Sources on security incidents

Sources on security incidents

Data of the Armed Conflict Location and Event Data Project (ACLED)3 and the Uppsala Conflict Data Program (UCDP)4 have been used for information on security events and fatalities. Data provided by UN reports have also been used in some sections.

ACLED is a project that collects, analyses and maps information on ‘dates, actors, locations, fatalities, and types of all reported political violence and protest events around the world’.5 ACLED has been covering political violence and protests in Afghanistan since January 2017. Each week, around 110 sources are reviewed in English, Dari/Farsi, Pashto, and Arabic and the information is compiled in a database.6 The main sources used in the database for the reference period of this report was Afghan exile media, and the ACLED curated data files for Afghanistan used for this report were downloaded on 10 December 2025.

ACLED explains the methodology applied for coding and monitoring the data in a codebook and in a specific methodology document for Afghanistan.7 As ACLED points out, the reader should be aware of some limitations, including the fact that ‘most of the data is gathered based on publicly available, secondary reports’. Thus, the data are in part a reflection of the coverage and reporting priorities of media and international organisations. One effect of this is that it may under-estimate the volume of events of non-strategic importance (for example, low-level communal conflict, or events in very isolated areas). ACLED addresses this possibility by ‘triangulating data sources to include humanitarian and international organisation reports, rather than media alone; and by conducting ground-truthing exercises’ in which they ‘present data to local organisations and partners to assess its validity among people working directly in conflict-affected contexts’.8 Based on the above, ACLED's figures in this report are to be considered as an estimate and illustration of violence trends over a given time period.9

ACLED also provides an estimated number of fatalities for each security event, but notes that ‘[f]atality data are typically the most biased, and least accurate, component of any conflict data’ and ‘should be treated as “reported fatalities”’.10 Furthermore, ACLED’s fatality figures include the reported deaths in totality per event, and do not distinguish civilian deaths.11

ACLED records six event types: battles, explosions/remote violence, violence against civilians, protests, riots and strategic developments.12 For the analysis of the security situation in Afghanistan in this report, only battles, explosions/remote violence and violence against civilians were included as incidents. ACLED uses the following definitions of these event types:

• Battle: ‘a violent interaction between two politically organized armed groups’ which occurs ‘at a particular time and location’, ‘between armed and organised state, non-state, and external groups, and in any combination therein’. There is no fatality threshold for an incident to be included. Sub-events associated with ‘battles’ are designated according to the events outcome and consist of ‘armed clash’, ‘government regains territory’, and ‘non-state actor overtakes territory’.13

• Violence against civilians: ‘violent events where an organized armed group deliberately inflicts violence upon unarmed non-combatants’ and includes attempts at inflicting harm (e.g. beating, shooting, torture, rape, mutilation) or forcibly disappearing civilian actors. Sub-events associated with ‘violence against civilians’ are: ‘sexual violence’, ‘attack’, and ‘abduction/forced disappearance’. It should be noted that all violence against civilians do not fall under this category, as civilians can also be harmed as ‘collateral damage’ in ‘explosions’ and ‘battles’ – in such cases a separate civilian-specific event is not recorded, although the number of fatalities is aggravated.14

• Explosions/remote violence: ‘incidents in which one side uses weapon types that, by their nature, are at range and widely destructive’. The sub-event types associated with ‘explosions/remote violence’ are ‘chemical weapon’, ‘air/drone strike’, ‘suicide bomb’, ‘shelling/artillery/missile attack’, ‘remote explosive/landmine/IED’, and ‘grenade’.15

ACLED identifies three codes for the geo-precision of events taking place in a particular town with available coordinates (geo-precision 1), ‘a small part of a region’ or ‘a general area’ (geo-precision 2) and a larger region (geo-precision 3).16 This report provides information about the security situation at provincial level and therefore makes use of all geo-precision levels.

UCDP is a ‘data collection project for civil war’.17 UCDP provided EUAA with a Georeferenced Event Dataset (GED) covering the reference period of the report. UCDP’s methodology is explained on its website as well as its GED Codebook.18 The unit of analysis of UCDP is the ‘event’19 which is defined as ‘[a]n incident where armed force was used by an organised actor against another organized actor, or against civilians, resulting in at least 1 direct death at a specific location and a specific date.’20 This leads, among other things, to ‘seemingly low estimates’ because ‘a number of factors can preclude a potential conflict event from inclusion in the UCDP GED’, for example, unclear actors or uncertainty about whether fatalities occurred.21 UCDP provides three estimates for fatalities for each event – a low estimate, a best estimate, and a high estimate. In addition, UCDP provides an estimate of the number of civilian deaths.22 According to UCDP, ‘it is quite likely that there are more fatalities than given in the best estimate, but it is very unlikely that there are fewer’.23

The stricter definition of an event of UCDP excludes some violent events recorded by ACLED, such as events attributed to ‘unidentified armed groups’. The difference in definitions is one explanatory factor to why the number of events recorded by ACLED can be significantly higher than events recorded by UCDP.24 In this report, UCDP data have been used to contrast ACLED data and to provide figures on civilian deaths. To reflect the security dynamic in Afghanistan, where the actor behind many security incidents is unknown, EUAA not only includes events that meet all UCDP’s set criteria (codified as ‘clear’ events in the UCDP dataset), but also include events codified as ‘unclear’ and ‘not applicable’.