‘Did Not Wish to Create Panic’: FOIA Records Rebuild the Official Story of the Kabul Evacuation

What do FOIA records show about the 2021 Afghanistan withdrawal?

Records released under the Freedom of Information Act show that Embassy Kabul had a certified evacuation plan but was not ready to use it. A State Department inspector general review found leadership feared “panic,” evacuee counts were unreliable, and key officers rotated out in the days and weeks before Kabul fell. Navy emails show the scramble that followed.

The embassy had a plan. It was written, certified, and drilled. It wasn’t enough.

That is the bottom line of the State Department inspector general’s review of the August 2021 evacuation of U.S. Embassy Kabul. The full 73-page report, AUD-MERO-23-15, is still listed on the inspector general’s website as containing “information that is Classified and is not available for public viewing.” A copy released under the Freedom of Information Act withholds large blocks under exemption (b)(1), the national security exemption. What survives is blunt.

Read alongside the inspector general’s public summary and two email chains from the records of Adm. Michael Gilday, then the chief of naval operations, the released pages rebuild a dated record of the withdrawal: what Washington said, what the embassy did, and what the Navy saw as evacuees poured out of Kabul.

Editor’s note: Page citations to AUD-MERO-23-15 give the report’s printed page, and each link opens the released PDF at the matching page. The released copies of AUD-MERO-23-15, ISP-S-23-05A, and the Navy emails are hosted with this article, with SHA-256 checksums in the docs folder index.

What Did the State Department OIG Find About the Kabul Evacuation?

The State Department’s Office of Inspector General found that Embassy Kabul wrote its emergency action plan by the book but was not ready for what came. Leadership feared overt evacuation planning would cause panic, its count of potential evacuees was unreliable, and the criteria for which Afghans qualified were never clearly defined.

The review, issued in May 2023 by the inspector general’s Middle East Region Operations division, set out to determine “whether Embassy Kabul followed established Department guidance in preparation for and execution of the evacuation” of U.S. personnel, private citizens, “Afghans at risk, and other individuals from Afghanistan in August 2021.” It opens with a single sentence on the result: the State Department and the Pentagon “oversaw a chaotic, noncombatant evacuation operation (NEO) in which 13 U.S. service members and many Afghan nationals lost their lives.” (AUD-MERO-23-15, Highlights)

The box beside it, headed “What OIG Found,” is blank in the release except for one marking: (b)(1).

Transcription AUD-MERO-23-15, Highlights (PDF p. 2)

“(U) On August 31, 2021, the Department of State (Department) officially suspended operations at U.S. Embassy Kabul, Afghanistan. … From there, the Department, along with the Department of Defense (DoD), oversaw a chaotic, noncombatant evacuation operation (NEO) in which 13 U.S. service members and many Afghan nationals lost their lives.”

“(U) What OIG Found” — [box withheld, marked “(b)(1)”]

Full-size image

The released text makes two findings. Finding A: the embassy’s plan followed guidance. It was “reviewed, certified, and approved before the annual review deadline,” and committee members “took emergency planning seriously,” the report says. But it quotes the State Department’s own handbook back at the embassy: “[h]aving a written Department-approved plan does not automatically mean the post is prepared for a crisis.” (pp. 11–12)

Finding B: “Embassy Kabul Was Not Fully Prepared for Challenges it Encountered in Evacuating Individuals.” The public summary puts it plainly: the embassy “was not adequately prepared for the full scope of challenges it would encounter while executing the evacuation in the final weeks of August 2021.” (AUD-MERO-23-33, p. 1)

The reasons the inspector general gives are specific:

• Fear of panic. Embassy leadership “expressed apprehension about taking overt actions in preparation for an evacuation,” fearing they “would undermine diplomatic support for the government of Afghanistan and cause panic.” (p. 33)
• A message from the top. Officials told the inspector general the ambassador did not push a further drawdown or start evacuation procedures “at least in part” because embassy leadership was carrying out “the Administration’s stated position that diplomatic operations would continue.” (p. 32)
• Bad numbers. The embassy’s count of potential evacuees, the F-77 report, was “far fewer” than the number later evacuated, and its data “were unreliable.” (p. 15)
• No definition of “at risk.” Embassy officials “were not provided a clear definition of ‘Afghans at risk’ or ‘vulnerable Afghans,’” and the criteria “expanded as the evacuation evolved.” (p. 18)
• Two ambassadors. After the embassy moved to the airport, a second ambassador arrived from Washington. Defense Department personnel said “there wasn’t an authority on who was specifically in charge.” (p. 35)

The embassy’s leaders kept the alarm low inside the building, too. Management officers wrote in their after-action report that “Embassy Leadership did not wish to create panic and . . . ensured that Management Notices and informational emails did not address the truly dire situation.”

Transcription AUD-MERO-23-15, p. 33 (PDF p. 36)

“despite the reported worsening security conditions, the Senior Regional Security Officer and two deputies (who had been at post for the prior year) departed in early August 2021, leaving the responsibility for security to individuals who had just arrived in July and August 2021.”

“In their after-action report, management officers wrote that ‘Embassy Leadership did not wish to create panic and . . . ensured that Management Notices and informational emails did not address the truly dire situation.’”

Full-size image

An official told the inspector general that “the Ambassador reprimanded embassy personnel when they expressed concerns about their safety given the deteriorating security environment during a meeting.” Emails from the embassy’s Community Liaison Office “during the week of the evacuation promoted social events at the embassy.” Asked when the decision to evacuate was made, members of the embassy’s Emergency Action Committee “reported multiple inconsistent dates and times.” (p. 34)

What Happened in the Months Before Kabul Fell?

In the four months between President Joe Biden’s April 14, 2021, withdrawal announcement and the Taliban’s August 15 entry into Kabul, the embassy urged Americans to leave and signed evacuation deals with allies. It also grew. Some staff ordered out in April were allowed back, and key security and consular officers rotated home in early August.

The released pages carry the dates. On April 27, 2021, the State Department ordered non-emergency staff to depart, and the embassy posted an alert telling U.S. citizens to make plans to leave “as soon as possible.” Since March, Secretary of State Antony Blinken later said, the department had sent “19 separate messages” to Americans enrolled with the embassy.

Transcription AUD-MERO-23-15, p. 12 (PDF p. 15)

“(U) Finding B: Embassy Kabul Was Not Fully Prepared for Challenges it Encountered in Evacuating Individuals” — [box withheld, marked “(b)(1)”]

“In the intervening months, Embassy Kabul took some actions to prepare for potential emergencies.”

“prior to the ordered departure in April 2021, the embassy reported that it had a total of 3,938 personnel (including 301 American direct hires) at the embassy. By June 23, 2021, that number had increased to 4,091 personnel (including 433 U.S. direct hires).”

Full-size image

Yet the embassy got bigger. Before the April ordered departure, it reported 3,938 personnel, including 301 American direct hires. By June 23, 2021, the number “had increased to 4,091 personnel (including 433 U.S. direct hires),” the inspector general found. For “a brief time, the embassy allowed some personnel who were ordered to depart in April to return.” (p. 33)

The public line from Washington did not waver. “While we will not stay involved in Afghanistan militarily, our diplomatic and humanitarian work will continue,” Biden said on April 14. On July 8, he said, “I intend to maintain our diplomatic presence in Afghanistan.” The inspector general ties those words directly to the embassy’s reluctance to plan openly for an evacuation.

Transcription AUD-MERO-23-15, p. 32 (PDF p. 35)

“(U) According to multiple officials OIG interviewed during this review, another reason why the Ambassador did not prompt the additional drawdown of personnel or initiate NEO procedures when the EAP risk indicators were crossed and security conditions worsened was, at least in part, due to embassy leaderships’ execution of the Administration’s stated position that diplomatic operations would continue following the withdrawal of U.S. military forces.”

