the Taliban strengthened its ties to al-Qaeda by refusing to hand

over bin Laden and other senior al-Qaeda leaders to the U.S. government. Roggio Report ¶ 93. In

return for safe haven and support inside Afghanistan, al-Qaeda assisted the Taliban in recapturing

Afghanistan. Roggio Report ¶¶ 93–95; Clarke Report at 37–39; Tr. I at 49:25–50:18 (Roggio).

Like the other groups in the Syndicate, al-Qaeda shares personnel with the Taliban. Tr. I

at 51:1–6 (Roggio). These so-called “dual-hatted terrorists,” who fight for both the Taliban and

al-Qaeda, include Sirajuddin Haqqani, who has described the Taliban’s cooperation with al-Qaeda

as “at the highest limits.” Roggio Report at ¶ 104 (citation omitted); Tr. I at 51:19–52:13 (Roggio).

Other dual-hatted terrorists include leaders and members of regional Taliban shuras and members

of the Haqqani Network. E.g., Tr. I at 51:2–5, 54:7–23, 55:12–24 (Roggio); Roggio Report

¶¶ 101–06.

Al-Qaeda provided significant operational support to the Taliban in planning and

authorizing terrorist attacks. This included aiding the Taliban in developing tactics, especially

suicide bombings, by providing ideological and technical expertise; al-Qaeda also paid the families

of Taliban suicide bombers. Roggio Report ¶ 108; Tr. I at 56:14–24 (Roggio). Taliban insurgents

8
Plaintiffs provided paper and electronic copies of their exhibits to the Court during the evidentiary hearing.
They are not available on the docket.
18
trained at al-Qaeda camps both within and outside Afghanistan. Roggio Report ¶¶ 112–13. And

a component of al-Qaeda fought alongside the Taliban and later reorganized and embedded itself

within the Taliban’s structure, fielding small units and embedding military trainers who instructed

Taliban fighters on waging a successful insurgency. Roggio Report ¶ 108; see id. ¶¶ 109–11.

B. Iran’s Material Support for the Terrorist Syndicate

Iran is a major state sponsor of global terrorism, and particularly of terrorism against the

United States. Tr. I at 61:7–12 (Roggio); Roggio Report ¶ 123; see generally Pls.’ Ex. 7 at 172–

73 (U.S. Department of State’s 2007 Country Reports of Terrorism describing Iran as “the most

active state sponsor of terrorism” and citing its support for “Taliban fighters in Afghanistan” and

al-Qaeda members detained in Iran). The United States designated Iran as a state sponsor of

terrorism in 1984, and that designation has remained in place ever since. Tr. I at 79:2–14 (Roggio);

Roggio Report ¶ 125. Iran’s efforts in Afghanistan are part of its mission “to promote its Islamic

revolution throughout the Middle East” and expand its influence by defeating local governments

it perceives as threats and “driv[ing] the U.S. and the West out of the Middle East.” Tr. I at 63:2–

7 (Roggio).

The IRGC is “the primary driver of Iran’s terror activities.” Roggio Report ¶ 126. Founded

by Iran’s first Supreme Leader, it has become an official entity that reports directly to the current

Supreme Leader, Ayatollah Ali Khamenei. Id. The IRGC protects Iran’s regime and attempts to

impose its clerical regime on other Muslim nations throughout the Middle East, providing military

forces, directing much of Iran’s economy, and implementing a global campaign of terrorist

activity. Id. Although the IRGC exists in parallel to Iran’s military, it is considered “the military

vanguard of Iran.” Id. ¶ 127 (citation omitted). The U.S. Department of State designated the IRGC

as an FTO in 2019, citing its support for terrorist organizations including al-Qaeda. Pls.’ Ex. 74

19
at 1–3. “The IRGC has been directly involved in terrorist plotting[, and] [i]ts support for terrorism

is foundational and institutional . . . .” Tr. I at 70:18–20 (Roggio) (quoting Pls.’ Ex. 74 at 2).

The IRGC’s special operations branch, the Qods Force, is “Iran’s primary mechanism for

cultivating and supporting terrorists abroad,” and Iran uses it “to implement foreign policy goals,

provide cover for intelligence operations, and create instability in the Middle East.” Pls.’ Ex. 15

at 300 (State Department’s 2015 Country Reports on Terrorism); see Tr. I at 69:17–25 (Roggio);

Roggio Report ¶ 130. The Qods Force was designated as an SDGT in October 2007. Roggio

Report ¶ 76; Tr. I at 47:14–15, 70:1–2 (Roggio). Iran’s Supreme Leader directly oversees the

Qods Force’s actions. Tr. I at 72:7–12, 20–22 (Roggio); Roggio Report ¶¶ 131, 133; see also Pls.’

Ex. 221 at 27 (declassified 2007 Counter-IED Operational Integration Center report providing

organizational chart of Qods Force leadership). The Qods Force works with non-Iranian partners,

proxies, and affiliates, notably Hezbollah, which was responsible for, among other attacks, the

1983 bombing of the U.S. Marine barracks in Beirut. Tr. I at 63:9–64:14 (Roggio); Roggio Report

¶¶ 139, 141–42; Pls.’ Ex. 198 at 68 (2019 Defense Intelligence Agency report on Iran Military

Power).

Although Iran is a Shia regime, the Qods Force allies with certain Sunni terrorist groups,

including Hamas. Tr. I at 64:15–65:1 (Roggio). In places where there are no major Shia

organizations with which to ally, Iran partners with other groups (like the Taliban in Afghanistan)

that share its goals of expelling the United States and reinstating the Islamic Emirate. Id. at 64:15–

65:7. The Qods Force’s branch in Afghanistan is known as the Ansar Corps or the Fourth Corps.

Id. at 74:16–25; Roggio Report ¶¶ 132, 152–53. From its headquarters in Mashhad, Iran, very

close to Iran’s border with Afghanistan, Roggio Report ¶ 152; Pls.’ Ex. 207 at 7 (JIEDDO report

listing locations of Qods Force command locations), the Ansar Corps directs terrorist and political

20
operations on Iran’s behalf inside of Afghanistan, Tr. I at 75:1–20 (Roggio); Pls.’ Ex. 194 at 6

(2011 Counter Insurgency Targeting Program report on Iran’s activity in Afghanistan). 9

In addition to its relationship with the Taliban, and by extension the rest of the Syndicate,

Iran shares a close relationship with al-Qaeda. Tr. I at 108:9–11 (Roggio); see generally Roggio

Report ¶¶ 231–47. Iran has supported al-Qaeda’s activities around the world (for example, in the

1998 Hezbollah/al-Qaeda attacks on the U.S. embassies in Kenya and Tanzania). Tr. I at 108:19–

109:9 (Roggio); Roggio Report ¶¶ 233–34. After the September 11 attacks, Iran and al-Qaeda had

a “secret deal” that Iran would serve as al-Qaeda’s base of operations and provide safe haven for

al-Qaeda terrorists and their families who were driven from Afghanistan. Tr. I at 109:10–21

(Roggio); Roggio Report ¶¶ 235–37. In 2007, Osama bin Laden described Iran as al-Qaeda’s

“main artery for funds, personnel, and communication, as well as the matter of hostages.” Pls.’

Ex. 252 at 1 (translation of Osama bin Laden’s statement); see Tr. I at 110:4–111:20 (Roggio)

(describing how the U.S. government came to possess that statement); Roggio Report ¶ 236.10

And the U.S. government has linked several high-ranking al-Qaeda officers to Iran in terrorist

designations and other reporting. E.g., Tr. I at 115:2–118:24 (Roggio); Roggio Report ¶¶ 237–39,

247. The same close relationship extended to al-Qaeda’s operations in Afghanistan: Iran’s support

of al-Qaeda allowed it to exist insulated from the pressures of American and Coalition forces in

9
The evidence confirming Iran’s material support of the Syndicate includes the terror designations of
particular IRGC and Qods Force officers. Tr. I at 77:21–78:5 (Roggio). In August 2010, for example, the U.S.
Treasury Department designated the commander of the Ansar Corps, General Hossein Musavi, as an SDGT, in part
because of his responsibility for Qods Force activities in Afghanistan and provision of financial and other support to
the Taliban. Id. at 78:15–79:1; Roggio Report ¶ 152 (also noting that another Qods Force senior officer, Colonel
Hasan Mortezavi, was designated as an SDGT for his provision of financial and material support to Taliban members);
see Pls.’ Ex. 73 (Treasury Department press release on designations of Musavi, Mortezavi, and other Qods Force
senior officers).
10
Indeed, bin Laden chided al-Qaeda subordinates for animosity towards the Shia, reasoning that a
relationship with Shia Muslims was important in maintaining al-Qaeda’s relationship with Iran. Pls.’ Ex. 252 at 1–2;
Tr. I at 110:4–14 (Roggio); see Roggio Report ¶ 232.
21
Afghanistan and, in turn, al-Qaeda provided tactical and operational support to the Syndicate in

Afghanistan. Tr. I at 119:20–120:9 (Roggio).

Iran supports terrorist proxies as part of its overarching mission to promote Islamic

revolution in the Middle East. Tr. I at 62:25–63:7 (Roggio); Roggio Report ¶¶ 124–25. In

Afghanistan, Iran’s goal—much like the Syndicate’s—was to end the American and Coalition

occupation by killing and wounding American soldiers. Tr. I at 120:11–18 (Roggio); Roggio

Report ¶ 248. Iran’s support significantly contributed to the Syndicate’s success in this mission,

Tr. I at 121:2–5 (Roggio); the United States nearly defeated the Taliban in 2001, but Iran’s safe

haven and support allowed the Taliban to regroup, and Iran’s well-developed expertise in

supporting terrorist insurgencies around the world enabled the Taliban to become stronger and

more effective, see generally Roggio Report ¶¶ 241–49. Iran’s support was fungible: although

Iran, the IRGC, and the Qods Force may not have been involved in the details of individual attacks,

the money, training, weapons, and expertise Iran provided were critical to the Syndicate’s success.

Tr. I at 123:21–124:13 (Roggio). Through cross-cutting organizational support, Iran substantially

contributed to all eleven of the bellwether attacks at issue in this proceeding. Id. at 122:25–123:21;

Roggio Report ¶ 256.

Iran provided four main types of material support to the Syndicate: weapons, training,

financial support, and safe haven. Tr. I at 61:15–18 (Roggio); see Pls.’ Ex. 198 at 68. Iran also

assisted in the Taliban’s drug-trafficking operations, which helped to finance the Syndicate’s

efforts to expel U.S. troops and restore the Islamic Emirate. Tr. II at 152:12–153:17 (Clarke);

Clarke Report at 82–83.

22
1. Weapons and Explosives

Iran provided a range of weapons to the Syndicate including small arms (e.g., AK-47s and

other assault rifles), anti-tank missiles, rocket-propelled grenades, surface-to-air missiles,

improvised explosive devices (“IEDs”), explosively formed penetrators (“EFPs”), rockets,

mortars, indirect fire weapons, recoilless rifles, PKM machine guns, ammunition, and components

for suicide attacks (e.g., triggers and detonators). Roggio Report ¶¶ 182–84; Tr. I at 83:15–84:1

(Roggio); Tr. II at 165:1–7 (Clarke); Pls.’ Ex. 198 at 68. Iran has provided lethal weapons to the

Taliban in Afghanistan since at least 2006, Pls.’ Ex. 7 at 192 (State Department’s 2009 Country

Reports on Terrorism), and its support has not been limited to a single region: weapons from Iran

flowed throughout all provinces, Tr. I at 87:13–17 (Roggio). Iran’s goal in providing these

weapons was to increase the Syndicate’s power, and in so doing, to combat the U.S. military

presence in Afghanistan. Roggio Report ¶ 186 (timeline and sources of Iranian exports of weapons

to Afghanistan); Tr. I at 87:3–12 (Roggio); Pls.’ Ex. 207 at 7 (“Iran provides arms and funding to

Afghan insurgents . . . . Iran’s intentions are . . . to develop, fund, and arm proxy networks to

leverage against the perceived U.S. aim of pursuing an active regime change doctrine in Iran.”). 11

2. Training

Iran provided a variety of training to Taliban fighters, including on small unit and infantry

tactics, techniques for executing complex attacks (for example, initiating an attack with a suicide

11
For example, declassified intelligence reporting shows that the IRGC provided weapons, including IEDs,
to the Taliban’s shadow governors of various provinces. The shadow governor of Farah Province, Haji Yusouf,
received 180 machine guns, which he disseminated to subordinate commanders throughout the province to attack
Afghan and Coalition forces, amplifying the impact of the Taliban and Iran across Farah Province. Pls.’ Ex. 227 at 6
(2011 National Ground Intelligence Center (“NGIC”) reporting depicting and describing this distribution of weapons);
see Tr. I at 89:12–22, 90:10–92:1 (Roggio). And the shadow governor of Helmand Province, Mullah Naim Barich,
the Taliban’s main representative to Iran, received Iranian weapons which he disseminated throughout Helmand and
Nimroz Provinces to attack U.S. and Coalition forces. Pls.’ Ex. 228 at 19 (2014 NGIC reporting depicting and
describing this provision of weapons); see Tr. I at 92:2–93:17 (Roggio).
23
bomb), and intelligence gathering and planning. Tr. I at 94:18–95:4 (Roggio); Tr. II at 163:15–

165:7 (Clarke); see generally Roggio Report ¶¶ 202–22. The Qods Force sent trainers into

Afghanistan to teach Taliban fighters how to use various weapons like small arms, explosives, and

indirect-fire weapons. Tr. I at 95:23–96:6 (Roggio); Roggio Report ¶¶ 211–13; Pls.’ Ex. 9 at 192

(State Department’s 2009 Country Reports on Terrorism describing Qods Force training in

Afghanistan). Iran also trained Taliban fighters inside Iran, Tr. I at 96:7–10 (Roggio): from 2005

or 2006 until the fall of the Afghan government in 2021, Iran operated training camps near its

border with Afghanistan, with sites in Tehran, Mashhad, Zahedan, and the province of Kerman,

id. at 96:15–24; Roggio Report ¶ 218 & fig. 11. This training, free from the pressure of Afghan

and Coalition forces, allowed the IRGC to train Taliban fighters over a longer term and on more

complex tactics. Tr. I at 97:5–25 (Roggio). Taliban fighters who trained in Iran returned to

Afghanistan and trained additional Taliban fighters in the techniques they learned, magnifying the

effect of Iran’s training and exponentially increasing the lethality and efficacy of Taliban attacks

in Afghanistan. Id. at 98:9–19.

3. Financial Support

Iran provided two main forms of financial support to the Syndicate. First, Iran provided

cash to key Taliban leaders so they could buy weapons and other materials to disseminate

throughout the regions where they operated. Tr. I at 98:20–99:3 (Roggio); Roggio Report ¶ 223.

These regions included areas on both Iran’s border with Afghanistan and central Afghanistan,

including Parwan and Kapisa Provinces. Tr. I at 102:12–103:21 (Roggio); Pls.’ Ex. 229 at 15;

Roggio Report ¶¶ 225–28. Iran also funded the Kabul Attack Network to aid in its attacks in the

capital city. Tr. I at 103:11–21 (Roggio). Second, Iran issued bounties on U.S. and Afghan forces.

Roggio Report ¶ 224. Iran paid the Taliban various sums of money for killing U.S. troops or

24
damaging U.S. equipment; this incentivized such attacks and also helped to provide resources for

future Taliban attacks. Id.; Tr. I at 99:3–17 (Roggio). Iran’s financing of the Syndicate was

significant because it both facilitated attacks and reduced the Syndicate’s need to raise its own

funds. Tr. I at 103:22–104:2 (Roggio).

4. Safe Haven

Beginning shortly after the September 11 attacks and the American invasion of

Afghanistan, Tr. I at 104:22–105:13 (Roggio), Iran provided a safe haven within its borders for

Taliban fighters, id. at 104:3–21; Roggio Report ¶ 202. This form of aid soon grew to a more

formal practice after the Taliban opened a regional office in Mashhad, Iran (also the headquarters

of the IRGC’s Ansar Corps) in 2007, which later became the headquarters of the Taliban’s

Mashhad Shura, Tr. I at 105:14–106:3 (Roggio). In November 2009, some of the Taliban’s

shadow governors—those responsible for the Helmand, Nimruz, Kandahar, Farah and Uruzgan

Provinces—traveled to the Iranian city of Zahedan to open a formal office on the Iranian/Afghan

border. Roggio Report ¶ 221; Tr. I at 105:25–106:3, 107:4–25 (Roggio); Pls.’ Ex. 194 at 6. From

this strategic location, Iran was better able to provide other forms of support, including funding

and training, to Syndicate fighters. Tr. I at 108:1–7 (Roggio); see Pls.’ Ex. 194 at 6. These safe

havens in Iran were critical to the Taliban’s insurgency, especially because they allowed Taliban

fighters to organize, plan, and fundraise free from threat of attack and without American

interference. Tr. I at 104:14–21 (Roggio).

5. Drug-Trafficking Operations

Finally, Iran facilitated the Taliban’s drug-trafficking operations. Tr. II at 152:12–15

(Clarke); see generally Clarke Report at 74–82. Trafficking was “highly lucrative” for the Taliban

insurgency, Tr. II at 152:18–23 (Clarke); see also id. at 153:10–17 (estimating that the Taliban

25
earned about $400 million from drug trafficking in 2021); Clarke Report at 76–77. After

recognizing the potential for income, the Taliban became involved in every step of the process,

from taxing poppy farmers to refining and manufacturing poppies into heroin to transporting and

selling the drugs. Tr. II at 152:24–153:9 (Clarke); Clarke Report at 76. Iran facilitated this drug

trafficking by permitting drugs to pass through the Iranian/Afghan border, issuing special license

plates to Taliban vehicles and declining to search those vehicles at border entry points. Tr. II at

153:18–25, 156:1–159:7 (Clarke); Clarke Report at 77–82. This route through Iran gave the

Taliban access to major markets, including Europe and Central Asia. Tr. II at 156:17–23, 157:5–

13 (Clarke). Iran also provided weapons to drug traffickers as they returned to Afghanistan, and

in some instances even worked with smugglers to plan attacks on U.S. forces. Id. at 153:18–25.12

From 2006 to 2019, eighty to ninety percent of the world’s heroin supply came from Afghanistan.

Id. at 157:14–19. The scope of this income—in one expert’s opinion, a level of financial flexibility

“that few insurgent groups can enjoy”—allowed the Taliban to acquire resources for its terrorist

operations, all with Iran’s assistance. Id. at 160:18–161:8; Clarke Report at 82.

C. The Syndicate’s Areas of Operational Dominance (Bellwether Geographies)

Attributing a specific attack to a particular terrorist group—a central issue in this

litigation—requires considering two key factors: geography and the time period in which the

attack took place. Tr. IV at 366:16–367:23 (Wood); Wood Report ¶ 11; see Tr. II at 166:13–20

(Clarke); see generally Clarke Report at 43–44 (discussing which terrorist groups had “operational

dominance” in specific provinces at particular times and, based on those conclusions, opining on

which Syndicate group likely committed attacks in various provinces). Indeed, it is often possible

to attribute an attack to a particular group based solely on geography and time because, at certain

12
Iran engaged in a similar model of drug-trafficking facilitation with Hezbollah. Tr. II at 159:8–19 (Clarke).
26
times and in specific locations, one Syndicate group had such an overwhelming presence that it is

highly likely that group carried out any attacks there. Wood Report ¶ 15; Tr. IV at 375:17–376:3

(Wood). Thus, before explaining its findings regarding the likely perpetrators of the eleven

bellwether attacks, the Court will make findings regarding the Syndicate’s areas of operational

dominance in seven “bellwether regions” of Afghanistan during the time periods relevant to this

case. These findings will also be useful in later attack attributions of non-bellwether attacks. The

Court will adopt a “sliding scale” approach and use the terminology employed by the experts in

this case to describe their levels of certainty, classifying the following geographical findings as

“likely” or “very likely.” See Wood Report ¶ 15.

1. Southern Afghanistan

The Taliban “very likely” carried out all the attacks in this case that occurred in the southern

region of Afghanistan, which comprises Kandahar and Helmand Provinces. Tr. II at 168:22–

169:25, 178:2–16, 183:8–184:7, 186:10–187:11 (Clarke); Tr. IV at 421:7–22 (Wood); Clarke

Report at 44; see generally Clarke Report at 45–48. Those two provinces are traditional areas of

Taliban control, Tr. II at 169:4–6 (Clarke)—indeed, the Taliban originated in Kandahar Province,

Clarke Report at 45—and the Taliban was the most prominent insurgent group in the region from

2006 to 2019, with several different strongholds (including the districts of Zhari, Alakozai, and

Panjwai, Tr. II at 189:3–18 (McGrath)) from which the group launched attacks, id. at 169:6–8

(Clarke). The attacks that took place in southern Afghanistan reflected the Taliban’s typical

tactics, techniques, and procedures (“TTPs”). Id. at 168:22–169:9 (Clarke). The Taliban was also

the main group in Helmand Province, where it controlled large swaths of territory; its Helmand-

based strongholds included the districts of Lashkar Gah, Sangin, Musa Qala, and Nowzad. Id. at

187:2–188:2 (McGrath); Tr. IV at 375:21–376:3, 421:7–22 (Wood); Clarke Report at 46–48. The

27
Taliban claimed responsibility for numerous attacks on U.S. and Coalition forces in both Kandahar

and Helmand from 2008 to 2019. Clarke Report at 45–47. And although other insurgent groups

were present in the area at the same time, “they came nowhere close to rivaling the Taliban’s grip”

on the region. Id. at 48; see also id. at 47 (reaching similar conclusion as to Kandahar Province).

2. Loya Paktia

In Loya Paktia, which comprises Khost, Paktia, and Paktika Provinces, the Haqqani

Network “very likely” carried out all the attacks in this case. Tr. II at 170:16–20 (Clarke); see

generally Clarke Report at 44, 48–52. Loya Paktia, a culturally Pashtun 13 area in southeastern

Afghanistan, is a traditional stronghold of the Haqqani Network. Clarke Report at 48; Tr. I at

37:7–15 (Roggio). Locals of the region are members of the same tribe as Haqqani Network

leaders, and they generally support the Network and the Taliban more broadly. Tr. IV at 488:14–

17 (Wood). The Taliban’s Miranshah Shura, led by Jalaluddin and Sirajuddin Haqqani, oversaw

attacks within Loya Paktia. Tr. II at 148:13–18 (Clarke); Clarke Report at 27; Wood Report ¶¶ 82–

84. Khost Province is a stronghold of the Haqqani Network, and in 2005 Sirajuddin Haqqani

identified himself as the leader of the Taliban’s military committee for Paktia, Paktika, Khost,

Ghazni, and Logar Provinces. Clarke Report at 48. As with the Taliban in Kandahar and Helmand,

the attacks carried out in Loya Paktia reflected the Haqqani Network’s standard TTPs. Tr. II at

170:16–171:8 (Clarke). The Network also claimed responsibility for several attacks in the region

during the 2007 to 2012 period, and no other group had a meaningful presence in the region.

Clarke Report at 48–49.

13
The Pashtuns, the largest ethnic group in Afghanistan, are a group of ethnic Muslim tribes which were
present in Afghanistan before the Soviet occupation; Pashtun members “are traditionally selected for senior role” in
the Afghan government, and the group “is largely defined by” its language (Pashto), its Muslim faith, and its ethical
code (Pashtunwali). Wood Report ¶ 23(a); see Roggio Report ¶ 38; Wood Report at 43, 69; Tr. IV at 434:21–24,
456:16–19 (Wood).
28
3. Kabul Province

Members of the aptly named Kabul Attack Network, working jointly with the Taliban

(including the Haqqani Network), al-Qaeda, and other Syndicate members, “very likely” carried

out all the attacks in this case that occurred in Kabul Province. Tr. II at 171:9–17 (Clarke); see

generally Clarke Report at 63–65. The attacks reflected the Kabul Attack Network’s TTPs, Tr. II

at 171:9–17 (Clarke), particularly its emphasis on “spectacular” attacks, id. at 149:2–150:1; Tr. IV

at 444:5–13 (Wood). The Kabul Attack Network likely faced no challenges to its operational

dominance (at least until ISIS-Khorasan’s first attack in Kabul in 2016), and it claimed

responsibility for numerous attacks prior to the formation of ISIS-Khorasan. 14 Clarke Report at

63–65.

4. Eastern Afghanistan/“N2KL”

In the eastern Afghanistan region comprising Nangarhar, Nuristan, Kunar, and Laghman

Provinces—collectively known as “N2KL”—the Taliban, with participation from al-Qaeda,

“likely” carried out all the attacks in this case. Tr. II at 171:18–24 (Clarke); see generally Clarke

Report at 44, 58–63. The Taliban (with al-Qaeda, which had a strong presence in the region

because of its safe haven just across the border in Pakistan, Tr. II at 172:7–16 (Clarke)) was the

dominant terrorist group in the region during the relevant time period, and the tactics of these

attacks reflect the TTPs it usually employed. Id. at 171:25–172:6.

Based on contemporary reporting and the Taliban’s own claims of responsibility for

numerous attacks, it is likely that the Taliban was the dominant terrorist organization in Kunar

Province from 2007 to 2012; in Laghman Province from at least 2009 to 2011; in Nangarhar

14
One attack in this case occurred after ISIS-Khorasan’s first Kabul attack, on January 14, 2019, but the
Taliban claimed responsibility for it. Clarke Report at 65.
29
Province from at least 2008 to 2015; and in Nuristan Province after 2005. Clarke Report at 59–

63. Although another terrorist group, Hezb-e-Islami Gulbuddin (“HIG”) was present in the same

region during the same time periods, its responsibility is less likely: in Kunar Province, the Taliban

actively worked to coopt HIG, and many HIG fighters defected to the Taliban; in Laghman

Province, HIG’s presence was relatively weak; and in Nangarhar and Nuristan Provinces, HIG

defected to the Taliban in 2005. 15 Id. at 59, 61–63.

5. North Central Afghanistan

The Taliban “likely” carried out the attacks in this case that occurred in the north central

region of Afghanistan, comprised of portions of the Parwan Province and Kapisa, Baghlan, and

Kunduz Provinces. Tr. II at 172:17–20 (Clarke); see generally Clarke Report at 44, 65–71.

Although HIG was also active in all of these provinces, the Taliban displaced it and established

operational dominance. Clarke Report at 65–68, 71. The Taliban maintained operational

dominance in Baghlan Province from 2008 to 2011, id. at 66; in Kapisa Province from 2007 to

2009 (even claiming responsibility for a joint attack on Coalition forces in July 2008), id. at 68–

69; and in Kunduz Province from at least 2009 to 2010 (partially evidenced by its seizure of

Kunduz City in 2015, suggesting that the group was already deeply entrenched in the area), id. at

69–70. As to Parwan Province, the Taliban was dominant from at least 2008 to 2016: multiple

sources show that the Taliban was stronger than other insurgent groups, and the Taliban claimed

responsibility for at least two attacks (including one on Bagram Airfield). Id. at 70–71. All the

15
As in Kabul, ISIS-Khorasan established a presence in Nangarhar Province in 2015, see Clarke Report at
61, but only one attack at issue in this case occurred after 2015. As discussed below, it appears that the Taliban was
responsible for that June 10, 2017 attack, in part because the Taliban subsequently claimed responsibility for another
insider attack in Nangarhar. Clarke Report at 61–62; see infra Part III.d.12.
30
attacks in this case that occurred in the region displayed the Taliban’s standard TTPs. Tr. II at

172:21–25 (Clarke).

6. Western Afghanistan

The Taliban “very likely” carried out all the attacks in this case that occurred in western

Afghanistan, comprising Nimruz, Farah, Herat, Baghdis, Ghor, and Faryab Provinces. Tr. II at

173:22–174:1 (Clarke); see generally Clarke Report at 44, 71–74. The TTPs used in these attacks

matched those used by the Taliban, Tr. II at 174:2–5 (Clarke), and there was no other known

insurgent presence in any of those provinces other than Herat at times relevant to this case, Clarke

Report at 72–74. The Taliban very likely had dominance in Baghdis from 2010 to 2011: by 2009,

the Taliban controlled or was free to operate in large swaths of the region, and it claimed

responsibility for at least two attacks in 2010 and 2011. Id. at 71–72. During at least 2011, the

Taliban very likely dominated Farah Province as well, where it claimed responsibility for an attack

in 2012. Id. at 72. From 2010 to 2012, the Taliban very likely dominated Faryab Province, and

the group claimed responsibility for an April 2012 suicide bombing that killed three U.S. soldiers

in the region. Id. at 73. And through at least 2009, the Taliban very likely dominated Herat

Province, where it claimed responsibility for at least one attack in Karukh District in 2009;

although HIG was attempting to reorganize itself in Herat Province, it had only a small presence

at the relevant time. Id. at 73–74.

7. Southeastern Afghanistan

Finally, the Taliban and the Haqqani Network “very likely” maintained operational

dominance and carried out all the attacks in southeastern Afghanistan, which includes Ghazni,

Logar, Uruzgan, Wardak, and Zabul Provinces. Tr. II at 170:1–7 (Clarke); see id. at 178:1–16,

183:8–184:7, 186:18–187:1 (McGrath); see generally Clarke Report at 44, 52–58. The Taliban

31
was the most dominant terrorist group in the region, and the attacks in this case reflect the Taliban’s

TTPs. Tr. II at 170:8–15 (Clarke). In Ghazni Province, the Haqqani Network very likely

maintained operational dominance during at least 2007 to 2012: Sirajuddin Haqqani identified

himself as the head of the Taliban’s military committee for a region including Ghazni and Logar

Provinces in February 2005. Clarke Report at 52. The Rahbari Shura assigned responsibility for

Ghazni to the Haqqani-led Miranshah Shura, and the Taliban claimed responsibility for at least

one attack in the province during this time period (a 2012 suicide bombing which killed U.S.

troops). Id. at 52–53. From at least 2008 to 2013, the Taliban very likely dominated Logar

Province. Id. at 53. The Taliban’s regional shura influenced operations in Logar, and the Taliban

claimed responsibility for several attacks there. Id. at 53–54. The Taliban also very likely

dominated or maintained a stronghold in Uruzgan Province from at least 2007 to 2012 and again

in 2019, particularly in the district of Tarin Kowt. Id. at 55; Tr. II at 190:4–9 (McGrath); Wood

Report ¶¶ 234–36. The Taliban is historically connected to the region (Mullah Baradar, a former

deputy leader of the Taliban, is from Uruzgan), and it claimed responsibility for at least one attack

there, a 2009 suicide bombing. Clarke Report at 55. In Wardak Province, the Taliban very likely

dominated from at least 2009 to 2013, claiming responsibility for numerous attacks on U.S. troops;

although HIG was present in Wardak, HIG fighters had largely defected to the Taliban by the

relevant time period. Id. at 55–57. And in Zabul Province, the Taliban very likely had operational

dominance from 2008 to 2012, where it claimed responsibility for numerous attacks. Id. at 57–

58; Tr. II at 190:10–191:13 (McGrath).

D. Bellwether Attacks

In this section, the Court will explain its findings of fact regarding the eleven bellwether

attacks in this case, including its attributions of those attacks to particular Syndicate member

32
groups. In sum, the Court concludes that the Syndicate committed all eleven attacks, and that

Iran’s material support substantially contributed to the Syndicate’s ability to do so. Before delving

into the details of each attack, though, the Court will briefly summarize the seven attack categories

that the bellwether attacks represent.

1. Attack Categories

Complex attacks: Complex attacks are those involving “advanced tactics,” Wood Report

¶ 68, which includes the use of multiple units coordinated to achieve a single objective, multiple

weapons with phased operations, or sophisticated maneuvers (e.g., commencing an attack with a

suicide bomber before proceeding with small-arms fire), id.; Tr. IV at 378:25–379:7 (Wood). The

Taliban often used complex attacks in conjunction with its major offensives: these attacks often

included Taliban fighters hiding weapons and equipment, and later moving into position to use

those items. Wood Report ¶¶ 68–69. Executing these strategies required reconnaissance and

surveillance, and the Taliban often filmed their attack locations before and during these

engagements. Id. ¶ 68. The Taliban launched complex attacks against Coalition forces using

rockets, mortars, and small arms fire, sometimes with hundreds of fighters, and sometimes lasting

for several days. Id. ¶ 69.

