Every targeted killing in Pakistan follows an operational script so consistent that the consistency itself becomes evidence. Two men on a motorcycle approach a designated individual at a location the target visits routinely, fire at close range with handguns, and vanish into the urban traffic within seconds. No group claims credit. No arrested operative offers testimony. Pakistani police file FIRs describing “unknown gunmen on a motorcycle,” and the case files collect dust. But the script’s repetition across Karachi, Lahore, Sialkot, Rawalpindi, Nawabshah, Rawalakot, and Landi Kotal tells a story that individual case files cannot: this is not improvisation. It is doctrine.

Understanding the modus operandi behind these eliminations requires moving beyond what happened in each case to examine how the killings are structurally executed, what capabilities each element demands, and what the operational signature reveals about the organization conducting them. The broader campaign has produced enough data points that the MO can be reconstructed from open-source reporting with reasonable confidence. Police FIR descriptions, witness accounts published in Pakistani newspapers, CCTV footage where available, and the geographic and temporal distribution of attacks all feed into a composite operational picture. Taken individually, each piece of evidence is fragmentary. Taken together, they form a mosaic that reveals disciplined operational planning behind what Pakistani authorities publicly dismiss as isolated criminal incidents.

No single source provides a complete picture. Pakistani police reports are formulaic and often incomplete. Witness accounts, filtered through trauma and retold across news cycles, carry inherent distortions. Defense analysts and intelligence commentators operate with varying degrees of access and varying analytical frameworks. But the convergence of independent sources pointing in the same analytical direction creates a weight of evidence that no single source could provide alone.

The argument this article advances is specific: the operational signature requires at minimum three capabilities that only a state-level intelligence apparatus can sustain. First, human intelligence on a target’s daily schedule, which demands infiltration of the target’s social or professional circle. Second, physical surveillance of the chosen location for a minimum of two weeks, which demands local assets who can loiter without attracting attention. Third, extraction infrastructure allowing the attackers to move through Pakistani cities with confidence, which demands familiarity with urban terrain, pre-positioned vehicles, and a network of safe locations. Freelance contractors, criminal gangs, or rival militant factions could replicate one or two of these capabilities in isolated cases. Replicating all three across multiple cities, against multiple targets, over several years, with zero operational failures, is a different proposition entirely. No criminal enterprise, no militant faction, and no lone-wolf actor has ever demonstrated this combination of capabilities sustained over this duration and geographic scope. The MO points toward a single conclusion about the nature of the actor behind it.

The Pattern Emerges

The first reported killing that matches the operational profile occurred in Karachi in late 2021, when unidentified assailants on a motorcycle shot a suspected militant in the city’s congested Orangi Town district. Pakistani media covered the event as routine urban violence, a reasonable assessment given Karachi’s history of gang and sectarian shootings. Nothing in that single incident suggested a broader campaign. But within months, a second killing with near-identical characteristics occurred in a different Karachi neighborhood, targeting another individual with documented links to Lashkar-e-Taiba. By mid-2022, when Zahoor Mistry, a convicted participant in the IC-814 hijacking living under a false identity, was gunned down in Karachi by two motorcycle-borne assailants, the pattern had become impossible to dismiss as coincidence.

Between late 2021 and early 2023, at least eight targeted killings matching the same operational profile occurred across three Pakistani provinces: Sindh, Punjab, and Khyber Pakhtunkhwa. The targets shared a common attribute that distinguished them from ordinary victims of Karachi’s pervasive street crime. Every one of them appeared on India’s designated-terrorist lists, NIA charge sheets, or UNSC sanctions documents. Karachi street gangs do not consult the National Investigation Agency’s files before selecting victims. The target selection alone eliminated the criminal-violence hypothesis for anyone willing to examine it.

The analytical gap between the start of the campaign and its public recognition as a campaign reveals something important about how intelligence operations remain hidden. For months, possibly over a year, individual killings were treated as isolated incidents in Pakistani reporting. Karachi desk editors filed them alongside daily gang violence summaries. Punjab correspondents noted them as localized disturbances. Only when analysts, both within Pakistani intelligence and in the international media, began cross-referencing the targets’ backgrounds did the commonality emerge: every victim had a documented history of anti-India terrorism. This delayed recognition is not accidental but a designed feature of the campaign’s operational strategy. By embedding campaign operations within the background noise of Pakistan’s endemic urban violence, the operators gained a crucial initial period during which their methods could be refined, their networks tested, and their capabilities validated without triggering a systematic counter-intelligence response. By the time the pattern became publicly visible in 2023 and 2024, the operational infrastructure was already mature enough to absorb whatever counter-measures Pakistan might deploy.

The geographic expansion followed a revealing trajectory. The campaign began in Karachi, Pakistan’s largest and most chaotic city, where motorcycle shootings are so common that additional incidents attract minimal investigative attention. From Karachi, the operations moved north and east into Punjab, hitting targets in Sialkot, Lahore, and the Rawalpindi area, each city presenting a progressively harder security environment than the last. Then came Khyber Pakhtunkhwa, where Sheikh Yousaf Afridi was shot in Landi Kotal, deep in tribal territory where the Pakistan Army maintains a heavy presence. Each geographic expansion represented an escalation in operational confidence and capability. Moving from Sindh to Punjab to KPK required not merely the willingness to operate in harder environments but the infrastructure to support operations in those environments: local assets, local knowledge, local logistics, and local escape routes. The progression from easy to hard mirrors the training philosophy of professional intelligence organizations, which test methods in permissive environments before deploying them in contested ones.

The temporal acceleration provided a second form of evidence. In 2022, the documented kills numbered in single digits. By 2023, the pace had roughly doubled. Al Jazeera’s April 2024 reporting, citing Pakistani security officials, attributed at least eight killings to a “hostile intelligence agency” operating on Pakistani soil. Geo News and Dawn published similar tallies, though the exact numbers varied because some cases fell into the ambiguous zone between campaign-attributed hits and ordinary criminal violence. The acceleration indicated not a series of opportunistic strikes but a campaign gaining momentum as its infrastructure matured.

Pakistani intelligence analysts, writing in local security journals and speaking to reporters on background, have offered conflicting assessments of the campaign’s pace. Some have argued that the actual number of attributed killings exceeds the publicly reported figures, because certain cases in rural areas receive minimal media coverage. Others have suggested that the maximalist counts inflate the pattern by including sectarian and criminal shootings that are unrelated to the India-focused campaign. The minimalist count, restricted to cases where the target has a verifiable listing on India’s NIA designation list or UNSC sanctions documentation, still produces a number large enough to constitute a sustained operational campaign. Whether the true figure is twenty-five or forty across the campaign’s full duration, the number is sufficient to demonstrate institutional capability rather than opportunistic action.

The operational learning curve visible in the campaign’s early phase is analytically revealing. The first documented operations were conducted in Karachi, where the base rate of motorcycle violence provided maximum camouflage. As the campaign’s operators gained confidence and refined their methods through successful operations, they expanded into more challenging environments: smaller cities with lower base rates of violence, Punjab with its heavier military presence, and eventually PoK with its dedicated military-intelligence overlay. This geographic progression mirrors the learning curve visible in Mossad’s post-Munich campaign, where initial operations targeted low-hanging fruit in relatively permissive European cities before progressing to more challenging operational environments in the Middle East. The shadow war’s operators appear to have followed an analogous capability-development trajectory, using early operations as training exercises that built the organizational confidence to attempt progressively harder targets in progressively harder environments.

What made the pattern analytically significant was the absence of variation where variation might be expected. Criminal organizations adapt their methods case by case. Rival militant factions use car bombs, IEDs, or ambushes as often as close-range shootings. The consistency of the motorcycle-plus-handgun method across different cities, different targets, and different security environments pointed toward standardized training and a doctrinal approach to operations.

Case-by-Case Breakdown

The Karachi Cluster: Establishing the Template

Karachi provided the operational laboratory. The city’s characteristics made it ideal for the campaign’s initial phase: a population exceeding fifteen million, traffic congestion that renders vehicular pursuit nearly impossible, over two million registered motorcycles providing anonymity in numbers, and a base rate of motorcycle-borne shootings high enough that additional incidents do not trigger systemic police responses.

Ziaur Rahman, an LeT operative, was shot during his evening walk in Karachi in September 2023. Witnesses described two men on a Honda 125cc motorcycle approaching from behind as Rahman walked near his residence. The pillion rider fired three shots from a semi-automatic pistol at a range of approximately two meters. Two rounds struck Rahman in the head and upper body. He collapsed immediately. The motorcycle accelerated into the adjacent lane and disappeared into traffic within fifteen seconds. No shell casings were recovered at the scene, suggesting the shooter either used a revolver (which retains spent casings) or collected casings as part of a trained evidence-elimination protocol. Karachi police registered the FIR as an “unidentified gunmen” case and made no arrests.