Full-size image

Then the people who would run an evacuation left. “Despite the reported worsening security conditions,” the senior regional security officer and two deputies departed in early August 2021, “leaving the responsibility for security to individuals who had just arrived in July and August 2021.” The consular chief left on August 5. Ten days later, the Taliban were in Kabul.

The Reconstructed Timeline

Report page numbers are the printed numbers; links open the released PDF at the matching page. Email times are as printed in the headers.

What Is a Noncombatant Evacuation Operation?

A noncombatant evacuation operation, or NEO, is an evacuation the State Department directs and the Defense Department supports. Civilians are moved out of a foreign country “when their lives are endangered by war, civil unrest, or natural disaster to safe havens as designated by the Department,” in the inspector general’s definition.

The definition sits in a footnote on page 4 of the review (PDF p. 7). Federal law puts the secretary of state in charge of “the safe and efficient evacuation of United States Government personnel, dependents, and private United States citizens when their lives are endangered.” The embassy’s tools for the job were these:

• Emergency action plan (EAP): the embassy’s crisis playbook, certified each year. Its Annex K covers drawdown and evacuation.
• Emergency Action Committee: the senior staff who meet to weigh threats and recommend action.
• Risk indicators and decision points: the tripwires in the plan that should prompt a drawdown. The embassy’s July 2021 framework is Appendix B of the review.
• F-77 Report of Potential Evacuees: the embassy’s estimate of how many people might need to be evacuated, which planners at State and the Pentagon rely on.

The F-77 failed in Kabul. The embassy updated it in June 2021 and cut its estimate. Both the February and June versions counted “far fewer” people than the government later said it evacuated. The embassy’s own plan had warned: “Any list or count of U.S. citizens in Afghanistan is unlikely to be very accurate.” (p. 16)

The final count is shaky, too. Blinken said the United States and its partners evacuated about 124,000 people, including 6,000 Americans. The inspector general could not confirm it. “According to a Department official, the number of evacuated persons reported by the Secretary ‘came from DoD,’” the public brief says. (AUD-MERO-23-33, p. 5)

Transcription AUD-MERO-23-15, p. 42 (PDF p. 45)

“after multiple inquiries, the Department could not provide documentation supporting its statement that the U.S. government and its partners evacuated approximately 124,000 individuals in the weeks before it suspended operations at Embassy Kabul.”

Full-size image

There is also a quirk in the words. In a March 20, 2023, meeting, department officials told the inspector general that the State Department “did not ‘evacuate’ Afghans at risk. Rather, the Department ‘relocated’ Afghans at risk,” because it lacks authority to pay to evacuate host-country nationals. The report uses “evacuate” anyway, “to minimize confusion.” (p. 13)

What Do the Navy Chief’s Emails Show About the Evacuation?

The emails, from the records of Adm. Michael Gilday, chief of naval operations, show the evacuation from the receiving end. A Navy status report counts 662 evacuees at Naval Air Station Sigonella in Italy. A second chain tracks 53 at-risk Afghan women stopped at a Taliban checkpoint outside Kabul’s airport, and the admirals working to get them through.

The Sigonella Status Report

The first record is an end-of-day report on Navy support to Operation Allies Refuge in Europe, sent to Gilday at 5:26 AM on Tuesday, August 24, 2021, with Adm. Christopher Grady and Adm. Samuel Paparo copied. The sender’s name is withheld under (b)(6); the message is signed “Bob.”

“NAVEUR execution of Day 2 of Operation ALLIES REFUGE continued with care and feeding of all 662 evacuees at NAS Sigonella (NASSIG),” it begins. Naval Station Rota, in Spain, had reached initial operating capability to support 650. The bottleneck was guards: “Security forces are the limiting factor to move either of our sites beyond their current capacity.” The 147 passengers on a KC-10 flight had left their luggage in Qatar, it noted, “several of which had their identification and personnel documents in their bags.” (p. 1)

Transcription NAVEUR Operation ALLIES REFUGE EOD 23Aug21, August 24, 2021, p. 2

“NAS SIGONELLA: Active Site
Evacuated personnel on Hand / Current Capacity: 662 / 1500
…
COVID Testing: all 662 evacuees tested, 2 positive, 8 close contacts (all 10 same family isolated)
State and Host Nation: Embassy Team on Station. Awaiting Consular service team.”

