Irfan Khan
The gunfire may have stopped in Kohat, and the clearance operation may have finally ended, but the most difficult phase of the tragedy has only just begun: the search for answers. According to the information provided by police and the Counter Terrorism Department, the clearance operation continued for approximately 20 to 21 hours and concluded with eight terrorists reportedly killed. At the same time, the human cost had reached a devastating level, with 23 police officers and civilians reported martyred and 103 people injured. These are not merely numbers to be inserted into a news bulletin. Each figure represents a family confronting grief, trauma, financial hardship and an uncertain future. Every fallen police officer is also a reminder of the enormous price being paid by those standing on the frontline of Pakistan’s continuing struggle against terrorism.
The completion of the clearance operation is undoubtedly an important operational development, but it cannot mark the end of the security discussion. The central question now is not simply how many terrorists were killed or how effectively the security forces eventually cleared the area. The more difficult question is how an attack of such scale was planned, how the attackers obtained information about their target, how they were able to reach the site, and whether there were warning signs that could have enabled the authorities to prevent the assault before it began.
Modern terrorism is no longer simply about an individual carrying a weapon toward a target. Militant organizations have increasingly demonstrated the ability to conduct reconnaissance, gather intelligence, study buildings, identify entry and exit points and understand the movement of security personnel. As technology becomes more advanced, those planning attacks can potentially use drones, digital imagery, communications technology and other surveillance methods to prepare detailed maps of sensitive installations. A police line or other security facility can be studied long before the attackers actually arrive.
That reality demands an equally sophisticated response from Pakistan’s security institutions. If terrorists are studying the physical layout of a building, security agencies must continuously assess the vulnerabilities of that building themselves. If militants can use technology to gather information about police deployments, security agencies must have the technological and intelligence capacity to detect suspicious surveillance. And if intelligence about a possible threat exists somewhere within the state apparatus, the critical issue becomes whether that information reaches the people responsible for acting upon it.
The Kohat incident also highlights the changing tactics of terrorist organizations. The strategy described after the attack suggests that militants are increasingly attempting to combine different methods of assault. An initial attack can create panic and draw security personnel toward one location, while a second group of attackers attempts to enter through another route and open fire. Similarly, a vehicle carrying explosives can strike a building, creating destruction and confusion and potentially forcing security personnel toward the site of the explosion while other attackers exploit another entrance or vulnerable point.
Such tactics are deliberately designed to place security forces in a reactive position. The attackers do not simply want to cause casualties; they want to manipulate the response of the defenders. This makes anticipation more important than ever. Pakistan’s counterterrorism strategy cannot depend exclusively on the ability of brave officers to respond after an attack has begun. Courage remains indispensable, but courage must be supported by intelligence, technology, training, surveillance, secure infrastructure and rapid coordination.
The most uncomfortable question raised by the Kohat attack concerns local facilitation. As has repeatedly been observed in discussions about terrorist violence, large-scale attacks generally require more than the people who eventually appear at the scene. Transportation, accommodation, food, communications, explosives, weapons, reconnaissance and logistical support all require networks of some kind. The precise circumstances of the Kohat attack must be established through a proper investigation, but if the attackers were able to stay in the area, prepare a vehicle, study their target and approach a sensitive security installation, authorities must determine how they were able to do so.
Who helped them? Where did they stay? Who provided transportation? How did the vehicle reach the location? Who facilitated their movement? Did anyone observe suspicious activity? Was any intelligence available beforehand? These are not questions that should be dismissed as criticism of security institutions. They are precisely the questions that a serious counterterrorism investigation must ask.
At the same time, the issue of local facilitation must be handled with great care. The fact that individual facilitators may belong to a particular community or region does not make the wider population responsible for terrorism. The people of Khyber Pakhtunkhwa have themselves suffered enormously from militancy. The victims of terrorism and those fighting terrorists have included countless Pashtuns. Terrorism cannot be reduced to ethnicity, and collective blame would only deepen social divisions while distracting attention from the individuals and networks actually responsible.
The reported identification of one of the suicide bombers has added another dimension to the investigation. Material circulating on social media reportedly included a card described as an Afghan citizen card, with information allegedly pointing toward the identity of one of the suicide attackers. Such material may be relevant to investigators, but social-media evidence must be treated cautiously. Photographs, identity documents and screenshots can be manipulated, misidentified or deliberately circulated as part of an information campaign. The identity of an attacker should therefore ultimately be established through forensic evidence, biometrics, official records and corroborating intelligence rather than social-media claims alone.