IEDs: In IED attacks, terrorists use homemade bombs to destroy, incapacitate, harass, or

distract targets. Wood Report ¶ 55. The Taliban used IEDs to disrupt, delay, and damage Coalition

forces, allowing the Taliban to inflict casualties without the need for direct engagement. Id. The

Taliban used IEDs extensively in the Helmand River Valley, and as their efficacy became clear, it

began to use them across Afghanistan. Id. ¶¶ 64, 67. The use of IEDs was the most prevalent

tactic in Afghanistan and caused the greatest number of casualties among Coalition forces. Tr. II

at 195:23–196:9, 198:1–7 (McGrath); 216:14–218:4 (Lemon). Ammonium nitrate-based

33
explosives were the most common ingredient in Taliban IEDs; ammonium nitrate is relatively

stable, making it easier to move and place inside IEDs. Wood Report ¶ 57. But after a shortage,

the Taliban began to use Haqqani-Network-provided chlorate and by 2013, more than 65% of

identified explosives in Afghanistan were chlorate-based. Id. ¶ 58. Between 2006 and 2019, the

Taliban used many types of IEDs, including victim-operated pressure plates, command-wire

detonated IEDs, remote-controlled IEDs, vehicle-borne IEDs, and suicide-vest—or “person-

borne”—IEDs. Wood Report ¶ 60. The development in delivery methods reflects the Syndicate’s

evolution and innovation in techniques as their attacks against U.S. and Coalition forces continued.

Id.

Indirect fire attacks: Indirect fire attacks involve the use of rockets or mortars against an

objective. Wood Report ¶ 71; Tr. IV at 473:5–8 (Wood). These weapons gave the Taliban an

attack method that did not require a direct line of sight on a target; as such, they were often

deployed against fortified Coalition bases to harass forces and inflict casualties. Wood Report

¶¶ 71–72. Syndicate combatants generally directed indirect-fire weapons by placing them on

rocks, sandbags, or metal rails, aimed in the general direction of Coalition targets. Id. ¶ 72. But

there are examples of more accurate rocket fire, which indicates outside advice and training from

more experienced transnational terrorist groups, like al-Qaeda, or state support from Iran or

Pakistan. Id. More frequent than rocket attacks, though, were mortar attacks, particularly with

82mm mortars. Id. ¶ 73. Many mortar attacks were ineffective due to a lack of training, but

Taliban insurgents who had trained on mortars (usually with outside groups) and therefore

understood the basic mechanics and tactics of a mortar attack were able to use the weapons more

effectively. Id.

34
Infantry-style tactics: The Taliban also used traditional infantry-style attacks, including

small-arms fire, rocket-propelled grenades (“RPGs”), and recoilless rifle or anti-aircraft attacks.

Wood Report ¶ 74; Tr. IV at 426:5–11 (Wood). These attacks all involve the use of individuals

pulling triggers (e.g., a small group of insurgents using AK-47s to fire directly on targets from

distances under 300 meters). Wood Report ¶ 74; Tr. IV at 426:5–11 (Wood). The Taliban often

used RPGs—shoulder-fired weapons that launch small, fin-stabilized rockets with explosive

warheads—against Coalition troops, lightly armored vehicles, and “dug-in” defensive positions.

Wood Report ¶ 75. A recoilless rifle (or an SPG-9), by contrast, is a tripod-mounted, portable,

73mm recoilless gun generally used for attacks on vehicles, but it is occasionally used against

personnel. Id. ¶ 76.

Insider attacks: Insider attacks (also described as “green-on-blue” attacks) became part of

the Syndicate arsenal beginning around 2011. Wood Report ¶ 77. A Taliban member would feign

membership in an Afghan security force before turning on Coalition or true Afghan forces. Id.

¶ 78; Tr. IV at 498:19–25 (Wood). To plan these attacks, the Taliban often targeted young men

who joined the Afghan National Security forces from Taliban-involved areas. Wood Report ¶ 78.

Once the men finished training and were incorporated into units with access to Coalition forces,

the Taliban would harass the planted soldier or threaten his family, in order to induce him to launch

the attack. Id. When Afghan trainees returned home on leave, the Taliban would recruit them,

provide additional training, and give them a way to communicate with the Taliban after the attack

ended. Id. By 2017, insider attacks killed at least 157 Coalition troops and more than 557 Afghan

troops. Id. ¶ 79.

Suicide attacks: Particularly favored by the Haqqani Network, suicide attacks involve a

terrorist personally delivering an explosive to a target and detonating the explosive, killing himself

35
in the process. Wood Report ¶¶ 88–89; Tr. IV at 439:23–440:1 (Wood). Although suicide

bombing is contrary to the Pashtunwali code (to which the Taliban, ethnically Pashtun, subscribes),

the Haqqani Network incorporated the practice into the broader Taliban, first by importing foreign

fighters seeking martyrdom, and later, in 2011, by publishing a document that provided a religious

justification for the use of suicide bombers. Wood Report ¶ 88. The Syndicate used two primary

types of suicide IEDs: person-borne (or suicide vest) IEDs, and vehicle-borne IEDs (“VBIEDs”).

Id. ¶ 89. Person-borne IEDs were typically made up of a cloth vest, worn around the bomber’s

chest, with explosives sewn into the fabric and nails, ball bearings, or other fragments outside the

explosive; when the vest detonated, the fragments would function as shrapnel, projecting into the

target and inflicting injuries. Id. ¶ 89–90; Tr. IV at 453:23–454:3 (Wood); e.g., Wood Report

¶ 239 & fig. 37. The Taliban used person-borne IEDs to penetrate secure areas, assassinate key

targets, or detonate in crowds to cause more deaths and injuries. Wood Report ¶ 90. VBIEDs, by

contrast, are cars, vans, or trucks loaded with explosives. Id. ¶ 91. This delivery method allowed

insurgents to transport large amounts of explosives, theoretically creating more devastating

attacks. Id. The Syndicate used VBIEDs to penetrate perimeters during complex attacks, to attack

large groups, and to attack armored vehicles. Id. VBIEDs frequently caused mass casualties and

led to media attention. Id. The Kabul Attack Network often used VBIEDs to target Afghan and

Coalition officials while they traveled around Kabul City. Id.

Kidnapping: The Taliban often kidnapped targets to gain political or economic advantages

(e.g., to negotiate the release of detained Taliban fighters), with over 100 confirmed kidnappings

of Westerners since 2001. Wood Report ¶ 305. To plan a kidnapping, the Taliban persistently

surveilled its target to determine the person’s pattern of life; rehearsed its attack to ensure its

36
success in isolating the target; and, at the time of execution, confused the target, applied

overwhelming force, and quickly exited the area of the abduction. See id. ¶¶ 308–311.

2. July 13, 2008 Complex Attack in Waygul District, Nuristan Province

The Taliban, likely with direct assistance from al-Qaeda, committed the complex attack

that occurred on July 13, 2008 in the Waygul District, which is in the N2KL bellwether region.

Tr. IV at 378:9–379:1, 389:22–390:1 (Wood); Wood Report ¶ 109; see generally Wood Report

¶¶ 109–146. The plaintiffs who were direct victims of the attack—SSG Jonathan Benton, 16 CPL

Jason M. Bogar, 1LT Jonathan P. Brostrom, SGT Israel Garcia, SPC Jason D. Hovater, CPL Pruitt

A. Rainey, and CPL Gunnar Zwilling—were all active members of the U.S. armed forces at the

time of the attack. Id. at 379:8–20; Wood Report ¶ 109; see Pls.’ Ex. 53 at 25 (listing military

units of the soldiers present at the attacks); Pls.’ Ex. 256 at 94 (U.S. Army Combat Studies Institute

Report on the attack at Wanat, describing SSG Benton as the platoon’s “2d Squad leader”). Iran’s

material support for the Taliban substantially contributed to the Taliban’s ability to conduct this

attack. Wood Report ¶ 146(e); see Tr. IV at 411:5–7 (Wood).

The attack occurred at a vehicle patrol base, VPB Wanat (also referred to as Combat

Outpost Kahler). Wood Report ¶¶ 111, 115 & fig. 12; see Pls.’ Ex. 256 at 109 (map of Wanat and

surrounding area). It is located in the Waygul Valley, one of a series of narrow valleys between

high mountain ranges near the Afghan/Pakistani border. Tr. IV at 391:8–13 (Wood). Al-Qaeda

maintained a significant presence in the area at the time, and the difficult terrain and proximity to

Pakistan made the area a particular point of focus for Taliban and al-Qaeda terrorist activities. Id.

at 392:16–25; Wood Report ¶ 132. Leading up to the attack, the Taliban and al-Qaeda engaged in

16
Although Col. Wood’s report does not mention SSG Jonathan Benton, other sources confirm that he was
a victim of this attack. See, e.g., Pls.’ Ex. 256 at 94.
37
substantial planning: they surveilled the area in the days preceding the attack, observing the base

and the U.S. soldiers from the mountains and a nearby village, Tr. IV at 395:19–398:5 (Wood);

Wood Report ¶¶ 133–34; they sought to hide this planning by holding meetings without American

leaders present, Tr. IV at 397:3–23 (Wood); Pls.’ Ex. 53 at 8; and they diverted water into a nearby

irrigation canal to disguise sounds and ensured that no civilians were present at Wanat on the day

of the attack, Tr. IV at 397:24–398:5 (Wood); Pls.’ Ex. 256 at 123; Pls.’ Ex. 53 at 8–9.

The attack began with a burst of machine gun fire at 4:20 a.m. local time, followed by more

machine gun and RPG fire from elevated positions around the base focused on key American

weapons positions. Tr. IV at 385:15–21 (Wood); see generally Wood Report ¶¶ 111–27; Pls.’ Ex.

256 at 151–62. SSG Benton was initially located in the main patrol base; he was injured in the

RPG portion of the attack. Tr. IV at 386:7–11 (Wood). During the initial moments of the attack,

all the occupants of an Observation Post (“OP”) located a short distance from the base, called OP

Topside, Tr. IV at 386:12–16 (Wood); Wood Report ¶ 120 & fig. 13, were either killed or injured;

these victims included CPL Bogar and CPL Zwilling, both of whom were killed. Wood Report

¶¶ 122, 124; Tr. IV at 387:4–17 (Wood); Pls.’ Ex. 53 at 10, 15–18 (detailing events at OP Topside).

One individual located at OP Topside contacted the main base to request reinforcements. Tr. IV

at 387:18–24 (Wood); Wood Report ¶ 122. 1LT Brostrom, CPL Rainey, and SPC Hovater reached

the OP from the base, but an insurgent who had infiltrated the OP shot and killed them. Wood

Report ¶¶ 123–24; Tr. IV at 387:25–388:16 (Wood). SGT Garcia then led a second wave of

reinforcements to the OP, but he was severely injured as the firefight continued and later died from

his wounds. 17 Tr. IV at 388:22–389:8 (Wood); Wood Report ¶ 125. SSG Benton, who was part

17
SGT Garcia posthumously received a Silver Star. It states: “For Gallantry: in action on 13 July 2008,
during an enemy attack on Vehicle Patrol Base Wanat in Kunar Province, Afghanistan, in support of Operation
Enduring Freedom. Sergeant Garcia’s fearless reinforcement of the observation post was pivotal in preventing the
38
of a third wave of reinforcements, was also injured. Pls.’ Ex. 256 at 173; Tr. IV at 386:10–11,

389:10–21 (Wood).

The evidence supporting the attribution of this attack to the Taliban and al-Qaeda is strong.

Complex attacks like this one were a standard Taliban TTP, but, as evidenced by its advance

planning, this attack was more sophisticated than usual. Tr. IV at 400:21–401:5 (Wood); Wood

Report ¶¶ 133–39; see Pls.’ Ex. 53 at 7–9; Pls.’ Ex. 256 at 122–23. Al-Qaeda, which was active

in the region at that time, likely participated: after the attack, the U.S. military discovered the body

of an Arab male, wearing civilian clothes under a camouflage uniform, who was almost certainly

an al-Qaeda fighter. Wood Report ¶ 140; Tr. IV at 401:6–402:5 (Wood). Moreover, the deputy

leader of the local Taliban cell posted a video claiming responsibility for the attack, including

corroborating details. Tr. IV at 402:6–403:9 (Wood); Wood Report ¶¶ 141–42. The Army

Regulation 15-6 Investigation 18 into the attack concluded that it was committed by “Anti-Afghan

Forces,” Pls.’ Ex. 53 at 26, a term used to refer to members of the Syndicate, Wood Report ¶¶ 143–

44; Tr. IV at 403:10–21 (Wood). 19 A further 2010 study of the attack on Wanat, conducted by the

U.S. Combat Studies Institute, identifies the Taliban by name as the perpetrator of the attack. Pls.’

Ex. 256 at 19–21, 53, 87, 97; Tr. IV at 403:22–404:11 (Wood).

decisive terrain from being overrun, and in allowing C Company to repel the determined enemy assault.” Pls.’ Ex.
282 at 9.
18
After the death of an active-duty soldier, the U.S. Army typically conducts an official investigation of the
nature and circumstances, sometimes called an “A.R. 15-6.” Tr. IV at 365:4–13 (Wood); see generally Wood Report
¶ 19(a). The result of that investigation is the military chain of command’s final assessment of the facts and
circumstances of the death. Tr. IV at 365:5–8, :16–20 (Wood). A.R. 15-6s often provide more than enough
information to attribute an attack to a particular terrorist group, even without additional evidence. Wood Report
¶ 19(a); e.g., Tr. IV at 382:8–12 (Wood).
19
The United States and the former Afghan government often avoided using the term “Taliban” because it
means “student” or “student of Islam,” an honor they did not want to bestow on terrorists. Wood Report ¶ 144; Tr.
IV at 372:3–18 (Wood).
39
3. August 16, 2009 IED-Triggered Complex Attack in Siawashan Village, Herat
Province

The Taliban committed the IED-triggered complex attack that occurred on August 16, 2009

in Siawashan Village in the Western Afghanistan bellwether region. Tr. IV at 411:5–7 (Wood);

Wood Report ¶ 153; see generally Wood Report ¶¶ 147–67. The attack involved an IED followed

by an ambush. Tr. IV at 407:16–408:3 (Wood); Wood Report ¶¶ 154–56, 158–60. The plaintiff

who was a direct victim—CPL Nicholas R. Roush—was an active member of the U.S. armed

forces at the time. Pls.’ Ex. 51 at 9 (A.R. 15-6 investigation report into CPL Roush’s death). Iran’s

material support for the Taliban substantially contributed to the Taliban’s ability to conduct this

attack. Tr. IV at 416:11–19 (Wood); Wood Report ¶¶ 162–63, 167(b)–(c).

CPL Roush’s unit was working to counteract Taliban efforts to interfere with Afghanistan’s

lawful elections in Siawashan Village, Herat Province. Tr. IV at 408:18–409:9 (Wood); Wood

Report ¶ 149. Herat borders on Iran, with which it shares cultural and economic ties; in 2009, the

Taliban often entered Herat to attack U.S. forces. Wood Report ¶¶ 154–55; Tr. IV at 413:3–9

(Wood). After arriving in the village, CPL Roush’s unit fell victim to well-aimed AK-47 fire from

multiple attackers. Tr. IV at 409:10–15 (Wood); Wood Report ¶ 150; see generally Pls.’ Ex. 51 at

9. The soldiers were able to repel the attacks and later sought to return to base along a road with

a narrow area bounded by a mud wall. Tr. IV at 409:19–410:6 (Wood); Wood Report ¶ 150. As

the convoy arrived at the narrow area, an IED planted in the wall exploded, killing CPL Roush.

Tr. IV at 410:2–15 (Wood); Wood Report ¶ 151; Pls.’ Ex. 51 at 9. The explosion was followed

by AK-47 and RPG fire from behind the wall, which lasted for a few kilometers as the soldiers

tried to retreat. Tr. IV at 410:16–411:4 (Wood); Wood Report ¶ 152. The Taliban’s goal was to

kill and maim U.S. soldiers leaving the village. Tr. IV at 411:8–10 (Wood); Wood Report ¶ 153.

40
The Taliban planned the attack in advance. Tr. IV at 414:5–6 (Wood). They made and

planted the IED before the attack, engaged U.S. forces to distract them, deployed the IED, and

staged an ambush along the convoy’s route back to base. Id. at 414:7–17; Wood Report ¶¶ 158–

60; Pls.’ Ex. 51 at 9, 19, 24, 27; Pls.’ Ex. 51 at 9. Complex attacks like this were a standard Taliban

TTP, but this attack was more sophisticated than usual at this time and in this region. Wood Report

¶¶ 158–61; Tr. IV at 415:1–12 (Wood). Iran directly supported the Taliban’s efforts to disrupt

elections in Afghanistan, and IRGC members very likely trained the Taliban cell involved in this

attack; IRGC forces may also have participated directly in the ambush. Wood Report ¶¶ 162–63;

Tr. IV at 415:13–25 (Wood). The A.R. 15-6 investigation concluded that the attack was committed

by “insurgents,” Pls.’ Ex. 63 at 3, a term the U.S. government typically used to refer to the

Syndicate members (to avoid the potentially honorary connotations of the term “Taliban”), Tr. IV

at 416:3–10 (Wood).

4. April 11, 2010 IED in Arghandab District, Kandahar Province

The Taliban committed the April 11, 2010 attack in Arghandab District. Tr. IV at 418:12–

14 (Wood); Wood Report ¶ 168; see generally Wood Report ¶¶ 168–83. This was an IED attack

that occurred in the Southern Afghanistan bellwether region. Tr. IV at 416:20–417:6 (Wood). The

plaintiffs who were direct victims of this attack—SGT Jared Satoshi Lemon and SPC Joseph T.

Caron—were members of the U.S. armed forces at the time of the attack. Tr. II at 212:16–18,

213:6–12 (Lemon); Pls.’ Ex. 58 at 11 (A.R. 15-6 investigation report 20 into the death of SPC

Caron). The Arghandab River Valley is an agricultural area northwest of Kandahar City; it is an

important economic and cultural hub close to the birthplace of the Taliban. Wood Report ¶ 174–

The A.R. 15-6 investigation report did not officially attribute the attack to any group, likely because “it
20

would have been extremely unusual to have anything other than the Taliban conduct this attack at this time in the
Arghandab District.” Tr. IV at 425:3–12 (Wood).
41
75; Tr. IV at 419:17–420:4 (Wood). The Taliban was very active in the Valley in 2010 and was

working to encircle Kandahar City to cut it off from the rest of the country. Wood Report ¶¶ 174–

75; Tr. IV 420:5–25 (Wood). The Valley also provided an important Syndicate logistics corridor.

Tr. IV at 421:1–6 (Wood).

On the evening of April 11, 2010, SGT Lemon and SPC Caron were moving away from

their home base and toward an OP as part of an 11-man foot patrol; SGT Lemon was tenth in line,

and SPC Caron was eleventh. Tr. II at 219:14–25, 220:4–8 (Lemon); Pls.’ Ex. 58 at 18. The group

moved in single file because of the threat of IEDs in the area. Id. at 220:13–16. The patrol reached

a wall and decided to cross it. Tr. II at 221:5–8 (Lemon). SGT Lemon crossed the wall, then

turned around and took SPC Caron’s machine gun from him so he could use both hands to climb

the wall. Id. at 221:9–21. SGT Lemon returned SPC Caron’s gun, turned back around, and took

two steps forward; it was then that SPC Caron stepped on the IED. Id. at 221:21–222:1; Wood

Report ¶ 172. The IED was initiated by a “toe-popper,” or a Russian-made PFM-1 mine, which

was first introduced into Afghanistan by the Soviets in the 1980s. Tr. II at 217:10–17 (Lemon);

Tr. IV at 422:3–423:3 (Wood); Wood Report ¶ 177. The Taliban connected the mine, which

functioned as a pressure plate, to a detonation cord, which ran to a blasting cap located in a large

jug of explosives (likely ammonium nitrate). Wood Report ¶ 177–79; Tr. IV at 423:6–23 (Wood).

When SPC Caron stepped on the IED, it exploded. Tr. II at 222:2–6 (Lemon). SPC Caron was

killed by the IED blast. Id. at 222:2–18; Wood Report ¶ 172; Pls.’ Ex. 58 at 18. SGT Lemon was

severely injured; his injuries are discussed in depth below. See infra Part III.E.1.

IED attacks like the one that killed SPC Caron and wounded SGT Lemon were a common

Taliban TTP. Tr. II at 195:23–196:9 (Lemon); Wood Report ¶¶ 180–81, 183(b). The Arghandab

Valley has been noted for its “overwhelmingly dominant network of Taliban leaders” and the

42
frequency of successful IED attacks on American forces, Wood Report ¶ 175, and, at the time of

the attack on SPC Caron and SGT Lemon, the Valley was “hotly contested by the Taliban and

American forces,” id. ¶ 174. The Taliban’s goal in this attack was to kill U.S. soldiers traveling

on foot in the area, Tr. IV at 418:15–16 (Wood); Wood Report ¶¶ 179–80, and it used a form of

IED, a “toe-popper,” designed for that purpose: to maim individuals who step on it, Tr. IV at

422:3–19 (Wood); Wood Report ¶ 177. The Taliban planned this attack in advance: they mixed

explosives, assembled the device, and decided where to place it to inflict casualties on American

and Coalition forces in the area. Tr. IV at 424:4–425:2 (Wood); Wood Report ¶ 180. Iran’s

material support for the Taliban, including its provision of finances and explosives training,

substantially contributed to the Taliban’s ability to conduct this attack. Tr. IV at 425:13–19

(Wood); Wood Report ¶ 183(d).

5. August 6, 2011 Attack on Helicopter in Tangi Valley, Wardak Province

The Taliban committed the August 6, 2011 attack on a helicopter in the Tangi Valley. Tr.

IV at 432:22–24 (Wood); Wood Report ¶ 184; see generally Wood Report ¶¶ 184–208. This was

a small arms, RPG, and anti-aircraft attack in the Southeastern Afghanistan bellwether region. Tr.

IV at 426:2–6 (Wood). The plaintiffs who were direct victims of this attack—SO1 SEAL Darrick

C. Benson, PO1 Christopher Campbell, CW2 Bryan J. Nichols, PO1 Jesse Pittman, CPO (SEAL)

Thomas A. Ratzlaff, SCPO Heath Robinson, PO2 Nicholas Spehar, PO1 Michael Strange, CPO

Aaron C. Vaughn, and SCPO Kraig Vickers—were all part of a SEAL team on the helicopter, and

were all members of the U.S. armed forces at the time of the attack. Wood Report ¶¶ 184–85, 194.

All were killed when the Taliban shot down the helicopter. Id. ¶ 184. The Tangi Valley, in Wardak

Province, was strategic terrain for the Taliban in 2011 because it connected Wardak Province,

which the Taliban used as a staging area for attacks into Kabul, to Pakistan and Loya Paktia. Tr.

43
IV at 433:19–434:7 (Wood); Wood Report ¶¶ 196–98 & fig. 26. The area was also used for

growing poppy and was inhabited by Pashtun tribe members who generally supported the Taliban.

Tr. IV at 434:8–24 (Wood).

On August 5, 2011, an American unit was on its way to interdict a senior Taliban

commander, Qari Tahir (identified in American intelligence as “Objective Lefty Grove”), in the

Tangi Valley based on information that he was located in a particular compound in the Valley. Tr.

IV at 428:2–18 (Wood); Wood Report ¶ 186; see Pls.’ Ex. 60 at 37, 50–51, 588 (A.R. 15-6

investigation report on the attack). The operation involved a ground assault force and support

helicopters. Wood Report ¶ 187; Tr. IV at 430:2–12 (Wood); Pls.’ Ex. 60 at 37. When the ground

force arrived at the compound, it did not find Qari Tahir; helicopter forces identified individuals

moving away from the compound, however, and intelligence suggested that one of them was Qari

Tahir. Tr. IV at 431:6–13 (Wood); Wood Report ¶ 191; Pls.’ Ex. 60 at 15–16, 37–38. The

helicopter containing the immediate reaction force, using the call-sign Extortion 17, was nearing

the suspected location of Tahir when the Taliban fired two RPGs from the roof of a two-story

building. Wood Report ¶¶ 193–94; Tr. IV at 431:21–25 (Wood). One RPG struck the helicopter:

it crashed, killing everyone on board. Wood Report ¶ 194; Tr. IV at 432:1–11 (Wood); Pls.’ Ex.

60 at 38–39. The RPG was an OG-7 antipersonnel round, Pls.’ Ex. 60 at 1121, 1125; Iran produced

OG-7 RPGs and regularly provided them to the Taliban, Wood Report ¶ 203; Tr. IV at 436:11–22

(Wood).

Shooting RPGs at helicopters was a Taliban TTP; the Taliban had attempted to shoot down

helicopters in the same manner, in the same valley, in the months preceding the attack. Wood

Report ¶¶ 75, 199–200 & fig. 27; Tr. IV at 435:13–24 (Wood); Pls.’ Ex. 60 at 38–39, 1098. It

appears the Taliban also planned this attack in advance. Tr. IV at 435:4–5 (Wood). They were

44
aware that U.S. troops often moved through the Valley using helicopters, and they often climbed

to elevated positions (like the roof of a building) in order to get a clearer shot at airborne targets.

Tr. IV at 435:6–16 (Wood). Further, the Taliban publicly claimed responsibility for this attack

and provided details about it. Id. at 436:23–437:1; Wood Report ¶¶ 204–05. U.S. forces also

intercepted Taliban communications claiming that Qari Tahir had committed the attack and was

planning his escape from Afghanistan. Tr. IV at 437:2–20 (Wood); Pls.’ Ex. 60 at 190–91. The

A.R. 15-6 investigation attributed the attack to the Taliban. Pls.’ Ex. 60 at 23, 31; Tr. IV 437:21–

438:11 (Wood); Wood Report ¶ 206. Iran’s material support, including the provision of finances,

training, and weapons, substantially contributed to the Taliban’s ability to conduct this attack. Tr.

IV at 438:12–16 (Wood); Wood Report ¶ 208(i).

6. October 29, 2011 Vehicle-Borne Suicide Bombing in Kabul City

The Kabul Attack Network committed an October 29, 2011 VBIED suicide bombing attack

in Kabul City (i.e., Kabul bellwether geography). Tr. IV 439:17–22, 444:2–4 (Wood); Wood

Report ¶¶ 209, 213; see generally Wood Report ¶¶ 209–27. LTC David Cabrera, SGT James

Darrough, and SSG Christopher Newman, the plaintiffs who were victims of this attack, were all

members of the U.S. armed forces at the time, and all three were killed in the suicide bombing.

Tr. IV at 440:2–8 (Wood); Wood Report ¶¶ 209, 211; Pls.’ Ex. 52 at 2 (A.R. 15-6 investigation

report into the attack). Kabul City is the capital of Afghanistan and the cultural, economic, and

social hub of the country. Tr. IV 445:5–12 (Wood). American and Coalition forces had an

extensive presence in Kabul in 2011, which the Taliban-led Syndicate attempted to counter by

conducting terrorist attacks in the city. Id. at 441:14–17, 445:13–24; Wood Report ¶ 214.

On the morning of October 29, 2011, an armored bus called a Rhino was moving between

American bases in Kabul. Tr. IV at 441:14–23 (Wood); Wood Report ¶¶ 211–12 & fig. 30; Pls.’

45
Ex. 52 at 7, 57, 83. A car loaded with explosives made contact with the bus, detonating the

explosives and destroying the bus. Tr. IV at 442:25–443:3 (Wood); Wood Report ¶¶ 211–12 &

figs. 29, 31; Pls.’ Ex. 52 at 7; Pls.’ Ex. 190 at 3, 6, 12 (story board summary of the attack from the

investigating unit). The attack very likely involved chlorate-based explosives, Tr. 447:25–448:3

(Wood); Wood Report ¶ 220; eyewitnesses described the smoke cloud as initially light in color

(consistent with the use of chlorate), and chlorate is “extremely friction-shock sensitive,” meaning

that “any kind of jarring will cause it to ignite . . . [and] explode.” Tr. IV at 448:17–21 (Wood);

see Wood Report ¶¶ 219–23. Thus, the ignition of the explosive from the impact of the car into

the bus suggests that the VBIED used chlorate. Wood Report ¶¶ 220-23; see Pls.’ Ex. 52 at 268,

277, 281, 309. 21

The Taliban publicly claimed responsibility for this attack on a website called Al-Amara 1,

a Taliban media outlet at the time. Tr. IV at 449:19–450:3 (Wood); Wood Report ¶ 224. The

Taliban typically claimed responsibility for attacks that American forces considered to be

committed by the closely related Kabul Attack Network. Tr. IV at 450:9–24 (Wood). In this

particular claim of responsibility, the Taliban identified the suicide bomber, and his name indicated

that he was a member of a Haqqani-affiliated tribe. Id. at 450:25–451:11; Wood Report ¶ 224;

Pls.’ Ex. 52 at 29, 404–05. The A.R. 15-6 investigation attributed the attack to “insurgents,” Pls.’

Ex. 52 at 7, 30, 41; Tr. IV at 451:12–18 (Wood), and a declassified military storyboard prepared

after the attack described it as a “planned Taliban operation,” likely using the Taliban’s name

because it was not initially intended for public release, Pls.’ Ex. 190 at 1; see Tr. IV at 451:19–

452:14 (Wood); Wood Report ¶ 225.

21
Terrorists often used chlorate-based explosives to ensure an attack would be successful even if the operator
did not trigger the explosion directly, as in this case. Wood Report ¶ 221; Tr. IV at 448:22–449:10 (Wood).
46
Suicide bombings, and particularly VBIED suicide bombings, were a common TTP of the

Kabul Attack Network. Wood Report ¶¶ 216–17. The Network had relatively easy access to

chlorate because it is the primary ingredient used in match factories located in Waziristan, a

traditional Haqqani stronghold. Id. ¶ 219; Tr. IV at 448:6–13 (Wood). The Network planned this

attack in advance, likely based on direction and guidance from the Haqqani-led Miranshah Shura;

the Syndicate trained the suicide bomber, gathered materials for the VBIED in Miranshah,

Pakistan, and imported them into Afghanistan along historical Haqqani Network smuggling routes.

Tr. IV at 446:5–11, 447:7–14 (Wood); Wood Report ¶¶ 215–216; Pls.’ Ex. 190 at 3. The group

then assembled the weapon in staging areas outside Kabul before bringing it into the city for an

attack. Tr. IV at 446:12–447:6 (Wood); Wood Report ¶¶ 215–16 & fig. 32. Once in Kabul, the

Network identified potential targets and surveilled their routes before conducting the attack. Wood

Report ¶ 217–18; Tr. IV at 447:15–24 (Wood). The Network’s goal was to kill high-level

American officials they believed were riding on the bus. Tr. IV at 444:14–18 (Wood); see Wood

Report ¶ 91. Iran’s material support for the Syndicate, including the provision of finances,

training, weapons material, and intelligence support, substantially contributed to the Taliban’s

ability to conduct this attack. Wood Report ¶ 227(f); Tr. IV at 453:5–12 (Wood).

7. May 20, 2012 Suicide Vest Bomber in Tarin Kowt, Uruzgan Province

The Syndicate committed the May 20, 2012 suicide vest bombing attack in Tarin Kowt, in

Southeastern Afghanistan. Tr. IV at 453:13–23, 454:24–455:4 (Wood); Wood Report ¶¶ 228, 233;

see generally Wood Report ¶¶ 228–42. CPT Timoney, a plaintiff who was a direct victim of the

attack, was a member of the armed forces at the time. Tr. III at 309:5–15, 310:18–311:3

(Timoney); Wood Report ¶¶ 228, 230–32. Tarin Kowt is north of Kandahar City, in a highly

agricultural area that transitions from the plains of southern Afghanistan to the mountains in the

47
north. Tr. IV at 456:3–14 (Wood); Wood Report ¶ 234. One of the Pashto tribes in the area is

closely affiliated with the Taliban, and Taliban presence in the area was substantial in 2012. Tr.

III at 313:9–12 (Timoney); Tr. IV at 456:15–25 (Wood); Wood Report ¶ 235. The Taliban’s goal

in conducting this attack was to kill the American soldiers present in Tarin Kowt that day. Wood

Report ¶ 233; Tr. IV at 455:5–7 (Wood).

On May 20, 2012, CPT Timoney was part of a “key leader engagement,” during which an

outgoing unit was to introduce members of the unit to the Afghan police chief in Tarin Kowt. Tr.