“Narrative: NASSIG received a total of 662 consisting of 1x American Citizen (AMCIT), 1 Other Country National (OCN), and 654 Afghan personnel.”

“NS ROTA: On Standby
Evacuated personnel on Hand / Current Capacity: 0 / 650
…
DHS Biometrics: None on station - awaiting prioritization from State and DHS”

Full-size image

Gilday replied at 9:48 AM: “Based on calls I’ve had, I believe tempo will increase … airlift from HKIA over past 28 hrs the most visible of a few indicators.”

Same Record, Processed Twice

The same report appears twice in the release. The body text of the two versions is identical. The redactions are not.

Version A

Version B

Transcription NAVEUR Operation ALLIES REFUGE EOD 23Aug21, August 24, 2021, pp. 1–2, versions A and B

Both versions: “Bob, super job by everyone. Good news on the BM kits … that’s been a constraint to thruput elsewhere. Based on calls I’ve had, I believe tempo will increase … airlift from HKIA over past 28 hrs the most visible of a few indicators.”

Version A: “Scotty Gray and (b) (6) (base CO at Sig) have done an absolutely superb job bringing this together.” Version B: “Scotty Gray and [unlabeled bar] (base CO at Sig) have done an absolutely superb job bringing this together.”

Editor’s note: A pixel comparison of the two versions found differences only in the black bars, on page 1 in the Cc line and on page 2 next to “Scotty Gray and.” Neither version reveals text that the other withholds. Version A is used for the figures above.

The “White Scarfs” at the South Gate

The second chain runs from Friday night, August 27, 2021, to Saturday night, August 28. It is between Gilday and Vice Adm. James J. Malloy at U.S. Central Command.

Malloy’s first message laid out the problem. A group of “53 X at-risk females,” which he called the “White Scarfs,” had reached the airport’s South Gate on two buses, as the International Coordination Cell at the airport had asked. Taliban soldiers checked the license plates and the passengers’ papers, made phone calls, and then told them “they were not ‘approved’ to move forward.” Malloy said the group was working with the Qataris, who “have been effective go-betweens with the TB,” his shorthand for the Taliban.

Transcription NED “White Scarfs” Update, August 27, 2021, 8:40 PM (p. 4)

“BL: I just received the following update from our A/SIG cell here at CENTCOM regarding the ‘White Scarfs.’ We are tracking that this particular group of White Scarfs (53 X at-risk females) is still in Kabul after an unsuccessful attempt to get through a TB checkpoint to the gates at HKIA.”

“Once they completed their phone calls, the TB got back on the buses and told the passenger they were not ‘approved’ to move forward and they should leave the line immediately.”

“As we discussed, the transition through Taliban check points has become increasingly problematic and the ICC’s ability to assist Afghans (without visa’s) at check points has become very limited.”

Full-size image

At 4:49 AM Saturday, Malloy wrote that “we are mourning the loss of our Marines, Soldier and Sailor down here,” and praised “RADM Pete Vasley” for “negotiating with the Taliban” and “briefing the President (at least daily).” At 10:30 AM, Gilday passed along word that one small group of the 53 had been let through.

Transcription NED “White Scarfs” Update, August 28, 2021, 10:30 AM (p. 3)

“Jim,
Rcvd word that one small group, possibly a family ([private family name blacked out]), of the 53 total, was allowed through, but the remainder of the group is 100m from South Gate.

Can A/SIG check status again with ICC?

Thanks very much Jim. VR Mike”

Full-size image

By 12:53 PM, Malloy reported “breaking news that there was TB movement of busses - clearing at least one large group into HKIA.” Twice, Malloy re-sent a message with a note. The first read “Unencrypted sir..” The second, at 12:58 PM Saturday, read “Unencrypted sir...sorry..” and went to Gilday’s michael.gilday@navy.mil address, which the release leaves visible.

