Guantanamo Detainee Matrix of Threat Indicators for Enemy Combatants

This document was originally released by WikiLeaks.  However, there is an error in the file made available by WikiLeaks that causes the document to only display eleven of the total seventeen pages in the document.  The version we are making available was created by combining pages from a redacted version made available by the New York Times with the unredacted file from WikiLeaks to create a complete, unredacted seventeen page duplicate of the original document.  Page thirteen and sixteen are particularly noteworthy as they list connections with Pakistani intelligence as an indicator of affiliation with terrorist organizations.


  • 17 pages
  • 7.81 MB


(S//NF) Below are indicators used in JTF-GTMO detainee assessments to determine a detainee‟s capabilities and intentions to pose a terrorist threat if the detainee were given the opportunity. The indicators are not all-inclusive and are written primarily with the JTF-GTMO detainee in mind, though they can be tailored to other theaters. These indicators are used in assessments in concert with each other, and need to be read in the context in which they are placed within an assessment. While some individual indicators may be sufficient alone to provide an accurate assessment of the detainee‟s threat, others may require additional indicators or multiple occurrences of the same indicator for reliability and confidence. In all, the indicators are designed to point to the threat a detainee would pose if he were to be released from custody, and the intelligence that a detainee potentially possesses, not as evidence to prove a detainee’s guilt or innocence.

(U) How to use these indicators

(S//NF) JTF-GTMO primarily uses three types of indicators to assess a detainee: 1) the detainee himself provides acknowledgement of a fact; 2) another detainee, document, government, etc. provides an identification of the detainee; and 3) analysis of the detainee’s timeline, activities, and associates in context with other known events and individuals. A fourth method may be available for a few select detainees in their SCI addendum, where special intelligence provides more specific information about a detainee.

Examples of these three types of indicators are:

  • 1) The detainee admitted being in Tora Bora;
  • 2) ISN 252 identified detainee from Tora Bora;
  • 3) Detainee claimed he met a group traveling to Pakistan and joined them and was eventually captured with them. Analysis will show that the detainee’s statements describe the events of the escape from Afghanistan and subsequent capture of the large al-Qaida force that was led out of Tora Bora by Ibn al-Shaykh al-Libi, which indicates the detainee was in Tora Bora with this group.

(U) Member of, or affiliation with, the Taliban or Anti-Coalition Militia (ACM)

(S//NF) The following provides the primary indicators for assessing a detainee’s membership or affiliation with the Taliban or ACM elements other than al-Qaida.

  • Detainee admitted be Taliban
  • Identified as a leader or member in the Taliban
  • Acknowledged or identified as serving under Taliban leadership
  • Name found on Taliban documentation, such as membership lists
  • Detainee has familial ties to Taliban officials
  • Associations with Taliban or ACM leaders
    • Mullah Muhammad Omar
    • Al-Tayib Agha
    • Jalaluddin Haqqani
    • Khirullah Said Wali Khairkhwa (ISN US9AF-000579DP)
    • Mullah Berader
    • Mullah Dadullah Lang
    • Mullah Fazil
    • Mullah Muhammad Fazl (ISN US(AF-000007DP)
    • Wakil Ahmad Muttawakil (ISN US(AF-000548DP)
    • Various Taliban Ministries
    • Other leadership and key members as identified in assessments and intelligence reporting, including those assessed to have been conduits betweenUsama Bin Laden and the Taliban
  • Associations with non-Taliban ACM organizations
  • Association with Pakistan ISID, especially in the late 1990s up to 2003
  • Attendance at Taliban training camps or received training from a Taliban member, especially after 11 September 2001
  • Occupied Taliban support facilities
  • Captured with other Taliban
  • Possessed weapons, explosives, mines, etc.

Share this: