Every Afghan national seeking resettlement in the United States is supposed to be screened against at least seven federal databases, checked for biometric matches against 2.5 million records collected during combat operations in Afghanistan, and run through the FBI’s fingerprint identification system. Despite this multi-layered process, 2025 has seen at least three violent incidents involving resettled Afghans.
The most recent of these came on November 26, 2025, when Rahmanullah Lakanwal, an Afghan national who had received paramilitary training to work with the CIA and was paroled into the U.S. in September 2021, allegedly shot two National Guard members two blocks from the White House. One service member later died from her injuries and the other remains in serious condition.
Lakanwal’s arrest has prompted scrutiny of how the U.S. government vetted tens of thousands of Afghan nationals who were evacuated and resettled in the U.S. as part of Operation Allies Welcome following the military’s withdrawal from Afghanistan in August 2021. After the shooting, the Trump administration paused all decision-making on asylum applications and stopped issuing visas for people traveling on Afghan passports.
How did standard vetting work before the 2021 evacuation?
Before the U.S. pullout from Afghanistan, Afghans who worked for the U.S. government during the war could apply for Special Immigrant Visas (SIV) through a 14-step, multi-agency process established by the Afghan Allies Protection Act of 2009. Congress mandated a nine-month target for processing these visas that was virtually never achieved.
The process began with Chief of Mission approval at Embassy Kabul, requiring documentation proving U.S. government employment and evidence of threats experienced due to that work. Applicants then filed petitions with U.S. Citizenship and Immigration Services (USCIS), waiting an average of 4.1 months for processing. They then entered the visa application phase, which averaged 13.6 months and included in-person interviews, administrative processing through interagency security checks across the full database architecture, and medical examinations.
The actual end-to-end timeline told a different story than the statutory requirements. The Migration Policy Institute found average processing took 703 days. A 2018 lawsuit challenging the processing delays revealed wait times exceeding four years. By early 2021, a backlog of over 17,000 principal applicants had accumulated, exacerbated by Embassy Kabul’s suspension of visa interviews for nine months due to the COVID pandemic.
In order to qualify for SIV, eligible Afghans must prove that they worked for the U.S. government for at least one year, receive a recommendation from a U.S. citizen supervisor, and provide evidence of threats resulting from that employment. This is in contrast to the refugee resettlement pathway taken by some Afghans, which does not require an employment connection to the U.S.
The refugee process typically takes 18 to 24 months and includes a formal refugee status determination by the United Nations High Commissioner for Refugees, name checks by the Department of State, interagency intelligence community screening, FBI, Department of Homeland Security (DHS), and Department of Defense (DOD) biometric checks, in-person USCIS officer interviews, and medical examinations. Notably, no refugee has killed anyone in a terrorist attack on U.S. soil since the modern refugee program began in 1980.
What database tools does the U.S. use to screen Afghan nationals?
Afghan vetting relies on an interlocking architecture of biometric and biographic databases operated across multiple agencies.
The DHS’s IDENT system serves as the primary repository of biometric data, which includes fingerprints, photographs, iris scans, and facial images. IDENT alone holds over 260 million unique identities and processes more than 350,000 daily transactions. The DOD’s ABIS (Automated Biometric Identification System) contains approximately 2.5 million records specifically from Afghanistan, including information about where, when, and why individuals were collected during combat operations. ABIS is especially crucial because it collects information about individuals ranging from detainees to people applying to work on U.S. military bases to recipients of microloans.
The FBI’s Next Generation Identification system constitutes the world’s largest biometric and criminal history repository. Additional checks run through the State Department’s CLASS system, National Crime Information Center criminal records, the National Counterterrorism Center’s Terrorist Identities Datamart Environment, and Customs and Border Protection’s TECS system at ports of entry.
The system’s strength is that it checks a person against multiple databases at once: terrorist watch lists, FBI criminal records, information gathered by spy agencies, fingerprints and photos collected by soldiers during military operations in Afghanistan, and any prior contact with U.S. immigration officials.
However, the screening process cannot detect individuals who have never previously encountered U.S. systems, whose documentation was destroyed by decades of Afghan conflict, or who become radicalized after their entry into the U.S.
What changed during the 2021 evacuation?
When Kabul fell on August 15, 2021, the U.S. executed its largest non-combatant evacuation in history. Approximately 124,000 people were airlifted over 17 days aboard roughly 800 aircraft. On August 16 alone, a single C-17 evacuated 823 passengers, far exceeding the aircraft’s normal 336-person capacity.
After the initial airlift, Afghans were transported to “lily pad” sites in countries ranging from the United Arab Emirates to Spain for processing. In total, the Department of Homeland Security deployed approximately 400 personnel to conduct biometric collection and vetting. Only those clearing manifest vetting were approved for U.S.-bound flights. Eight domestic military installations then processed evacuees, with Wisconsin’s Fort McCoy at peak capacity holding approximately 12,600 people.