At 8:48:59 PM Saturday, Gilday wrote that “about 100 of the White Scarfs made it into HKIA,” more than the 53 in the particular group Malloy first described. Malloy answered minutes later: “Glad we got done sir. So many deserving. This process was never designed for an ‘accelerated breakaway’ and our IA partners do not flex like that. Will continue to watch for the rest of them and pray there is not a repeat from 3 days ago.”

Transcription NED “White Scarfs” Update, August 28, 2021, 8:48:59 PM (p. 1)

“Jim, I received a call that about 100 of the White Scarfs made it into HKIA. Thank you Jim … and the teams here and forward who are doing God’s work under the most difficult of circumstances.
VR Mike”

Full-size image

Editor’s note: Times are as printed in the email headers; the release does not state a time zone. The “White Scarf” list Malloy attached is not in the release.

What Is the Government Still Withholding?

Most of the inspector general’s findings. In the released copy of AUD-MERO-23-15, exemption (b)(1) blanks the summary of findings, the evaluation of the embassy’s warning signs, four of ten recommendations, and most of its July 2021 decision-points framework. A companion annex on the Afghanistan Affairs Unit is withheld almost entirely.

The public brief says why its own account is thin: “Because of the classified nature of the details included in the report, this unclassified summary information brief does not contain everything OIG previously reported.” The complete report went to the State Department and congressional committees. The inspector general’s evaluation of how the embassy handled its risk factors as security worsened is “not included in this information brief due to their classified nature.” (AUD-MERO-23-33, p. 8)

• The core findings. The “What OIG Found” box on the Highlights page of AUD-MERO-23-15 is withheld in full under (b)(1).
• The warning signs. The inspector general’s evaluation of how the embassy acted on its risk indicators as security worsened is withheld.
• Four recommendations. The wording of Recommendations 7 through 10 is withheld in the report’s list of recommendations.
• The decision points. Most of the embassy’s July 2021 Decision Points Framework, Appendix B, is withheld.
• The annex. Almost all of ISP-S-23-05A is withheld, including the threat ratings for the Afghanistan Affairs Unit.
• Personal details. In the Navy emails, (b)(6) covers email addresses, phone numbers, and some names, including the Sigonella base commander’s.

Transcription AUD-MERO-23-15, Appendix B, p. 43 (PDF p. 46)

“(U) APPENDIX B: U.S. EMBASSY KABUL DECISION POINTS FRAMEWORK, JULY 2021”

“OPERATING ASSUMPTIONS: Operating Assumptions provide a baseline of the unique conditions in which Post operates.” — [rest of page withheld, marked “(b)(1)”]

Full-size image

The released pages also show their history. The “SECRET//NOFORN” banners are struck through and the declassification instructions lined out, the marks of a classified document reviewed for release.

The annex makes the point starkly. ISP-S-23-05A, the November 2022 classified annex to the inspection of the Afghanistan Affairs Unit, the Doha-based office that replaced Embassy Kabul, runs seven pages. In the release, almost nothing survives but headings and footnotes. The unclassified parent report, ISP-I-23-05, says the annex covers “the inspection’s classified and Sensitive But Unclassified findings,” including staffing. (ISP-I-23-05, p. 2)

Transcription ISP-S-23-05A, cover (PDF p. 1)

“ISP-S-23-05A Office of Inspections November 2022 — Classified Annex to the Inspection of the Afghanistan Affairs Unit — BUREAU OF SOUTH AND CENTRAL ASIAN AFFAIRS”

[Crossed out:] “Classified By: Sandra Lewis, AIG / Reason: DSCG 17-01, C, G / Declassify By: 20471130”

Full-size image

Transcription ISP-S-23-05A, Appendix A (PDF p. 6)

“(U) APPENDIX A: THREAT RATINGS” — Post: “AAU” — Terrorism, Political Violence, Crime, Human Intelligence, Technical Intelligence: [withheld, marked “(b)(1)”]

“Source: Department’s Security Environment Threat List, dated December 23, 2021.”

Full-size image

How Do You Reconstruct Military Events From FOIA Documents?

Start with the record’s ID, request it under FOIA, and read the redacted release against its public companion. Pin every fact to a date, a document, and a page. Treat email headers as data, compare duplicate releases, and report only what the pages show. Redaction boxes mark what exists; they do not say what it is.

1. Find the record’s ID. Search the inspector general’s report list, Oversight.gov, and the agency’s FOIA reading room. A classified report usually still has a public landing page with its number and date.
2. Request it by that ID. File a FOIA request with the office that holds the record, cite the report number, and ask for every reasonably segregable portion. Classified pages come back with (b)(1) boxes, not blank refusals.
3. Pair it with the public version. Read the redacted release next to any unclassified summary or parent report. The public version fills in context; the release shows how much of the full text exists.
4. Pin every fact to a date and a page. Log each event with its date, the document ID, and the printed and PDF page numbers, then sort the log into a timeline table.
5. Read email headers as data. Record each message’s sender, recipients, timestamp, and subject. Re-sends, replies, and attachments missing from the release show how information moved.
6. Compare duplicate releases. When the same record turns up twice, set the copies side by side. Different redactions show processing choices, not new facts.
7. State only what the record shows. Quote verbatim, cite the page, and leave redactions alone. A blacked-out box tells you something exists, not what it says.

Which Documents Are Most Useful?

The most useful records pair a formal finding with the raw traffic underneath it. An inspector general report supplies findings, footnoted dates, and staffing figures. Senior officials’ emails and daily status reports supply the timestamps and the words used in the moment. A classified annex, even blacked out, shows how much is still held back.

• Inspector general reports and their public companions, such as AUD-MERO-23-15 and AUD-MERO-23-33, for findings, footnoted dates, and staffing numbers.
• Classified annexes, such as ISP-S-23-05A, to map what is still withheld.
• Senior officials’ email records, for timestamps and the language used at the time.
• Daily situation reports, such as the Navy’s end-of-day status report, for headcounts and capacity.
• After-action reports and management responses, often quoted inside inspector general reports.

The Records at a Glance

Frequently Asked Questions

Is the full State Department OIG report on the Kabul evacuation public?

No. The inspector general’s website lists AUD-MERO-23-15 as classified and “not available for public viewing.” A copy released under FOIA keeps the unclassified paragraphs and withholds the rest under exemption (b)(1). The public information brief, AUD-MERO-23-33, summarizes the findings but leaves out the classified details.

What is the difference between AUD-MERO-23-15 and AUD-MERO-23-33?

AUD-MERO-23-15 is the full 73-page review from May 2023, still classified in its complete form. AUD-MERO-23-33 is the 13-page unclassified information brief from September 2023. The brief says it “does not contain everything OIG previously reported” and that the complete report went to the State Department and congressional committees.

What do the FOIA exemptions (b)(1) and (b)(6) mean?

Exemption (b)(1) covers information properly classified in the interest of national defense or foreign policy. Exemption (b)(6) covers personnel and similar files whose release would be a clearly unwarranted invasion of personal privacy. In these records, (b)(1) blanks most findings and (b)(6) covers addresses, phone numbers, and some names.

Who were the “White Scarfs” in the Navy emails?

The released emails describe them only as a group of “53 X at-risk females” trying to reach Hamid Karzai International Airport in late August 2021. Neither “White Scarfs” nor “NED” is defined in the release, and the list of names that Vice Adm. James Malloy attached to his first email is not included.

How many people were evacuated from Afghanistan in August 2021?

Secretary of State Antony Blinken put the figure at about 124,000, including 6,000 U.S. citizens. The State Department’s inspector general could not confirm it. After multiple inquiries, the department could not provide supporting documentation, and an official told the inspector general the number “came from DoD.”

Colin Aamot is an investigative journalist and OSINT domain expert specializing in FOIA and public records. A technologist, U.S. Army veteran, and former Capitol Hill staffer, he has held director roles across the private and public sectors.Full bio