The attack has also brought the Afghanistan dimension back into sharp focus. The Al-Badr Group was reported to have claimed responsibility for the operation and to have released videos allegedly showing preparations for the attack. A militant group’s claim of responsibility, however, should be independently verified. If investigators establish that the organization responsible for the attack operates from Afghan territory, the implications for Pakistan-Afghanistan relations are considerable.
Pakistan has repeatedly expressed concerns about militant groups operating from Afghan soil, while Afghan authorities have rejected accusations that their territory is knowingly being used to launch attacks against Pakistan. These competing positions cannot be resolved through television statements or social-media arguments. They require evidence, diplomatic engagement and verifiable action.
The question becomes particularly serious when a militant organization publicly acknowledges responsibility for an attack while allegedly maintaining locations across the border. If such locations can be independently identified and linked to the perpetrators, the international community also has a legitimate interest in understanding why those individuals and organizations are able to operate there. A neighboring country cannot simply be expected to ignore an armed organization if there is credible evidence that it is using territory across the border to organize attacks against its citizens.
The discussion also referred to reports concerning Al-Qaeda and an alleged letter from its senior leadership instructing ministries and international commanders associated with militant training to provide support and facilitation. Such claims are extremely serious and should be independently verified through credible intelligence and documentary evidence. If substantiated, they would raise significant questions about the broader militant ecosystem in the region and the relationships among different extremist organizations.
At the same time, Pakistan must distinguish between militant organizations and the Afghan civilian population. Afghanistan’s ordinary citizens should not be treated as responsible for crimes committed by armed groups. Any security response must be directed at verified militant networks rather than entire communities. This distinction becomes especially important when considering the possibility of military action across the border.
The discussion following Kohat also raised the prospect of airstrikes or other action against militant locations in Afghanistan. Pakistan has an undeniable responsibility to protect its citizens and security personnel, particularly when credible evidence establishes an external source of terrorist violence. But military action beyond an international border carries significant risks, including escalation, retaliation, diplomatic deterioration and civilian casualties. Any such decision therefore requires careful consideration of evidence, objectives and consequences.
There is also an information war surrounding such incidents. Whenever military action occurs, competing narratives quickly emerge. Social-media accounts may circulate photographs, videos and claims alleging that civilian areas rather than militant targets were attacked. The discussion surrounding Kohat included concerns that accounts associated with various political and militant constituencies could attempt to support attackers, blame Pakistan or manipulate public opinion. These allegations, however, should be investigated rather than accepted as established fact.
The state must understand that the battlefield now extends beyond the physical site of an attack. Social media has become an arena in which terrorist organizations, political groups, foreign actors and anonymous accounts can attempt to shape public perception. Old photographs can be presented as new, unrelated videos can be attached to current events, and unverified claims can spread across thousands of accounts within minutes.
This makes credible government communication more important than ever. When official information is delayed or contradictory, speculation fills the vacuum. When authorities do not communicate clearly, fabricated narratives can gain traction. The answer is not censorship or political propaganda; it is timely, evidence-based public communication that separates what is known from what remains under investigation.
The Kohat tragedy has also generated criticism of the provincial government’s priorities. The discussion highlighted the fact that the provincial government had been politically preoccupied for an extended period while serious security incidents were occurring in areas including Kurram and Kohat. Critics have questioned whether sufficient attention has been devoted to peace and security and whether the provincial administration has been adequately responding to the worsening threat.
These criticisms should be assessed against the government’s actual record rather than political rhetoric. Nevertheless, the underlying question is legitimate: what exactly are provincial institutions doing to address terrorism?
A chief minister or provincial minister does not have to personally pick up a weapon and stand on the frontline. Their responsibility is different and, in many respects, equally important. Political leadership must establish priorities, provide policy direction, ensure resources are available, coordinate departments and hold responsible institutions accountable for implementation.
That is why the Apex Committee is so important. When was its last meeting? What decisions were taken? Were those decisions implemented? Were subsequent review meetings held? How much progress has been made under the provincial action plan? Which measures were completed, and which remain outstanding?
These questions are not merely political ammunition. They are questions of governance.
A security policy that exists only in official documents cannot protect citizens. An action plan that is not implemented is little more than a collection of promises. If authorities identified vulnerabilities in sensitive installations, those vulnerabilities must be addressed. If additional surveillance was required, it must be installed. If intelligence-sharing mechanisms needed improvement, they must be strengthened. If personnel required specialized training, that training must be provided.
The same principle applies to intelligence.
Pakistan does not necessarily suffer from a complete absence of information. The greater challenge may be the ability to connect information, identify patterns and translate intelligence into timely action. Modern counterterrorism requires the integration of human intelligence, technical surveillance, forensic investigation, data analysis, border monitoring and local policing.
The objective must be to identify the attack before the attacker reaches the target. That is the difference between a reactive security system and a preventive one.
Pakistan has experienced enough terrorist attacks to understand that every major incident contains lessons. Unfortunately, the country has also witnessed a familiar cycle: an attack occurs, the nation mourns, security forces conduct an operation, officials issue condemnations, arrests or deaths are announced, and eventually public attention moves elsewhere.
That cycle cannot continue indefinitely.
The reported 23 deaths and 103 injuries following the Kohat incident demand more than condolences. The families of those who lost their lives deserve support, but they also deserve the assurance that their loved ones did not die in vain. The injured deserve sustained medical and institutional assistance. Security personnel who spent 20 to 21 hours conducting the clearance operation deserve recognition and, equally importantly, a security system capable of giving them better intelligence and protection before the next attack begins.
Kohat should therefore become an institutional learning exercise rather than another political confrontation.
The federal government must examine the broader national security dimension. The provincial government must examine its governance and law-and-order responsibilities. Police and the Counter Terrorism Department must examine operational vulnerabilities. Intelligence agencies must examine whether warnings existed and whether they were adequately shared. Investigators must pursue the entire facilitation network rather than focusing only on the attackers killed at the scene.
And policymakers must confront the regional dimension with a combination of evidence, diplomacy and carefully calibrated security measures. Most importantly, Pakistan must refuse to confuse the perpetrators of terrorism with the communities among whom they may hide.
The people of Khyber Pakhtunkhwa have suffered enough. Pashtun families have lost sons, brothers and fathers to terrorism. Pashtun police officers have stood among the most exposed defenders of the state. Communities have endured displacement, economic disruption and years of insecurity. To blame an entire population for the crimes of a militant minority would be both unjust and strategically counterproductive.
The same principle applies to Afghanistan. Afghan civilians should not be confused with militant organizations. Pakistan’s dispute is with those who plan, facilitate or execute terrorist attacks—not with ordinary Afghans seeking to live through decades of conflict.
The ultimate lesson of Kohat is therefore much larger than the outcome of a single clearance operation.
The terrorists may have been eliminated at the scene, but the network that enabled them must also be pursued. The reported identification of a suicide bomber must be verified through proper investigation. The reported claim of responsibility must be independently established. The question of local facilitation must be answered. The cross-border dimension must be investigated. Security vulnerabilities must be identified and corrected. And the provincial and federal authorities must demonstrate that security policies are actually being implemented.
The operation may have lasted 20 to 21 hours, but the investigation should last as long as necessary to establish the truth. Pakistan cannot afford to measure success only by how many terrorists are killed after an attack.
The more important measure is how many attacks are prevented before they happen. That requires intelligence that anticipates rather than merely reacts, technology that is matched by trained personnel, police installations designed around modern threats, political leadership that treats security as a continuous responsibility, and institutions willing to acknowledge weaknesses rather than conceal them.
Terrorist organizations will continue to adapt. They will study targets, exploit vulnerabilities, recruit facilitators, manipulate social media and attempt to operate across borders. Pakistan’s response must evolve faster than the threat. The Kohat tragedy should therefore not disappear from public consciousness once the headlines fade.
The clearance operation is over. The real work has begun. The country must now ask who planned the attack, who facilitated it, how the attackers acquired information about their target, whether any warning existed, why that warning may not have translated into prevention, and what concrete measures are being taken to ensure that the next attack is harder to plan and harder to execute.
The families of the martyrs deserve those answers. The injured deserve those answers. The security personnel who fought through the long clearance operation deserve those answers.
And the people of Pakistan deserve a security system that learns from tragedy instead of simply mourning it. Kohat was not merely another terrorist attack. It was a warning about changing militant tactics, possible intelligence gaps, the importance of investigating local facilitation, the continuing regional security challenge, the power of information warfare and the urgent need for stronger institutional coordination.
Pakistan cannot prevent every threat. But it can learn from every attack.
The true tribute to those who lost their lives in Kohat will not be another speech, another condemnation or another temporary security operation. It will be a system that becomes harder to penetrate, an intelligence network that becomes harder to deceive, a government that treats security as a permanent priority, and a counterterrorism strategy that reaches beyond the gunman to the entire network that makes terrorism possible.
The terrorists may have lost the battlefield in Kohat.
Pakistan must now make sure they do not win the war through institutional failure, political distraction or public forgetfulness.