Weeks later, Mufti Qaiser Farooq, a direct aide to Hafiz Saeed, was killed near a religious institution in Karachi’s Samanabad area. The method was nearly identical: motorcycle approach, close-range fire, rapid withdrawal. Farooq had been walking from the madrassa where he worked to a nearby market, a routine he followed on the same days each week. The attackers had clearly mapped this routine. They struck at the point along his walk where the street narrowed and foot traffic thinned, maximizing approach proximity and minimizing the number of potential witnesses with clear sightlines.

Sardar Hussain Arain, a JuD operative responsible for the organization’s madrassa network in Sindh, was killed in Nawabshah in a third Karachi-adjacent operation. Nawabshah is a smaller city, roughly 260 kilometers northeast of Karachi, where Arain had relocated, possibly believing that distance from the metropolis offered protection. It did not. The same method, motorcycle approach and close-range handgun fire, followed him to a smaller urban environment, demonstrating that the operational capability was not confined to Karachi’s specific geography. Arain’s killing in Nawabshah carries particular significance for the MO analysis because it proves that the operational teams can deploy outside of the major-city environments where motorcycles provide maximum anonymity. In a city of Nawabshah’s size (population approximately 300,000), a motorcycle shooting generates immediate community attention in a way that the same event in Karachi does not. The operational team accepted this elevated attention risk, which suggests that their confidence in their extraction capability extended beyond the protective anonymity of megacity traffic into smaller urban environments where the margin for error narrows considerably.

The Karachi cluster also reveals a noteworthy pattern of inter-organizational targeting within a single city. The targets hit in Karachi span LeT operatives, JuD functionaries, and JeM-linked individuals, crossing organizational boundaries that Pakistani militant groups themselves respect. LeT and JeM maintain distinct organizational structures, separate funding channels, and largely separate geographic bases within Pakistan. A faction within one organization targeting members of the other is possible but unusual. A campaign that targets both organizations simultaneously in the same city points toward an external actor whose target list is defined by the targets’ anti-India activities rather than by any intra-Pakistani factional logic.

The Punjab Strikes: Geographic Escalation

The move into Punjab represented a qualitative escalation. Punjab is the heartland of the Pakistan Army. Rawalpindi, the garrison city, houses the General Headquarters of the Pakistan armed forces, the ISI directorate, and the country’s densest concentration of military and intelligence infrastructure. Conducting a covert operation in Punjab is categorically different from operating in Karachi’s anarchic streets.

Shahid Latif, the Jaish-e-Mohammed commander who masterminded the 2016 Pathankot airbase attack, was shot inside a mosque in Sialkot by masked gunmen. Sialkot sits in northeastern Punjab, approximately 100 kilometers from the Indian border. Latif had gone to the mosque for prayers, a routine so predictable that it gave the attackers a fixed window of opportunity. The mosque setting created particular operational challenges and advantages. The attackers could predict with near-certainty that Latif would be present at specific prayer times, but they also had to execute the operation in a confined, crowded space with limited escape routes. That they succeeded without being apprehended, in a Punjab city, inside a mosque, during prayers, indicated a level of planning that exceeded anything a freelance team would typically achieve.

The Lahore incident targeting Amir Hamza, the co-founder of Lashkar-e-Taiba and Hafiz Saeed’s deputy, pushed the operational boundary further. Lahore is not merely a major city; it is the base of LeT’s charitable infrastructure through Jamaat-ud-Dawa, the city where Saeed himself resides under Pakistani protection, and a security environment where LeT members operate with effective state approval. Attacking Hamza in Lahore was the equivalent of striking a made Mafia boss in his home borough. The attack did not kill Hamza but left him seriously wounded, demonstrating that even the most protected figures were vulnerable. The operational decision to strike in Lahore, rather than waiting for Hamza to travel to a less defended location, carried a message as deliberate as the bullets: nowhere is safe. Lahore’s security apparatus, which includes dedicated LeT-affiliated counter-surveillance teams, plainclothes ISI watchers in neighborhoods where senior militant figures reside, and a police force that historically treats LeT members as allies rather than targets, failed to prevent the attack or apprehend the attackers. The Lahore operation’s success under these conditions represented not merely a tactical achievement but a strategic humiliation for Pakistan’s security establishment, one that forced a fundamental reassessment of the shadow war’s reach and ambition.

The PoK and Border Operations: Testing Limits

Pakistan-occupied Kashmir and the border regions represent a distinct operational theater that the campaign penetrated with particular audacity. The PoK administrative structure, while nominally civilian, operates under effective Pakistani military control. Security forces in PoK monitor population movement, maintain checkpoints on major roads, and operate an informant network designed to prevent precisely the kind of infiltration that the shadow war’s operations imply. Operating in PoK requires navigating not only the Pakistani security apparatus but also the additional layer of military-intelligence oversight that the Army maintains in its most strategically sensitive territory.

The killing of Abu Qatal, the alleged mastermind of the Reasi attack and a close aide to Hafiz Saeed, in Jhelum district demonstrated that the campaign could reach into Punjab’s heartland. Jhelum sits along the Grand Trunk Road, one of Pakistan’s most historic and heavily traveled arterial routes, approximately 175 kilometers southeast of Islamabad. The operation in Jhelum followed the standard motorcycle-and-handgun template, but the location’s proximity to the Mangla military cantonment and the Jhelum garrison added a layer of operational risk that previous Karachi operations had not faced. The attackers demonstrated confidence in their ability to operate within the security perimeter of one of Pakistan’s major military installations.

Multiple LeT and Hizbul Mujahideen figures have been targeted in smaller cities and towns across Punjab and Sindh that lack the anonymity of Karachi’s megacity environment. In smaller urban areas, a shooting by unknown assailants generates more attention, more community-level scrutiny, and more pressure on local police to investigate than an equivalent incident in Karachi. The campaign’s willingness to operate in these environments signals either supreme confidence in the operational teams’ ability to withstand heightened scrutiny, or the existence of local support networks robust enough to absorb the additional risk.

The Tribal Frontier: Maximum Penetration

Afridi’s killing in Landi Kotal, the principal town in the Khyber district of Khyber Pakhtunkhwa, represents the deepest territorial penetration documented in the campaign. Landi Kotal sits at the western end of the Khyber Pass, approximately 50 kilometers from the Afghan border and 250 kilometers from Islamabad. The area is administered under special security protocols, with heavy Pakistan Army and Frontier Corps presence at multiple checkpoints along the approach roads. Reaching Landi Kotal requires passing through military-controlled corridors that funnel all traffic through identifiable chokepoints.

Abu Qasim, the alleged mastermind of the Dhangri terror attack, was shot inside a mosque in Rawalakot, Pakistan-occupied Kashmir. Rawalakot presents unique challenges for any external operation. The PoK administrative capital is separated from Indian-controlled territory by the Line of Control, one of the most heavily militarized borders on earth, and from the Pakistani interior by mountainous terrain with limited road access. The operation in Rawalakot demonstrated reach into a geography that most analysts would have considered impenetrable for external assets.

Each of these geographic expansions forced an upward revision of the assessed capability behind the campaign. An operation limited to Karachi could plausibly be conducted by a single cell with local knowledge. Operations spanning Karachi, Sialkot, Lahore, Nawabshah, Rawalpindi, Landi Kotal, and Rawalakot require either a single network with nationwide reach or multiple independent cells coordinated by a central command. Both possibilities point toward state-level resources.

Cross-Organizational Targeting: Not Random, Not Factional

The organizational distribution of targets provides a critical analytical dimension that individual case studies cannot capture. The campaign has struck across organizational boundaries with a consistency that eliminates factional rivalry as an explanatory model. Lashkar-e-Taiba has suffered the largest number of attributed losses, consistent with its status as the most expansive India-focused terror group operating from Pakistani soil. LeT operatives from Karachi, Lahore, Jhelum, Rawalakot, and Khyber Pakhtunkhwa have all been hit, spanning the organization’s entire geographic footprint within Pakistan. The targeting has climbed LeT’s hierarchy from local facilitators to district commanders to direct aides to Hafiz Saeed himself, with the attack on Amir Hamza in Lahore representing a strike on the co-founder level.

Jaish-e-Mohammed has sustained losses across its command structure as well, most notably Shahid Latif in Sialkot and Zahoor Mistry in Karachi. The JeM targeting pattern reveals an additional dimension: the campaign does not restrict itself to active combatants. Mistry had been living under a false identity for years, his operational role largely historical. His elimination served a symbolic function, closing the book on the IC-814 hijacking saga, that complemented the campaign’s operational objectives. The message to JeM was not merely that its current fighters are vulnerable but that its entire history of anti-India violence is subject to accountability.

Hizbul Mujahideen figures have been targeted in operations that demonstrate knowledge of the organization’s Pakistan-based command structure, a structure that operates with ISI oversight from bases in Pakistan-occupied Kashmir and Punjab. The Khalistan-linked killings in Canada, while geographically distinct, share the same analytical signature: precision targeting of designated individuals by operatives who demonstrated prior surveillance and close-range engagement. The cross-organizational and cross-geographic spread collectively argues against any single-faction explanation: no Pakistani militant group has both the motive and the capability to strike across LeT, JeM, Hizbul Mujahideen, and Khalistan networks simultaneously.

The target seniority ladder visible across organizations follows a consistent logic. In each organization, lower-tier operatives were targeted first, followed by mid-tier commanders, followed by senior leadership. This parallel progression across multiple organizations suggests a centralized targeting authority that applies the same escalation doctrine regardless of which group the target belongs to. A fragmented campaign conducted by multiple independent actors would not produce parallel seniority ladders across different organizations; it would produce random targeting distributions reflecting each actor’s specific grudges or opportunities.

Modus Operandi Analysis

The operational signature breaks into seven discrete elements, each of which demands specific capabilities and infrastructure. Examining these elements individually, and then as an integrated system, reveals the architecture behind the campaign.

The first element is target identification. Every documented target has links to India’s most-wanted designations. Zahoor Mistry was a convicted IC-814 hijacker. Shahid Latif masterminded the Pathankot attack. Abu Qasim allegedly organized the Dhangri massacre. Amir Hamza co-founded Lashkar-e-Taiba. Ziaur Rahman was an identified LeT operative. The target selection shows no deviation toward criminal or personal vendettas and no inclusion of individuals who lack documented terror connections. This precision in target selection requires access to curated intelligence files, not general knowledge gleaned from media reporting.

The second element is schedule surveillance. Every killing occurs at a predictable location during a predictable activity: a daily walk, a prayer session, a visit to a market or shop. This predictability does not happen by accident. It requires sustained observation of the target’s daily routine, typically over a period of at least two weeks, to identify the window where presence, approach route, and escape route all align favorably. Ronen Bergman’s account of Mossad’s operational methodology in “Rise and Kill First” describes a minimum two-week surveillance period for most targeted operations, with some requiring months of observation. The shadow war’s operational tempo, with some targets killed within weeks of being identified, suggests that surveillance and intelligence-gathering phases may overlap, with local assets providing continuous reporting on potential targets before a specific operation is authorized.

The third element is the vehicle. The motorcycle is the campaign’s most visible signature, and its selection solves five tactical problems simultaneously. A detailed analysis of the motorcycle choice reveals that two-wheelers provide approach speed through congested traffic that four-wheeled vehicles cannot navigate, anonymity among the millions of motorcycles in Pakistani cities, a dual-rider configuration allowing separation of driving and shooting functions, instant escape into traffic corridors that police cars and larger vehicles cannot pursue through, and disposability after the operation since motorcycles can be abandoned and replaced cheaply. The Honda 125cc and Honda 70cc, Pakistan’s most common motorcycle models, appear in witness descriptions across multiple incidents. Using the most ubiquitous vehicle available guarantees that CCTV footage, where it exists, captures only one of thousands of identical motorcycles.

The fourth element is the weapon. Witness accounts and police FIR descriptions consistently reference handguns, typically semi-automatic pistols, fired at ranges of one to three meters. Close-range fire eliminates the marksmanship variable. A trained shooter at two meters cannot miss a stationary target. The choice of handgun over a rifle or submachine gun reflects the operational priority of concealment during approach and extraction. A handgun fits under a jacket or in a waistband. It does not protrude visibly during the motorcycle approach. The caliber, where reported, tends to be 9mm or .30 bore (7.65mm), both widely available on Pakistan’s black market through the Darra Adam Khel weapons bazaar and other informal channels.

The weapon choice also reveals what the campaign is not. It is not a bombing campaign, which would require explosive materials that are more difficult to procure discreetly and that produce collateral casualties alerting security services. It is not a sniper campaign, which would require specialized rifles, elevated firing positions, and longer engagement windows that increase exposure. It is not a poisoning campaign, which would require access to the target’s food or personal items and specialized toxicological knowledge. Each alternative method carries operational disadvantages that the handgun-at-close-range approach avoids. The consistency of weapon selection is itself evidence of doctrinal thinking: someone assessed the full spectrum of available methods and concluded that the handgun provides the optimal balance of lethality, concealment, availability, and deniability for this specific operational context. This kind of systematic methodology analysis is characteristic of intelligence organizations, not criminal enterprises, which typically use whatever weapon is most readily available regardless of operational optimization.

The question of suppressed versus unsuppressed weapons adds a further analytical layer. Witness accounts in several cases describe the gunshots as audible from surrounding streets, suggesting unsuppressed firearms. Commercially available suppressors reduce report volume significantly but do not eliminate it entirely, and they add barrel length that complicates concealment on a motorcycle. The apparent decision to forego suppressors reflects a trade-off calculation: in Pakistani urban environments, where firecrackers, engine backfires, and construction noise are constant, unsuppressed handgun shots attract less immediate attention than they would in a quiet European street. The operational environment itself provides acoustic camouflage that makes suppressors unnecessary.

The fifth element is the attack team composition. Witness descriptions consistently report two individuals: one riding the motorcycle and one shooting. The division of labor is optimal for the motorcycle platform. The rider focuses exclusively on navigation, approach speed, and the escape route. The shooter focuses exclusively on target identification and engagement. This dual-operator configuration is standard in close-quarters motorcycle operations globally. Iranian Revolutionary Guard Corps assassination teams operating against dissidents in the 1980s and 1990s used the same two-person motorcycle configuration. Colombian cartel sicarios (hitmen) adopted motorcycle pairs for urban assassinations in Medellin and Cali during the same era. The convergence of method across unrelated programs reflects the motorcycle platform’s inherent tactical logic rather than any organizational connection between them.

The two-person team raises a question about support personnel. Do only two individuals participate in each operation, or are additional operatives involved in roles invisible to witnesses? The operational requirements suggest that at minimum one additional person, a spotter, must be present at or near the target location to confirm the target’s presence and signal the approach team. In several cases where the target was inside a mosque or shop when the attackers arrived, the precise timing of the attack, occurring within minutes of the target’s arrival, implies real-time surveillance by someone positioned to observe the target’s entry. A spotter would remain at the scene after the shooting, blending into the crowd of panicked witnesses, and departing separately without any connection to the motorcycle team. This three-person minimum, rider, shooter, and spotter, represents the operational floor. Larger operations involving additional security for the escape route, counter-surveillance to detect police presence, and logistical support for vehicle staging could involve five to seven individuals for a single operation. Witness testimony, by its nature, captures only the most visible participants and likely undercounts the total team size involved in each strike.

The anonymity of the team members deserves emphasis. Witness descriptions across multiple cases converge on the same generic profile: males aged approximately twenty-five to thirty-five, wearing shalwar kameez or casual clothing, faces partially concealed by motorcycle helmets or cloth face coverings. This description matches the demographic majority of motorcycle riders in any Pakistani city. The attackers do not dress distinctively, do not display unusual physical characteristics, and do not behave in ways that would distinguish them from millions of other motorcycle pairs navigating Pakistani streets. This deliberate ordinariness is itself an operational choice, trained into the teams through clothing guidelines and behavioral protocols that ensure they dissolve into the urban background before and after the operation.

The sixth element is timing. Operations occur overwhelmingly during daylight hours or early evening, typically between late afternoon and dusk. This window coincides with peak traffic density in Pakistani cities, which maximizes the motorcycle’s escape advantage. It also coincides with daily prayer times, which is why mosques and prayer schedules have become the campaign’s most reliable targeting window. Prayer times provide the one routine that religious obligation makes socially undisruptable. A target who varies their commute route, changes their sleeping location, and randomizes their market visits will still attend the same mosque for the same prayer at approximately the same time. The attackers exploit this predictability with surgical precision.

The timing analysis reveals an additional layer of operational sophistication when examined across the full campaign. Killings do not cluster on specific days of the week, which would suggest a pattern driven by the attackers’ own schedules (such as operatives who have day jobs and can only conduct operations on specific days). Instead, the days of the week are distributed relatively evenly across documented cases, suggesting that the operational teams have the flexibility to operate on any day, timing their strikes based on the target’s routine rather than their own constraints. This scheduling flexibility is consistent with full-time operational assets rather than part-time operatives who must work around civilian employment.

The seasonal distribution of killings also carries analytical weight. The campaign does not cease during Ramadan or other major Islamic observances, nor does it concentrate during specific political seasons or diplomatic cycles. This temporal independence from external calendars suggests that operations are authorized based on operational readiness and target availability rather than strategic-messaging considerations. A politically motivated campaign might time strikes to coincide with diplomatic negotiations or international summits to maximize embarrassment; the shadow war’s apparent indifference to the diplomatic calendar reinforces the assessment that operational efficiency, not political signaling, drives the timing of individual operations. The exception to this pattern, if one exists, may be the acceleration in killings following major terror attacks against India, such as the Pahalgam massacre. Whether this acceleration reflects a direct retaliatory trigger or simply the authorization of operations that were already in the planning pipeline remains analytically ambiguous.

The seventh element is extraction. In every documented case, the attackers escape without pursuit. Witness accounts consistently describe the motorcycle accelerating away from the scene and disappearing into traffic within seconds. No documented case has resulted in a chase. No attacker has been apprehended at the scene or during withdrawal. This flawless extraction record across dozens of operations in multiple cities suggests pre-planned escape routes, pre-positioned secondary vehicles or safe locations, and intimate familiarity with local street layouts and traffic patterns. In several Karachi cases, witnesses reported the motorcycle turning into narrow side streets that would be unknown to anyone without extensive local knowledge.

The extraction phase deserves closer examination because it is the most exposure-intensive moment after the shooting itself. In the seconds immediately following the gunfire, the operational team is at maximum vulnerability: witnesses are alert, anyone with a phone can begin recording, and the gunfire may attract police attention if a patrol happens to be nearby. The consistent success of extraction under these conditions implies that escape routes are not merely planned but rehearsed. An operational team that has walked or ridden its escape route multiple times before the operation will navigate it under stress with the automaticity that comes from repetition. Teams that have merely studied a map will hesitate at intersections, miss turns, and lose the precious seconds that separate clean extraction from pursuit.

The absence of vehicular pursuit in any documented case raises a secondary analytical question: is the lack of pursuit a function of the escape route’s effectiveness, or does it reflect a broader Pakistani law enforcement posture that does not prioritize immediate pursuit of shooting suspects? In Karachi, where motorcycle-borne shootings occur with sufficient frequency that police have developed a degree of tactical fatigue, the answer is likely both. Police vehicles in Karachi are typically four-wheeled sedans or pickup trucks that cannot navigate the narrow lane networks that motorcycles access freely. Police motorcycle patrols exist but are thinly distributed across a city that spans over 3,700 square kilometers. Even a highly motivated police response would struggle to intercept a motorcycle team that disappears into a residential lane network within ten seconds of the shooting. The campaign’s operators have clearly mapped this policing reality and designed their extraction protocols to exploit it.

The integration of these seven elements into a single operational package is what transforms the MO from a tactical method into evidence of institutional capability. Consider the counterfactual: a criminal gang tasked with killing a specific individual in Karachi might manage elements three (vehicle), four (weapon), five (team composition), and six (execution). They could steal a motorcycle, buy a gun, recruit two shooters, and ambush a target. But they would lack element one (access to curated intelligence files identifying the target’s real identity and significance), element two (sustained surveillance requiring weeks of dedicated resources), and element seven (professional extraction protocols that leave zero forensic evidence). The complete operational package observed in the shadow war exceeds what any non-state actor could sustain across multiple operations.

The comparison with the CIA’s approach is also instructive. American counter-terrorism methodology in Pakistan relied on unmanned aerial vehicles, Predator and Reaper drones, armed with Hellfire missiles launched from altitudes of twenty thousand feet. The drone methodology eliminated the insertion risk entirely but created massive collateral-damage exposure, a political footprint that eventually turned Pakistani public opinion decisively against American operations, and an electronic signature that Pakistani radar systems could detect. India’s motorcycle methodology accepts the insertion risk but eliminates the electronic signature, avoids collateral damage almost entirely (documented bystander casualties from the campaign are near zero), and maintains the deniability that drone strikes cannot provide. The two approaches represent fundamentally different cost-benefit calculations applied to the same strategic problem: eliminating designated individuals on Pakistani territory.

A third comparative dimension involves Mossad’s kidon units and their evolution over decades. Early Mossad operations, during the Wrath of God campaign of the 1970s, relied heavily on European-passport-carrying Israeli operatives inserted into target countries for specific operations. The Lillehammer disaster in 1973, where a kidon team killed an innocent Moroccan waiter in Norway after misidentifying him as a Palestinian target, exposed the vulnerability of the insertion model. Subsequent Mossad operations increasingly relied on locally recruited assets and technical methods (remote-detonated explosives, poisoned door handles, modified equipment) that reduced the exposure of Israeli personnel. The shadow war appears to have learned from this evolution, bypassing the insertion-heavy model entirely and beginning with a locally networked approach that Mossad took decades to develop.

The Intelligence Architecture

Reconstructing the intelligence capabilities required for the campaign produces an operational capability requirement matrix that spans seven phases of activity. Each phase demands specific infrastructure, specific human assets, and specific institutional support that together reveal the architecture of the organization conducting the operations.

Phase one is target identification and prioritization. Selecting targets exclusively from India’s designated lists requires access to NIA charge sheets, UNSC sanctions documentation, and classified intelligence files that identify specific individuals by name, organizational role, and current location. A freelance contractor does not maintain a curated target database that precisely mirrors a foreign government’s most-wanted list. This phase requires either direct institutional access to the designating government’s intelligence files or a systematic process for translating public designations into actionable targeting packages. The sophistication of target selection, moving from lower-tier operatives in 2021-2022 to senior commanders and co-founders by 2023-2024, suggests a deliberate escalation strategy that a centralized command structure is directing.

Phase two is location intelligence. Knowing that Zahoor Mistry lives in Karachi is general knowledge available from news reports. Knowing that he lives as “Zahid Akhund” in a specific neighborhood, walks to a specific market at a specific time, and can be approached from a specific direction on a specific street requires penetration of his local environment. This penetration can occur through recruited agents within the target’s social circle (neighbors, shopkeepers, mosque acquaintances), through technical surveillance (phone interception, location tracking), or through physical surveillance by assets who blend into the neighborhood. The fact that this location intelligence has been developed for targets across multiple cities, from Karachi to Landi Kotal, suggests a distributed network of human assets rather than a single technical capability.

Phase three is location reconnaissance. Once a target’s routine is mapped, the specific kill site must be scouted. What are the approach vectors? Where does the target stand or sit? What is the foot traffic density at the selected time? Where do potential witnesses congregate? What are the escape routes? How quickly can a motorcycle reach the nearest arterial road after the shooting? These questions require physical presence at the location, ideally over multiple days, to confirm that the intelligence picture matches ground reality. In Avery Plaw’s analysis of global targeted-killing methodologies in “Targeting Terrorists,” he notes that the reconnaissance phase is typically the most exposure-intensive period for an operational team, because personnel must be physically present in the target area without attracting attention. The shadow war’s zero-arrest record suggests that reconnaissance is conducted by local assets who have legitimate reasons to be present, not by foreign operatives whose appearance or behavior might trigger suspicion.

Phase four is weapon procurement. Semi-automatic handguns in 9mm or .30 bore are readily available on Pakistan’s informal weapons market. Darra Adam Khel, the tribal-area weapons bazaar located in Khyber Pakhtunkhwa approximately 40 kilometers south of Peshawar, produces unlicensed copies of virtually every handgun model in global circulation, from Beretta 92 replicas to Glock imitations. Buyers pay cash, receive no documentation, and leave no traceable transaction record. Procuring clean weapons, firearms without a traceable history, is straightforward for anyone with local contacts and modest funds. Prices for functional replica handguns at Darra range from the equivalent of fifty to two hundred US dollars, placing weapon procurement well within the budget of any organized group. This phase is the least capability-intensive element of the operational chain, which may partly explain why the campaign uses handguns rather than more exotic weapons. The weapons are locally sourced and locally disposable, adding no logistical tail that could be traced to an external sponsor. In comparative terms, Mossad’s kidon units historically preferred to procure weapons locally in the operational theater rather than smuggling Israeli-sourced firearms across borders, for precisely the same reason: local procurement eliminates the supply chain as an intelligence vulnerability.

Phase five is team insertion. Getting a two-person team to the target location on the day of the operation requires either local personnel who live in or near the target city, or an insertion capability that moves non-local operatives into the area without detection. The geographic diversity of the campaign, spanning Sindh, Punjab, KPK, and PoK, makes cross-border insertion for each operation logistically implausible. A team inserted from India would need to cross the international border covertly, travel hundreds of kilometers through Pakistani territory to reach a target city, execute the operation, and then reverse the journey. Doing this once is conceivable. Doing it dozens of times across multiple cities without a single interdiction strains credulity. The more parsimonious explanation is that the campaign relies on locally based assets in each city, individuals who hold Pakistani identity documents, speak local languages and dialects, and can move freely without attracting scrutiny. This is the most operationally significant finding: the campaign’s reach implies deep infiltration of Pakistani urban society by assets loyal to an external sponsor.

Phase six is execution. The shooting itself lasts between three and ten seconds in every documented case. The pillion rider fires two to four rounds at close range, the motorcycle accelerates, and the team withdraws. The brevity of the engagement is deliberate and trained. Longer engagements increase exposure to witnesses, potential resistance, and the possibility of pursuit. The close-range firing eliminates the need for precision marksmanship, a critical design feature because it allows the campaign to use operatives whose primary qualification is reliability and local integration rather than elite military training. A trained shooter at two meters cannot miss a stationary target. The entire execution phase is optimized for speed, not spectacle. There is no signature action, no calling card, no message left at the scene. The absence of any theatrical element distinguishes the campaign from terrorist violence, which typically seeks maximum visual impact, and aligns it with professional intelligence operations, which seek minimum operational exposure.

Phase seven is extraction and post-operation protocol. After the shooting, the motorcycle disappears into traffic. In several documented cases, the motorcycle was later found abandoned in a different neighborhood, typically one to three kilometers from the attack site, suggesting that the team switched to a secondary vehicle or dispersed on foot into crowded commercial areas. The transfer from motorcycle to secondary transport represents an additional layer of extraction planning that further complicates any pursuit or post-incident investigation. No operational debris, spent casings in most cases, no dropped identification, no recoverable forensic evidence, has been reported at any attack site. This clean extraction is consistent with professional training in evidence elimination and counter-forensic protocols. The post-operation phase likely includes communications security measures, with operational phones destroyed or discarded and the team going dark for a cooling-off period before resuming normal activities. This entire post-operation protocol mirrors standard intelligence tradecraft described in both Western and Israeli counter-intelligence literature.

The seven phases, taken together, constitute an operational architecture that Ronen Bergman would recognize from his documentation of Mossad’s kidon (bayonet) units. The Israeli precedent for close-range human assassination teams operating on foreign soil required exactly these capabilities: curated target intelligence, local surveillance, site reconnaissance, local weapon procurement, locally integrated operatives, brief execution, and clean extraction. The shadow war’s method is not identical to Mossad’s, which historically preferred varied methods, including car bombs, poisoning, and booby-trapped phones, to avoid creating a detectable signature. The Indian campaign’s commitment to a single, repeated method suggests either a different operational philosophy or a calculation that the motorcycle signature’s visibility serves a deterrent function alongside its tactical utility.

Beyond the seven operational phases, the campaign’s architecture implies three additional infrastructure capabilities that operate at a level above individual operations.

The first is secure communications. Coordinating operations across multiple cities requires a communications architecture that allows the central command to authorize specific operations, transmit target intelligence to field teams, receive operational updates, and confirm completion, all without interception by Pakistani signals intelligence. Pakistan’s Inter-Services Intelligence operates an extensive signals-intelligence apparatus that monitors phone communications, internet traffic, and radio transmissions within Pakistani territory. The campaign’s zero-compromise record suggests either the use of encrypted commercial communications platforms that ISI cannot easily penetrate, or a communications discipline that avoids electronic channels entirely in favor of human courier networks. Either approach requires institutional training in communications security, a subject that intelligence agencies devote considerable resources to but that criminal organizations and militant groups typically neglect. The Mahmud al-Mabhouh operation in Dubai in 2010, where Mossad agents were identified through hotel CCTV and phone metadata despite meticulous operational planning, demonstrated that communications security is often the weakest link in even the most professionally executed operations. The shadow war’s operators appear to have internalized this lesson: the absence of intercepted communications suggests communications discipline that exceeds what most intelligence services achieve.

The second is asset management. A distributed network of locally embedded operatives requires a system for recruitment, vetting, training, compensation, and discipline that operates across geographic boundaries and organizational compartments. Asset management in denied territory, where the managing intelligence service has no official presence, is among the most demanding functions in the intelligence profession. Each asset must be identified as a potential recruit, assessed for reliability and discretion, approached without alerting Pakistani counter-intelligence, trained in operational skills and security protocols, compensated through untraceable channels, and managed through a handler relationship that maintains loyalty without creating dependency. The campaign’s geographic scope implies that asset-management capabilities exist in multiple Pakistani cities simultaneously, which in turn implies either a small number of highly mobile handlers or a larger number of locally positioned handlers, each managing a cell-sized team in their assigned city.

The third is institutional memory. A campaign that has been running for several years accumulates operational knowledge: which methods work in which cities, which escape routes are compromised, which targets have changed their routines, which local police units are more or less competent, which neighborhoods have CCTV coverage that must be avoided. This institutional memory must be stored, updated, and transmitted to operational teams in a form that improves each successive operation’s probability of success. The campaign’s zero-failure rate over time, combined with its accelerating tempo, suggests that institutional memory is being effectively captured and deployed, a function that requires organizational infrastructure beyond what any ad hoc group could sustain.

What separates this assessment from speculation is the cumulative weight of evidence. A single killing with these characteristics could be random. Five killings with identical characteristics across two cities suggest a pattern. Fifteen killings with identical characteristics across seven cities, targeting exclusively India-designated individuals, with zero operational failures, constitute evidence of institutional capability. The pattern decoded from these cases points toward a structured campaign, not a series of unrelated events.

Competing Theories

Four hypotheses have been advanced to explain the identity and sponsorship of the operational teams conducting these killings. Each hypothesis must be tested against the operational evidence, and several fail critical tests.

The first hypothesis, advanced by Pakistani officials and the ISI-linked security establishment, attributes the killings to India’s Research and Analysis Wing (RAW). Pakistani Interior Ministry statements have repeatedly described the killings as the work of Indian intelligence, claiming that RAW operates networks within Pakistani cities that conduct the assassinations. Al Jazeera’s April 2024 reporting quoted senior Pakistani security officials directly attributing eight specific killings to RAW. The Guardian’s April 2024 investigation, based on interviews with unnamed intelligence operatives, lent additional credibility to the India-attribution theory by reporting that individuals with knowledge of the operations confirmed Indian government involvement. India has formally denied any role in the killings. Indian officials have consistently declined to comment on specific cases and have characterized Pakistani allegations as attempts to deflect attention from Pakistan’s own failure to dismantle terrorist infrastructure on its soil. The India-attribution theory is the only one that accounts for all elements of the operational evidence: target selection, geographic scope, MO consistency, and zero-failure rate. Its primary weakness is the absence of a publicly arrested operative or intercepted communication that would provide direct evidence.

The second hypothesis suggests that the killings are the product of internal Pakistani rivalries, either within the military establishment, between intelligence factions, or among competing militant groups. Pakistan has a documented history of using targeted killings to eliminate assets who have become liabilities. ISI has historically disposed of militant figures who defy directives or threaten to expose state sponsorship of terrorism. Khalid Khwaja, a former ISI officer with extensive militant connections, was killed by the TTP-aligned Asian Tigers in 2010, possibly with ISI acquiescence. Under this theory, the “unknown gunmen” are Pakistani operatives cleaning house. The weakness of this hypothesis is target selection. Internal Pakistani cleanup operations would target individuals who threaten the Pakistani state or the military establishment’s control over militant groups. They would not exclusively target individuals who appear on India’s designated lists. Shahid Latif’s organizational role within JeM served Pakistani strategic interests in Kashmir. His elimination harmed Pakistan’s proxy-war capability. An ISI-directed cleanup would not remove its own functional assets. The internal-rivalry theory also cannot explain the geographic scope: ISI would not need motorcycle-borne hit teams to eliminate its own clients; it could simply withdraw protection and allow Pakistani law enforcement to make arrests.

The third hypothesis proposes that the Tehrik-i-Taliban Pakistan (TTP) or affiliated groups are responsible. TTP has conducted targeted killings of individuals associated with the Pakistan Army and rival militant factions. Some of the campaign’s geographic footprint, particularly in Khyber Pakhtunkhwa, overlaps with TTP’s operational territory. The weakness here is similar to the internal-rivalry hypothesis: TTP targets individuals who collaborate with the Pakistan military, not individuals designated by India for involvement in anti-India terrorism. LeT and TTP have historically maintained a non-aggression understanding, with both groups viewing the Pakistan Army as either an ally (LeT) or a primary enemy (TTP). TTP has no strategic reason to eliminate LeT commanders who pose no threat to TTP’s own operations. There is also no TTP claim of responsibility for any of the attributed killings, which would be unusual, since TTP typically publicizes its operations for propaganda value.

The fourth hypothesis, preferred by analysts who favor the state-capability assessment, argues that the killings are conducted by an organized state intelligence apparatus, most likely Indian, using locally recruited assets who have been identified, vetted, trained, and equipped by professional intelligence officers. This hypothesis best accounts for the target selection (exclusively India-designated individuals), the geographic scope (multiple cities across multiple provinces), the operational consistency (identical MO across cases), the zero-failure rate (no arrested operatives), and the deliberate escalation in target seniority over time. The comparison with remote methods such as drone strikes is instructive: India chose human teams over drones despite the higher risk to personnel, likely because drone operations over Pakistani territory would be detected by radar and would constitute an unambiguous act of war, while motorcycle-borne assassinations maintain plausible deniability.

A necessary complication must be acknowledged: without arrested operatives or official disclosure from any government, the operational details in this analysis are reconstructed entirely from open sources. Police FIR descriptions, witness accounts in Pakistani media, defense analysts’ assessments, and journalistic investigations all contribute to the composite picture, but each individual source carries limitations. Witness accounts are filtered through trauma and media framing. Police FIRs are often formulaic. Defense analysts may project capabilities based on historical precedent rather than direct evidence. The distinction between what is documented (specific details of specific killings) and what is inferred (surveillance durations, network structure, training protocols) should be maintained throughout. The confidence in the overall pattern rests on the convergence of multiple independent data points, not on any single piece of evidence.

The disagreement between local-asset networks and cross-border insertion teams deserves specific adjudication. If the campaign relied on teams inserted from India for each operation, the logistical footprint would be enormous: repeated border crossings, safe houses for transit, false documentation for travel through Pakistani interior, and exfiltration after each operation. The geographic diversity of targets, scattered across cities separated by hundreds of kilometers, makes the insertion model logistically unsustainable at the observed operational tempo. The local-asset model, in which recruited agents already resident in Pakistani cities conduct the operations under remote coordination, accounts for the same evidence with fewer logistical impossibilities. Karachi alone has received millions of internal migrants from every region of Pakistan and from Afghanistan, making it relatively straightforward to embed assets with manufactured identities. Similar conditions prevail in Lahore, Rawalpindi, and other campaign cities. The local-asset model also explains the zero-arrest record: locally embedded operatives do not need to cross checkpoints, do not carry foreign identification, and do not exhibit the behavioral anomalies that would alert Pakistani counter-intelligence.

The local-asset model, while analytically more parsimonious, raises its own set of demanding questions. How are local assets recruited in a country where anti-India sentiment runs deep and where ISI maintains an extensive informant network designed to detect precisely this kind of foreign infiltration? Three pathways are plausible. First, ethnic and sectarian minorities within Pakistan who harbor grievances against the state or against the Sunni militant groups that the state sponsors may be susceptible to recruitment. Karachi’s Muhajir, Baloch, and Shia populations have all suffered at the hands of organizations that the shadow war targets. Second, financially motivated assets, individuals who will conduct operations for payment without ideological alignment, exist in every society and can be recruited through intermediaries who conceal the ultimate sponsor’s identity. Third, agents of Pakistani origin who have been recruited, trained, and sent back to Pakistan through neighboring countries, particularly Afghanistan, the Gulf states, or via the extensive Pakistani diaspora, could provide a pipeline for operational talent. Each pathway has historical precedent in intelligence operations worldwide, and the campaign likely uses some combination of all three rather than relying on any single recruitment channel.

The financial dimension of asset management deserves separate consideration. Compensating a distributed network of assets across multiple Pakistani cities requires a financial infrastructure that avoids the banking system’s monitoring mechanisms. Hawala networks, the traditional South Asian informal value-transfer system, operate extensively across Pakistan and provide a proven mechanism for moving funds without formal banking records. Cash payments through intermediaries are another option. Cryptocurrency, while theoretically untraceable, requires technical sophistication and internet access that may limit its utility for local assets in smaller cities. Whatever financial mechanism the campaign employs, it must be robust enough to sustain ongoing payments, flexible enough to scale across multiple cities, and secure enough to avoid detection by Pakistan’s Financial Monitoring Unit or by ISI’s financial-surveillance operations. The campaign’s sustained multi-year operations suggest that the financial infrastructure is well-established and has not been compromised.

Strategic Implications

The modus operandi, considered as evidence of capability, produces four strategic conclusions that reshape the analytical landscape of the India-Pakistan confrontation.

First, the campaign’s operational architecture reveals a depth of intelligence penetration into Pakistani society that Pakistan’s security establishment has never publicly acknowledged. If the local-asset model is correct, then an external intelligence service has recruited, trained, and sustained networks of operatives in Pakistan’s largest cities for years without detection. The ISI has historically prided itself on its counter-intelligence capability, particularly within its domestic domain. The shadow war’s success implies either that ISI’s counter-intelligence has failed comprehensively, or that certain elements within Pakistan’s security establishment are tolerating or even facilitating the campaign for reasons that remain unclear. Both possibilities are deeply destabilizing for Pakistan’s internal security calculus. If ISI cannot protect its own assets within Pakistani cities, the foundational assumption of Pakistan’s proxy-war strategy, that the militants are sheltered and therefore expendable, collapses.

The penetration question also raises uncomfortable implications for Pakistan’s nuclear security establishment. If locally embedded foreign assets can identify, surveil, and eliminate specific individuals across Pakistani cities with no operational failures, the same capability could theoretically be directed at other categories of targets. Pakistan’s nuclear weapons and delivery systems are protected by elaborate security protocols managed by the Strategic Plans Division. The shadow war does not threaten nuclear security directly, but it demonstrates a capability envelope that Pakistan’s strategic planners must account for in their threat assessments. The psychological impact of this demonstrated penetration may exceed the campaign’s direct operational results.

Second, the MO’s deliberate consistency serves a strategic purpose beyond tactical efficiency. A campaign that varied its methods, using car bombs in one city, poison in another, and snipers in a third, would be harder for the target population to associate with a single actor. The motorcycle-handgun signature’s repetition ensures that every new killing is immediately associated with the same campaign. Karachi, where the majority of attributed killings have occurred, has become a city where designated individuals know exactly what the threat looks like: two men on a motorcycle, approaching from behind, during a routine activity. This predictability is itself a weapon. It forces behavioral changes in the target population. Senior LeT and JeM figures have reportedly increased personal security, changed residences, reduced public appearances, and curtailed routine activities. These behavioral changes degrade organizational effectiveness even before a specific individual is killed, because leaders who are hiding cannot lead, recruiters who fear exposure cannot recruit, and facilitators who restrict their movement cannot facilitate.

The behavioral-change effect extends beyond the primary targets to the organizations’ support infrastructure. Madrassa administrators, financial facilitators, logistical coordinators, and media operatives within LeT and JeM’s structures have reportedly taken precautionary measures that disrupt normal organizational functions. Avery Plaw, in his analysis of how targeted-killing campaigns produce organizational degradation, argues that the indirect effects of forcing behavioral adaptation often exceed the direct effects of removing specific individuals. The shadow war appears to be generating precisely this dynamic: the fear of being next degrades organizational capacity more broadly than any single killing achieves individually.

Third, the campaign’s MO reveals a strategic philosophy that prioritizes sustained pressure over decisive strikes. A conventional military operation would attempt to eliminate the highest-value targets as quickly as possible. The shadow war’s escalation from low-level operatives to mid-tier commanders to senior leaders and co-founders follows a bottom-up approach that suggests patient strategic planning. By beginning with lower-profile targets, the campaign developed its operational infrastructure, tested its methods, and accumulated intelligence from each operation before moving to higher-value, better-protected individuals. Each successful operation generated actionable intelligence for subsequent operations: funerals revealed associates, network communications activated in the aftermath of a killing could be intercepted, and security protocols adopted by surviving members revealed the organizational structure’s response pathways. This patient escalation mirrors the methodology Ronen Bergman attributes to Mossad’s most successful campaigns: begin with soft targets to build operational confidence and intelligence, then progressively climb the organizational hierarchy. India’s shadow war and the Israeli model converge on this principle of graduated escalation.

Fourth, the MO carries a message directed at the Pakistani state itself, beyond the immediate target community. Every successful operation in a Pakistani city, particularly in Punjab and PoK, demonstrates that Pakistan’s security guarantee to its militant clients has been compromised. The safe-haven network that sheltered India’s most-wanted for decades relied on an implicit contract: Pakistan provided sanctuary, and in return, the militants served Pakistani strategic interests in Kashmir and beyond. The shadow war has broken one side of that contract. Sanctuary no longer guarantees safety. The implications ripple through Pakistan’s entire proxy-war architecture, because every militant group must now calculate whether the protection Pakistan offers is worth the risk of appearing on someone’s list. Recruitment becomes harder when prospective fighters see that their predecessors are being systematically hunted. Fundraising becomes harder when donors observe that their investments in jihadi infrastructure are being physically dismantled one operative at a time.

The campaign’s operational tempo, accelerating from single digits annually to over thirty attributed killings in 2026 alone, suggests that the infrastructure supporting the operations is maturing rather than degrading. Whatever networks conduct these killings, they are growing more capable with each completed operation. The MO may evolve as counter-measures develop, but the underlying capability, the ability to locate, surveil, and strike designated individuals in Pakistani cities, has been demonstrated beyond reasonable dispute. The complete timeline of attributed killings shows an upward curve that no counter-measure has yet bent downward.

The acceleration itself carries doctrinal implications. A campaign that kills three targets in its first year and thirty in its fifth year has not merely expanded its operations; it has transformed its organizational character. The early-phase campaign was likely constrained by the need to build networks, test methods, and validate intelligence in each new city. As these one-time investments matured into persistent infrastructure, the constraint shifted from capability (can we operate in this city?) to targeting (which targets in this city are ready?). The transition from capability-constrained to target-constrained operations is a hallmark of institutionalized intelligence programs, and it suggests that the campaign’s infrastructure could sustain an even higher operational tempo if the targeting authority chose to authorize it.

The doctrinal evolution visible in the MO also carries implications for the relationship between India’s covert campaign and its conventional military posture. Operation Sindoor, the missile strikes on terrorist infrastructure in Pakistan in May 2025, demonstrated India’s willingness to use overt military force alongside covert capabilities. The shadow war and the open war are not competing strategies but complementary instruments of a unified counter-terrorism doctrine. The motorcycle-borne campaign degrades terrorist organizations from within by eliminating individual operatives. Operation Sindoor degraded terrorist organizations from above by destroying physical infrastructure. Together, they create a compression effect: targets who flee to avoid the motorcycle teams concentrate in facilities that become targets for missile strikes; targets who disperse from destroyed facilities to avoid air strikes become isolated individuals vulnerable to the motorcycle teams. This complementary dynamic, if it is indeed coordinated rather than coincidental, represents a counter-terrorism doctrine more integrated than anything previously documented in the India-Pakistan theater.