III at 313:24–314:7 (Timoney); Wood Report ¶ 230; Pls.’ Ex. 59 at 13–14 (A.R. 15-6 investigation

report into the attack). Before the mission, there were reports that two suicide bombers were

present in the area. Tr. III at 314:8–15 (Timoney); Tr. IV at 460:2–6 (Wood); Wood Report ¶ 237;

Pls.’ Ex. 59 at 15–16, 108. The police station was located near the market in Tarin Kowt; it was

not market day, but there were some shacks set up in the market, which was unusual. Tr. III at

316:16–23 (Timoney). When American units arrived at the police station, the police chief was not

present, so the units waited for one hour and 35 minutes for him to arrive. Id. at 314:20–25,

315:20–316:3. When he arrived, he was angry at the American units and demanded that they leave

the station. Id. at 317:1–10. The soldiers formed a line and began to walk out of the compound

headed south to where their trucks were parked. Id. at 317:11–19, 318:9–22. As they left the

station, a man called out to them; the translator responded with concern in his voice, and the man

approached. Id. at 318:23–319:5. He yelled, “Allah Akbar” and detonated his suicide vest. Id. at

319:5–6, 319:12–24; Pls.’ Ex. 59 at 17. CPT Timoney was injured, Tr. III at 319:17–320:11

(Timoney); Wood Report ¶ 237; Pls.’ Ex. 300 (sealed medical records reflecting CPT Timoney’s

injuries); Pls.’ Ex. 301 (video of CPT Timoney depicting some of his injuries in the hospital), and

48
CPT Jesse Ozbat and 2LT Tobias Alexander were killed, Tr. III at 317:13–25 (Timoney); Pls.’ Ex.

59 at 13. CPT Timoney’s injuries are discussed in depth below. See infra Part III.E.3.

Suicide bombings like the one used in this attack were a Taliban TTP by 2012, Wood

Report ¶ 63; Tr. IV at 457:9–23 (Wood), though the Taliban often used other Syndicate members

as the actual suicide bombers due to the Pashtun’s historical reticence about committing suicide,

Wood Report ¶ 240. The Taliban planned this attack in advance, constructing a suicide vest,

identifying and surveilling the target, and timing the attack for the moment when soldiers left the

police station. Tr. IV at 458:10–460:9 (Wood); Wood Report ¶ 238. That there were no civilians

in the area further indicates advance warning. Tr. IV at 459:14–460:1 (Wood). The suicide vest

used in this attack was likely made by placing ball bearings into hot glue on a sheet of paper.

Wood Report ¶ 239 & fig. 37; Tr. IV at 460:19–461:3 (Wood). The ball bearing sheet was placed

on the outside of the explosives but inside the fabric of the vest, so the ball bearings would be

thrown outwards during the explosion. Wood Report ¶ 239; Tr. IV at 461:4–10 (Wood). Iran’s

material support for the Syndicate, including the provision of finances, training, and weapons,

substantially contributed to the Syndicate’s ability to conduct this attack. Tr. IV at 462:6–12

(Wood); Wood Report ¶ 242(d).

8. May 31, 2012 IED in Zombalay District, Helmand Province

The Taliban, likely with outside assistance, committed the May 31, 2012 IED attack in

Zombalay District, in the Southern Afghanistan bellwether geography. Tr. IV at 462:13–24,

466:9–18 (Wood); Wood Report ¶¶ 243, 258; see generally Wood Report ¶¶ 243–59. SGT Eric

M. Hunter, the plaintiff injured in this attack, was a cook assigned to a special forces unit in a

remote part of Helmand Province; he went on missions with the special forces unit in a support

role, and he was a member of the U.S. armed forces at the time of the attack. Wood Report ¶ 245;

49
Tr. IV at 462:25–463:7, 463:24–464:2 (Wood); Pls.’ Ex. 163 at ¶¶ 1–3 (sealed Declaration of

Sergeant Eric M. Hunter). Zombalay is located in Helmand province, near the provincial capital

of Lashkar Gah, and the area is a traditional Taliban stronghold with significant Taliban activity

during this time period. Tr. II at 187:2–188:5 (McGrath); Tr. IV at 467:13–468:5 (Wood); Wood

Report ¶¶ 250–52.

On the day of the attack, SGT Hunter was participating in a mission where American troops

were moving in two separate columns to converge on the village of Zombalay. Tr. IV at 464:13–

465:15 (Wood); Wood Report ¶¶ 245–46; Pls.’ Ex. 163 at ¶ 4. SGT Hunter was in the western

column. Tr. IV at 465:14–15 (Wood); Wood Report ¶ 247. The other column began taking direct

fire as they approached the village, and SGT Hunter ran to the top of a roof to provide suppressive

fire. Tr. IV at 465:19–466:3 (Wood); Wood Report ¶¶ 247–48; Pls.’ Ex. 163 at ¶ 5. He stepped

on a pressure plate IED placed beneath a path in the village and the device detonated; the IED did

not kill anyone, but it severely wounded SGT Hunter, ultimately requiring the amputation of his

right leg below the knee, causing serious damage to his left leg, and resulting in a traumatic brain

injury and post-traumatic stress disorder. Tr. IV at 466:4–8 (Wood); Wood Report ¶ 248; Pls.’ Ex.

163 at ¶¶ 5, 7–8. SGT Hunter received the Purple Heart award, which states: “While conducting

presence patrols in Helmand Province[,] member suffered an improvised explosive blast injury

resulting in damage to both legs.” Tr. IV at 470:7–471:13 (Wood); Pls.’ Ex. 285 at 2 (sealed

military record relating to SGT Hunter’s Purple Heart).

IED attacks like this one were a common Taliban TTP. Wood Report ¶¶ 55–57, 61, 259(b).

The trigger device on the IED that injured SGT Hunter was significantly more sophisticated than

the devices typically found in the area, Tr. IV at 468:24–469:6 (Wood): it was designed to

compress only under the weight of a fully armed soldier, allowing the Taliban to place it under a

50
commonly used path without injuring local civilians. Id. at 468:11–20; Wood Report ¶¶ 255–56.

The sophistication of the weapon suggests that it was built with non-Taliban assistance. Wood

Report ¶¶ 257, 259(c); Tr. IV at 466:13–18, 469:1–6 (Wood). But despite this sophistication, the

device did not operate at its full efficacy; had it functioned as intended, it likely would have killed

SGT Hunter and others. Tr. IV at 469:21–24 (Wood). The Taliban’s goal in conducting this IED

attack was to kill American soldiers, id. at 466:19–20, and the Syndicate planned the attack in

advance by building and placing the IED in the village, id. at 468:12–20. Iran’s material support

for the Taliban, including the provision of finances, training in advanced IED tactics, and weapons

materials, substantially contributed to the Taliban’s ability to conduct this attack. Wood Report

¶ 259(d); Tr. IV at 472:15–19 (Wood).

9. June 18, 2013 Indirect Fire on Bagram Airfield, Parwan Province

The Taliban committed the June 18, 2013 indirect fire attack on Bagram Airfield, in North

Central Afghanistan. Tr. IV at 472:20–473:5, 475:16–18 (Wood); Wood Report ¶¶ 260, 273; see

generally Wood Report ¶¶ 260–74. SPC Robert W. Ellis, the plaintiff killed in this attack, was a

member of the armed forces at the time. Tr. IV at 473:9–13 (Wood); Wood Report ¶ 260; Pls.’

Ex. 56 at 10 (A.R. 15-6 investigation report into the attack). Bagram Airfield is in the southern

part of Parwan Province, approximately 64 kilometers north of Kabul City, Tr. IV at 473:18–21,

476:7–12 (Wood); Wood Report ¶¶ 264–65 & fig. 44, and it served as a logistics and military

command and control hub during the relevant time period. Tr. IV at 476:17–23 (Wood); Wood

Report ¶¶ 264–65. The airfield is in a large, wide valley surrounded by high mountains. Tr. IV at

477:1–6 (Wood). Although the population in the surrounding area was largely pro-American,

Taliban terrorists would enter the area to conduct attacks focusing on the airfield. Id. at 477:7–18;

Wood Report ¶¶ 264–65.

51
On June 18, 2013, SPC Ellis had just finished training at Bagram Airfield and was waiting

at a bus stop with other members of his unit to be transported back to their sleeping area. Tr. IV

at 474:4–18 (Wood); Wood Report ¶ 262; Pls.’ Ex. 56 at 9. Enemy combatants fired two rockets

at the airfield, and although one missed entirely, the other rocket struck the bus stop where SPC

Ellis was standing. Tr. IV at 474:19–22 (Wood); Wood Report ¶ 262 & figs. 42–43; Pls.’ Ex. 56

at 9, 15. The rocket exploded on impact, instantly killing SPC Ellis. Tr. IV at 475:14–15 (Wood);

Pls.’ Ex. 56 at 15; Wood Report ¶ 262. The rocket used in this attack was a 107mm rocket; Iran

manufactured many of the 107mm rockets that have been identified in Afghanistan. Wood Report

¶¶ 262, 269–70; Pls.’ Ex. 56 at 9, 18; Tr. IV at 478:16–479:7 (Wood).

Firing rockets at American targets was a common Taliban TTP, Wood Report ¶¶ 71–73,

and Bagram Airfield was a regular target during this time period, id. ¶¶ 266–67; Tr. IV at 478:4–

15. Indeed, the fact that SPC Ellis was killed by an explosion at Bagram Airfield caused by enemy

forces is sufficient to conclude that, more likely than not, SPC Ellis was killed by the Taliban. Tr.

IV at 481:9–18 (Wood); see also Pls.’ Ex. 279 at 1 (sealed Report of Casualty on SPC Ellis’s

death). The A.R. 15-6 investigation into this attack concluded that it was committed by “enemies

of Afghanistan,” Pls.’ Ex. 56 at 9; this term, though not commonly used, referred to members of

the Taliban-led Syndicate and not to other terrorist groups, Tr. IV at 479:8–15 (Wood); Wood

Report ¶¶ 271–72. The Taliban planned the attack in advance by procuring the rockets and

modifying them to fire without their original ignition systems. Tr. IV at 477:23–478:3 (Wood);

Wood Report ¶¶ 267–69; see Pls.’ Ex. 56 at 11. Iran’s material support for the Taliban, including

the provision of finances and weapons—particularly 107mm rockets like this one—substantially

contributed to the Taliban’s ability to conduct the attack. Wood Report ¶¶ 270, 274(c)–(d); Tr. IV

52
at 481:19–25 (Wood) (“It’s very likely that [Iran is] where [the 107mm rockets used in this attack]

came from.”).

10. July 15, 2013 82mm Recoilless Rifle Attack in Paktia Province

The Haqqani Network, a Taliban subgroup, committed a recoilless rifle attack in Paktia

Province on July 15, 2013. Tr. IV at 486:8–12 (Wood); Wood Report ¶¶ 275, 297; see generally

Wood Report ¶¶ 275–98. This was a small-arms, RPG, and anti-aircraft attack in the Loya Paktia

bellwether geography. Tr. IV at 482:1–9, 15–17 (Wood); Wood Report at 114. Loya Paktia is the

traditional homeland of the Haqqani Tribe; the terrain is restrictive, favoring anti-U.S. and anti-

Coalition forces, and the border with Pakistan rendered the area a safe haven for the Haqqani

Network and the Taliban. Tr. IV at 487:20–488:21 (Wood); Wood Report ¶¶ 284–85. SSG Sonny

C. Zimmerman, the plaintiff who was a direct victim of the attack, was a member of the armed

forces at the time. Wood Report ¶¶ 277–78; Pls.’ Ex. 57 at 6 (A.R. 15-6 investigation report into

the attack).

SSG Zimmerman was stationed at Chamkani Assistance Platform. Tr. IV at 483:2–5

(Wood); Wood Report ¶ 278. On the afternoon of July 15, 2013, his unit traveled to train an

Afghan unit in a nearby village. Wood Report ¶¶ 277–78; Tr. IV at 483:6–10 (Wood); Pls.’ Ex.

57 at 7. On the way to the training, the unit was engaged by a small number of individuals shooting

at them, but the ambush failed and SSG Zimmerman’s unit dispersed the insurgents with the help

of American helicopters. Tr. IV at 483:11–20 (Wood); Wood Report ¶ 280; Pls.’ Ex. 57 at 8–9.

After the training that night, the unit returned to base in several smaller groups, a tactic intended

to increase security. Tr. IV at 483:24–484:8 (Wood). SSG Zimmerman was in a truck in the

second group to depart. Id. at 484:9–11; Wood Report ¶ 277. Along a road through a mountainous

region, SSG Zimmerman’s group saw a white flash near the group in front of them. Tr. IV at

53
484:12–20 (Wood); Wood Report ¶ 281. They called forward, but the first group had not seen or

heard anything. Tr. IV at 484:19–20 (Wood); Wood Report ¶ 281. The white flash was likely a

recoilless rifle firing at the vehicles. Tr. IV at 484:21–25 (Wood). Both groups continued forward,

and when SSG Zimmerman’s group reached the same location, Haqqani Network terrorists fired

the recoilless rifle at SSG Zimmerman’s vehicle. Tr. IV at 485:1–5 (Wood); Wood Report ¶ 282;

Pls.’ Ex. 57 at 6, 10, 12. The round, originally designed to combat tanks, Wood Report ¶ 279,

pierced the bulletproof glass on the passenger side of the truck, killing SSG Zimmerman and

injuring everyone else in his vehicle. Tr. IV at 485:6–13 (Wood); Wood Report ¶¶ 282, 294; Pls.’

Ex. 57 at 6, 10–11.

The Haqqani Network’s goal in firing the recoilless rifle was to kill Americans. Tr. IV at

486:24–487:1 (Wood); Wood Report ¶ 283. The Haqqani Network planned this attack in advance:

the rifle was placed in the brush to provide a clear line of fire while obscuring the rifle’s location,

and the attackers had fired on American forces multiple times in the weeks leading up to this attack.

Tr. IV at 489:17–490:4 (Wood); Wood Report ¶¶ 290–93. And the correct use of an unusual,

sophisticated weapon to fire on a passing convoy and avoid detection is a Haqqani Network TTP.

Tr. IV at 490:5–11 (Wood); Wood Report ¶ 294. The A.R. 15-6 investigation into the attack

concluded that it was committed by “insurgents,” Pls.’ Ex. 57 at 6, which likely referred to

members of the Haqqani Network, Wood Report ¶¶ 295–96; Tr. IV at 490:12–18 (Wood). Iran’s

material support for the Taliban-led Syndicate, including the provision of finances, weapons, and

training, substantially contributed to the group’s ability to conduct this attack. Tr. IV at 490:19–

23 (Wood); Wood Report ¶ 298(e).

54
11. August 7, 2016 Kidnapping in Kabul City

The Taliban, including its Haqqani Network subgroup, committed the August 7, 2016

kidnapping attack in Kabul City. Tr. IV at 491:6–9, 19–22 (Wood); Wood Report ¶¶ 299, 318;

see generally Wood Report ¶¶ 299–318. Mr. Kevin King, the plaintiff who was a direct victim of

the kidnapping, was a U.S. citizen at the time of the attack and remains a U.S. citizen today. Tr.

III at 274:11–15 (King).

Mr. King was an English teacher at the American University of Afghanistan in Kabul. Tr.

III at 273:10–25 (King); Wood Report ¶ 301. He had taught English in Afghanistan several times,

with his last trip beginning in October 2014. Tr. III at 273:19–20, 274:2–13 (King). Mr. King

lived in a guest house at a compound for university employees, id. at 274:23–275:3; he traveled

back and forth to campus with others who lived at the compound in a university-provided van, id.

at 275:4–10. The van, the compound, and the university all used Afghan guards, some of whom

were Afghan military personnel; at both the university and in the compound, guards admitted the

van into secured facilities to pick up teachers, closing the gate while the teachers entered the van,

and then reopening the gate to allow the van to depart. Id. at 275:7–19. On August 7, 2016, Mr.

King had finished teaching classes at the university and, along with another teacher, Mr. Timothy

Weeks, he boarded the van to return to the compound at around 7:50 p.m. Id. at 276:20–277:6.

While the van was passing through an alley just outside of the university gates, another van pulled

up and cut off the teachers’ van. Id. at 277:8–19. Individuals dressed in Afghan military uniforms

got out of the blocking van and pointed machine guns at the university van. Id. at 277:20–278:5.

The Afghan guard and driver of the university van unlocked the doors, and the armed individuals

forced Mr. King and Mr. Weeks into the other van at gunpoint. Id. at 278:6–16; Wood Report

¶ 302. The kidnappers searched the teachers for phones and forced them into the second and back

55
row of the van, where they were forced to lie down with a blanket covering them. Tr. III at 278:17–

279:6 (King). The kidnappers then drove the teachers around Kabul, passing through a checkpoint,

to a location outside the city. Id. at 279:7–280:4; Wood Report ¶ 302. Mr. Weeks and Mr. King

were then taken from the van and handed off to a second group of individuals. Tr. III at 280:2–4

(King).

The new captors were dressed in “standard local garb,” with the leader wearing a turban,

and they all carried guns or wore explosive vests. Tr. III at 280:8–17 (King). Mr. King and Mr.

Weeks were bound, marched to a new van, and driven to another location. Id. at 280:18–282:8;

Wood Report ¶ 303. They were forced to make a video identifying themselves and stating that

they had been kidnapped by the Taliban, who wanted to exchange them for Taliban prisoners. Tr.

III at 282:19–283:2 (King). This was the first of a series of such videos addressed to both the U.S.

and Afghan governments. See generally Pls.’ Exs. 288–91 (hostage videos and transcripts of

videos containing Mr. King and Mr. Weeks). The Taliban published those videos, in one case on

the Taliban’s media network, Al-Amara. Tr. II at 167:15–168:5 (Clarke); Tr. IV at 495:6–496:7

(Wood); see generally Tr. III at 288:11–293:6 (King).

Mr. King and Mr. Weeks were held captive for three years, three months, and twelve days.

Tr. III at 283:18–21 (King). They were moved several times during the course of their captivity.

Wood Report ¶¶ 304, 312–14; Tr. III at 283:22–284:10 (King). For the first two years, Mr. King

was bound at the wrists and ankles for 23 hours a day and chained to Mr. Weeks at night; during

what was ultimately his final year as a prisoner, the guards were slightly more lenient, sometimes

only chaining the captives’ wrists and not chaining them together at night. Tr. III at 286:12–18

(King). Mr. King was not permitted to go outdoors except while moving between locations for

two years. Id. at 287:8–12. He was given minimal food and suffered from an infection, and he

56
began to lose weight. Id. at 298:22–299:5. He was beaten, kicked, dragged through the snow,

apparently used as a medical test subject, 22 and frequently threatened, including at gunpoint. Id.

at 293:17–295:15. Mr. King’s health steadily deteriorated throughout his three-year captivity:

when he was examined after his release, he was diagnosed with malnourishment, severe vitamin

D deficiency, an electrolyte imbalance, heart issues, scurvy, posterior rib fractures, peripheral

neuropathy, and sensorineural hearing loss, among other conditions. Id. at 299:6–14, 304:15–

307:25; see generally Pls.’ Ex. 286 (Mr. King’s sealed medical records). The effects of his

prolonged captivity are discussed in more depth below. See infra Part III.E.2. Mr. King and Mr.

Weeks were ultimately released in exchange for three high-ranking Taliban prisoners including

Anas Haqqani, Sirajuddin Haqqani’s brother. Tr. IV at 496:8–16 (Wood); Wood Report ¶ 317. In

announcing Mr. King’s release, then-Secretary of State Michael Pompeo identified the Taliban as

his captor and characterized the release “as a goodwill gesture.” Tr. IV at 496:21–497:11 (Wood);

Wood Report ¶ 317.

Mr. King’s captors identified themselves as the Taliban, Tr. III at 287:19–25 (King) (“[I]t

was clear they were the Taliban. They told us from the very beginning . . . we’re the Taliban.”);

Wood Report ¶ 315, and kidnapping Westerners was a common Taliban TTP, Wood Report ¶ 305.

The Taliban’s goal in this attack was to kidnap prisoners to negotiate for a prisoner exchange. Tr.

IV at 491:23–492:1 (Wood); Wood Report ¶¶ 305, 318(e). The Taliban, and possibly the Haqqani

Network, planned this kidnapping in advance: the kidnappers had clearly conducted advanced

surveillance of the target; they had obtained Afghan military uniforms, enabling them to approach

22
Mr. King testified that some of his guards “were actually medical students, theoretically,” and they would
use him and Mr. Weeks “for their homework.” Tr. III at 295:5–7 (King). On several occasions, those guards would
“take an IV and nail it to the wall,” then place the needle into Mr. King’s vein. Id. at 295:7–12. Mr. King testified
that he could not object to this and “would just have to lie there for 45 minutes while . . . whatever they were putting
into me was in there.” Id. at 295:13–15.
57
the van with weapons without raising any alarm; and they were prepared for several possibilities

(e.g., if one of the captives had a trackable device like a cell phone, if the van were stopped at a

checkpoint). Id. at 493:15–494:18; Wood Report ¶¶ 308–11. Iran’s material support for the

Taliban, including the provision of money, intelligence, and advanced training in sophisticated

operations, substantially contributed to the Syndicate’s ability to conduct this attack. Tr. IV at

498:2–7 (Wood); Wood Report ¶ 318(f).

12. June 10, 2017 Insider Attack in Pekha Valley, Nangarhar Province

The Taliban committed the June 10, 2017 insider attack in Nangarhar Province, in the

N2KL bellwether geography. Tr. IV at 498:10–20, 502:12–15 (Wood); Wood Report ¶ 319; see

generally Wood Report ¶¶ 319–46. An insider or “green-on-blue” attack occurs when an

individual in an Afghan unit—often placed by a terrorist group—murders members of his unit or

Coalition forces. Tr. IV at 498:21–25 (Wood). This insider attack occurred in a very mountainous

region of Nangarhar Province, near the border with Pakistan; the proximity to the border and the

restrictive terrain in the area allowed terrorist groups to move freely, and three groups—the

Taliban, al-Qaeda, and ISIS-Khorasan—all had a presence in the area in 2017. Id. at 503:2–504:2;

Wood Report ¶ 327 & fig. 53. SGT Dillon C. Baldridge and SGT William M. Bays, plaintiffs who

were direct victims of this attack, were members of the U.S. armed forces at the time they were

killed. Tr. 499:1–6 (Wood); Wood Report ¶ 319; Pls.’ Ex. 55 at 19 (A.R. 15-6 investigation report

on the attack).

SGT Baldridge and SGT Bays w

[Text truncated at 120,000 characters. The full text is on the page linked above.]

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/cases/6501028. Public record. Not legal advice.