However, the large numbers of evacuees and pressure to process them in a timely manner forced significant deviations from standard screening practices. Rather than going through SIV or refugee processing, the majority of evacuees—approximately 72,500 people—were instead granted humanitarian parole. While parole permitted rapid entry into the U.S., it also did not require the presentation of passports or travel documents. Critically, parole is not an official admission to the United States; parolees remain legally “applicants for admission” with temporary two-year status and no inherent pathway to permanent residence.
A crucial systems gap also emerged as DHS was not initially able to vet evacuees against all DOD data in ABIS before paroling them due to restrictions on data-sharing with foreign partners. The battlefield intelligence that could identify individuals encountered in hostile contexts was not flowing to civilian immigration screeners.
Was the vetting process during the evacuation adequate?
Inspector General investigations have produced findings more nuanced than political characterizations of the vetting process on either side suggest.
A June 2025 report by the Justice Department’s Office of the Inspector General subsequently reported that the FBI believes that “the need to immediately evacuate Afghans overtook the normal processes required to determine whether individuals attempting to enter the United States pose a threat to national security.”
The report also found that CBP admitted evacuees with “questionable names and dates of birth” due to cultural practices. Some Afghans use single names, and exact birth dates are often not recorded.
A DOD Inspector General report issued in February 2022 identified at least 50 evacuees with “potentially significant security concerns” in Defense Department biometric databases who were brought to the U.S. The report attributed this to a gap in data-sharing. At the time, DHS lacked access to DOD’s tactical collection data, the records noting that an individual had been detained, questioned, or encountered in a combat situation. This gap was later fixed in a September 2021 interagency agreement that enabled retroactive screening.
The June 2025 DOJ Inspector General report also found 55 Afghan evacuees who either arrived while on the terrorism watchlist or were added afterward. However, the report also found that as of July 2024, 46 had been removed from the watchlist after an FBI investigation determined they posed no threat. Nine remained on the watchlist under monitoring, with four subject to active FBI investigation.
Notably, the DOJ Inspector General concluded that “the FBI effectively communicated and addressed any potential national security risks identified,” and made no formal recommendations, indicating the process performed adequately despite emergency-driven pressures and limitations.
How does continuous monitoring work post-entry?
The vetting of Afghan immigrants hasn’t ended with their arrival, in part because many are still awaiting asylum decisions. Parolees are continually evaluated in the National Crime Information Center’s database, which monitors for new criminal records and flags matches against the system’s files on wanted persons, immigration violators, and known and suspected terrorists. The FBI added approximately 49,200 fingerprint records into the Next Generation Identification system, which alerts authorities if enrolled individuals subsequently encounter law enforcement or match against newly added records.
To address gaps in the initial emergency period of admissions, U.S. authorities conducted a Phase Two re-vetting from October 2021 through October 2022. During this second round, screeners collected more detailed personal information (like alternate name spellings, family connections, and prior addresses) from evacuees while they were staying on U.S. military bases. They then ran this information, along with the original biometrics, through every available database, including the military battlefield data that hadn’t been accessible during the rushed initial screening.
The approximately 77,000 Afghans who were granted parole for two years have either seen that status expire or will see it expire soon. However, the DHS Inspector General found no established process to monitor parole expirations and noted that various immigration enforcement agencies “uniformly believed” tracking expirations was “not their responsibility”—a gap in the monitoring architecture that remains unresolved.
What happens next?
The Lakanwal case has already triggered immediate policy consequences. On November 27, U.S. Citizenship and Immigration Services announced it had “stopped indefinitely” processing all immigration requests from Afghan nationals pending a review of security and vetting protocols. President Donald Trump further stated that the administration would “reexamine every single alien who has entered our country from Afghanistan under Biden” and pursue removal of those who “do not belong here.” Whether these measures address the actual vulnerability depends on questions that remain unanswered.
The distinction between vetting failure and post-arrival radicalization determines which policy interventions could actually prevent future violence. If Lakanwal was adequately screened at entry and subsequently radicalized, or if his CIA-affiliated background placed him outside normal database checks entirely, then halting refugee processing and re-vetting evacuees may do little to address the underlying risk. If, however, screening gaps allowed a known threat to enter, the policy implications shift substantially.
Government reviews under both the Biden and the Trump administrations do not support the claim that Afghan vetting is either comprehensively adequate or systematically broken. The documented reality is a multi-layered system that functioned imperfectly under emergency conditions, identified most flagged individuals through subsequent reviews, and continues to face administrative gaps in long-term monitoring. It’s not yet known whether that system failed in Lakanwal’s specific case or whether any screening architecture could have prevented it.