The final strategic implication is temporal. The campaign shows no signs of concluding. Its operational tempo is accelerating, its geographic scope is expanding, and its target seniority is escalating. Absent a comprehensive peace settlement that addresses India’s core grievances regarding cross-border terrorism, or a Pakistani decision to genuinely dismantle its militant infrastructure (neither of which appears imminent), the campaign’s sponsors have no incentive to stop. The MO that this article has reconstructed is not a historical artifact to be studied in the past tense. It is an active, evolving operational doctrine that will continue to produce data points for analysis, and casualties for Pakistan’s militant organizations, for the foreseeable future.

Frequently Asked Questions

Q: How are the targeted killings carried out in Pakistan?

The documented method follows a consistent pattern across cases. Two individuals on a motorcycle approach the target at a location the target visits routinely, such as a mosque, market, or neighborhood street. The pillion rider fires a handgun at close range, typically two to four rounds from a distance of one to three meters. The motorcycle then accelerates away from the scene into urban traffic. The entire engagement lasts between three and ten seconds. No group claims responsibility, and Pakistani police register the cases as attacks by “unknown gunmen.” The method exploits the motorcycle’s tactical advantages in Pakistani urban environments: speed through congested traffic, anonymity among millions of identical two-wheelers, and the impossibility of vehicular pursuit through narrow side streets. The consistency of this method across different cities, different targets, and different years indicates standardized operational protocols rather than improvised violence.

Q: Why do the attackers use motorcycles for targeted killings?

Motorcycles solve five tactical problems simultaneously. They provide approach speed through Pakistani urban traffic that cars cannot navigate, making interception during approach virtually impossible. They offer anonymity because Honda 125cc and Honda 70cc motorcycles are the most common vehicles in Pakistan, with millions registered across the country. The dual-rider configuration allows division of labor between a driver focused on navigation and a shooter focused on the target. Escape into traffic is immediate because motorcycles can use lanes, sidewalks, and narrow alleys that police vehicles cannot follow through. Disposability is high because the motorcycles can be abandoned after the operation and replaced cheaply, leaving no forensic trail back to the team. These five advantages combined make the motorcycle the optimal platform for close-range urban assassination, which explains why Iranian, Colombian, and Filipino assassination teams independently converged on the same vehicle choice in unrelated campaigns.

Q: How do the attackers know where the targets live and what their daily routines are?

The intelligence preparation for each operation requires penetration of the target’s local environment. This can occur through recruited informants within the target’s social or professional circle, such as neighbors, shopkeepers, or mosque acquaintances who provide schedule information. Physical surveillance by locally embedded assets who can observe the target’s movements over a period of days or weeks without attracting attention is another likely method. Technical surveillance through phone interception or location-tracking technology may supplement human sources. The fact that this intelligence has been developed for targets in cities as far apart as Karachi and Landi Kotal, separated by over a thousand kilometers, suggests a distributed network of human assets rather than a single centralized surveillance capability.

Q: Do the killers use the same weapons every time?

Witness accounts and police reports consistently describe handguns, typically semi-automatic pistols in 9mm or .30 bore (7.65mm) caliber. Close-range engagement eliminates the need for precision rifles. Handguns are concealable during the motorcycle approach, compact enough to be drawn and fired from a pillion position, and widely available on Pakistan’s informal weapons market. The Darra Adam Khel bazaar in the tribal areas produces unlicensed copies of nearly every handgun model in global circulation, making procurement of untraceable weapons straightforward. In several cases, the absence of recovered shell casings suggests the use of revolvers, which retain spent casings internally, or trained evidence-collection protocols where the shooter retrieves casings before withdrawal.

Q: How do the attackers escape after the killing?

Extraction follows a consistent pattern: immediate acceleration away from the scene into the nearest traffic flow, a turn into side streets or narrow lanes within the first thirty seconds, and disappearance into the urban environment. In several Karachi cases, the motorcycle was later found abandoned in a different neighborhood, indicating a switch to a secondary vehicle or dispersal on foot. No pursuit has been documented in any case. The escape is facilitated by pre-planned routes that exploit local knowledge of street layouts, one-way patterns, and traffic density at the selected time of day. The fact that no attacker has been apprehended during extraction across dozens of operations indicates either exceptional planning or assistance from individuals who ensure that pursuit is not attempted.

Q: Has any attacker ever been caught or identified?

No attacker has been publicly identified, arrested, or prosecuted in connection with any of the attributed killings. Pakistani police register each case as an “unknown gunmen” incident and investigations consistently go cold. No CCTV footage has led to an identification. No witness has provided a description detailed enough for a successful sketch or recognition. No forensic evidence recovered from any scene has produced an actionable lead. This zero-identification record across multiple years and multiple cities is itself evidence of professional counter-forensic protocols and locally integrated operatives who do not stand out from the surrounding population.

Q: How long does surveillance take before a targeted killing is executed?

Based on the operational requirements for target-routine mapping, site reconnaissance, and approach-route planning, a minimum surveillance period of approximately two weeks is estimated for each operation. Some operations likely require longer preparation, particularly for targets in unfamiliar cities or with irregular schedules. Mossad’s documented methodology for similar operations typically involves two to four weeks of dedicated surveillance, with some high-value targets monitored for months before a decision to strike. The shadow war’s accelerating operational tempo in 2025 and 2026 suggests that surveillance periods may be compressed as the network’s local knowledge base matures and pre-existing intelligence on potential targets accumulates.

Q: What intelligence capabilities are needed for a targeted killing?

A complete operational cycle requires seven distinct capabilities: target identification from curated intelligence files, schedule surveillance through human or technical sources, physical reconnaissance of the chosen attack site, local weapon procurement, team insertion or activation of pre-positioned local assets, execution with trained close-quarters shooting, and extraction through pre-planned routes with counter-forensic protocols. Sustaining these capabilities across multiple cities simultaneously requires institutional resources, specifically a coordinating intelligence organization, a secure communications architecture, a recruitment and vetting pipeline for local assets, a training program for operational skills, and a financial support system that does not leave traceable transactions.

Q: Why do the targeted killings often happen near mosques or during prayer times?

Prayer times provide the most reliable targeting window because they solve the hardest problem in assassination: predictable presence at a known location. A target who varies their commute, sleeps in different locations, and randomizes their shopping can still be found at the same mosque for the same prayer at approximately the same time. Religious obligation makes this routine socially undisruptable. The attackers exploit this predictability to guarantee that the target will be present at a specific location during a narrow time window, which allows precise coordination of the approach, execution, and extraction phases. Several documented killings, including those of Shahid Latif in Sialkot and Abu Qasim in Rawalakot, occurred immediately outside or inside mosques during or after prayer sessions.

Q: Is the consistent modus operandi evidence that a single organization is responsible?

The consistency of method across cases is one of the strongest pieces of evidence for a single coordinating organization. Random criminal violence produces varied methods. Rival militant factions use different weapons and approaches depending on the specific faction. The motorcycle-handgun-close-range method’s repetition across different cities, targeting exclusively India-designated individuals, with no claimed responsibility in any case, points toward a unified doctrine applied by trained teams operating under central coordination. The alternative explanation, that multiple independent actors independently adopted identical methods and independently selected only India-wanted targets, requires a series of coincidences that becomes statistically implausible as the number of cases grows.

Q: How does this modus operandi compare to Mossad’s assassination methods?

Mossad historically employs a wider variety of methods than the shadow war’s motorcycle-centric approach. Israeli operations have used car bombs (Beirut 1979), poisoned toothpaste (Fathi Shqaqi, Malta 1995), booby-trapped phones (Yahya Ayyash, 1996), and close-range shooting (multiple Wrath of God operations across Europe). Mossad deliberately varies its methods to prevent adversaries from developing effective countermeasures. The shadow war’s commitment to a single, repeated method represents a different operational philosophy, either reflecting confidence that Pakistani counter-measures cannot adapt to even a known method, or serving a deterrent function by making the threat recognizable and therefore psychologically potent. Both programs share the core capability requirements: intelligence penetration, local surveillance, pre-positioned assets, and clean extraction.

Q: Could the Pakistani military or ISI be secretly behind the killings?

This theory proposes that Pakistan’s own intelligence apparatus is conducting the killings, either to dispose of assets who have become liabilities or under covert agreement with India. Two pieces of evidence weigh against it. First, target selection consistently removes individuals who serve Pakistani strategic interests. Shahid Latif was an active JeM commander useful to Pakistan’s Kashmir proxy war. Amir Hamza co-founded LeT, Pakistan’s most valuable militant asset. ISI would not systematically dismantle its own proxy-war infrastructure. Second, Pakistani officials have publicly attributed the killings to RAW and demanded international action against India, behavior inconsistent with a secret self-inflicted campaign. The ISI-involvement theory fails the target-selection test.

Q: What role does Karachi play in the targeted killing campaign?

Karachi serves as the campaign’s primary operational theater, hosting more attributed killings than any other Pakistani city. The city’s characteristics make it ideal for covert operations: a population exceeding fifteen million that renders individual surveillance difficult, extreme traffic congestion that makes vehicular pursuit nearly impossible, over two million registered motorcycles providing anonymity in numbers, a high base rate of street violence that makes additional shootings statistically unremarkable, and diverse migrant populations from every region of Pakistan and Afghanistan that allow operatives with any ethnic background to blend in without suspicion. Karachi is also the city where LeT maintains significant operational infrastructure, meaning that targets are present in numbers sufficient to sustain a campaign.

Q: Are the motorcycles used in the killings ever traced or recovered?

In several documented cases, motorcycles have been recovered after the operation, typically abandoned in a different neighborhood from the attack site. Pakistani police have reported recovering motorcycles with filed-off engine numbers and chassis numbers, indicating deliberate efforts to prevent tracing. In other cases, no motorcycle has been recovered. The motorcycles used are invariably common models, Honda 125cc or Honda 70cc, available from thousands of dealers and secondhand markets across Pakistan. Even when recovered, the motorcycles provide no actionable intelligence because they lack traceable registration histories and carry no forensic evidence linking them to specific individuals.

Q: Could the TTP or other militant factions be responsible for the killings?

Tehrik-i-Taliban Pakistan conducts targeted killings in Pakistan, particularly against military personnel, police, and individuals who collaborate with the Pakistan Army. Some geographic overlap exists between TTP’s operational territory and the campaign’s footprint in Khyber Pakhtunkhwa. However, TTP’s target selection focuses on state collaborators, not India-designated militants. TTP also typically claims responsibility for its operations to maximize propaganda value, whereas the shadow war’s operations are unclaimed. The systematic targeting of only India-wanted individuals eliminates TTP as a plausible primary actor, though some analysts have speculated that TTP elements might provide logistical support or intelligence to the campaign in exchange for undermining their own rivals within the Pakistani militant ecosystem.

Q: What does the escalation in target seniority reveal about the campaign?

The campaign’s progression from lower-tier operatives to mid-level commanders to senior leadership and organizational co-founders follows a pattern of graduated escalation. In the early phases (2021-2022), targets were primarily foot-level operatives and local facilitators. By 2023, targets included district-level commanders and attack planners. By 2024-2025, the campaign reached organizational co-founders, direct aides to supreme commanders, and figures with direct connections to marquee terror attacks. This bottom-up escalation reveals a strategic patience that is inconsistent with reactive, opportunistic violence and consistent with a deliberate campaign designed to build intelligence and operational confidence through successive operations.

Q: How does the weapon choice compare to other global assassination campaigns?

Handguns at close range represent the most common weapon choice in state-sponsored targeted killings globally. Mossad’s Wrath of God operations frequently used suppressed Beretta .22LR pistols for close-range engagements in European cities. Iranian MOIS assassination teams operating against Kurdish and monarchist dissidents in Europe during the 1980s and 1990s favored close-range handgun fire. The CIA’s Phoenix Program in Vietnam used handguns for individual-targeted operations. The shadow war’s weapon choice aligns with global best practice for close-quarters assassination: handguns are concealable, reliable at close range, and available locally, eliminating the logistical exposure of importing specialized weapons across international borders.

Q: Does the consistent MO suggest that the attackers follow a formal training manual?

The operational consistency across cases, including vehicle choice, team composition, engagement range, timing parameters, and extraction protocols, is consistent with standardized training. Whether this training occurs through a formal manual or through institutional knowledge transferred during operational preparation is unknowable from open-source evidence. The distinction matters less than the implication: the teams receive systematic instruction in a method that has been tested and refined over multiple operations. The zero-failure rate suggests that training includes contingency protocols for scenarios that have never publicly materialized, such as target resistance, witness intervention, or police proximity.

Q: What prevents Pakistani police from investigating these killings effectively?

Multiple factors impede investigation. The operational tempo of the attacks leaves minimal forensic evidence: no shell casings in many cases, no DNA, no fingerprints, no recoverable digital evidence. The motorcycle’s anonymity in Pakistani cities means that eyewitness descriptions of the vehicle match thousands of identical motorcycles. The attackers’ helmet usage, reported in several cases, prevents facial identification. Pakistani police departments are chronically underfunded and understaffed, with forensic capabilities that fall well below international standards. Security analysts have also speculated that certain elements within Pakistan’s security establishment may have reasons to avoid solving these cases, whether because they tacitly support the campaign’s objectives or because a successful investigation would expose embarrassing intelligence failures.

Q: Will the modus operandi change as Pakistani counter-measures adapt?

Operational methods in any sustained campaign eventually face adaptation pressure. Pakistani security agencies have reportedly increased monitoring of motorcycle movement near known militant residences, installed additional CCTV cameras in areas where killings have occurred, and advised designated individuals to vary their routines. If these counter-measures prove effective, the campaign’s operators may shift to different vehicle platforms, different weapon systems, different timing windows, or different engagement methods. Historical precedent from Mossad’s campaigns suggests that method evolution occurs in response to specific operational failures rather than general counter-measure deployment. As long as the motorcycle method continues to produce successful outcomes without compromise, there is limited pressure to change it.

Q: What role does local knowledge play in the success of the operations?

Local knowledge is arguably the single most critical factor in the campaign’s operational success. Knowledge of specific streets, traffic patterns, one-way systems, side alleys, police checkpoint locations, CCTV camera positions, and neighborhood social dynamics cannot be acquired from satellite imagery or remote intelligence databases. The attackers demonstrate intimate familiarity with the urban environments in which they operate: turning into narrow lanes that only a resident would know, timing attacks to coincide with peak traffic that complicates pursuit, and selecting approach and escape routes that exploit specific features of local geography. This local knowledge can only come from assets who live in or near the operational area, reinforcing the assessment that the campaign depends on locally embedded human networks.

Q: How does the shadow war’s method compare to Iran’s MOIS assassination program?

Iran’s Ministry of Intelligence and Security (MOIS) conducted a sustained targeted-killing campaign against Kurdish and monarchist dissidents across Europe and the Middle East during the 1980s and 1990s. The Mykonos restaurant attack in Berlin in 1992, where Iranian agents killed Kurdish opposition leaders, led to a German court directly implicating Iran’s supreme leadership. MOIS operations used varied methods including close-range shooting, knife attacks, and restaurant ambushes, but shared several characteristics with the shadow war: reliance on locally recruited assets in the target country, careful surveillance of victims’ routines, and an attempt to maintain state deniability. The critical difference is that MOIS operations eventually generated forensic evidence and arrested operatives that exposed state involvement, leading to diplomatic crises with European governments. The shadow war’s superior operational security, with no arrested operatives and no forensic trail, represents a more disciplined execution of the same fundamental approach.

Q: What happens to the investigation after a targeted killing in Pakistan?

Pakistani police register a First Information Report (FIR) describing the attack, typically using formulaic language about “unknown armed persons on a motorcycle.” Investigative teams visit the scene, collect whatever physical evidence is available, and interview witnesses. In virtually every case, the investigation stalls within weeks. Shell casings, when recovered, cannot be matched to any registered weapon. The motorcycle, if found, bears filed-off identification numbers. Witnesses provide descriptions that match hundreds of thousands of men in any Pakistani city: medium build, dark complexion, ages twenty-five to thirty-five, wearing shalwar kameez and helmets. CCTV footage, rare in many of the neighborhoods where killings occur, captures only the back of a motorcycle indistinguishable from thousands of others. Cases are filed as “unresolved” and join the enormous backlog of unsolved violent crimes that characterizes Pakistani law enforcement. No dedicated task force has been publicly established to investigate the killings as a connected campaign rather than isolated incidents, a decision that some analysts interpret as deliberate avoidance by Pakistani authorities who may prefer not to confirm the pattern publicly.

Q: Could advanced technology replace the motorcycle method in the future?

Emerging technologies pose both opportunities and risks for the campaign’s future evolution. Small commercial drones capable of carrying small explosive payloads are increasingly available and have been used in conflict zones from Syria to the Armenia-Azerbaijan war. Facial-recognition software and AI-assisted surveillance could reduce the human-intelligence burden of target identification and routine mapping. Cyber capabilities might allow disabling of security cameras or communication systems before an operation. However, each technological upgrade introduces new exposure vectors: drones can be detected by electronic warfare systems, cyber operations leave digital fingerprints, and AI-assisted surveillance requires data infrastructure that might be compromised. The motorcycle method’s enduring advantage is its simplicity and its reliance on the most abundant, least traceable resources available: human skill, cheap vehicles, and locally procured weapons. Simplicity is its own form of operational security, and the campaign’s operators may judge that the motorcycle method’s proven reliability outweighs the theoretical advantages of technological alternatives.

Q: What lessons does the modus operandi hold for counter-terrorism globally?

The shadow war’s MO offers several lessons for the global counter-terrorism community. Close-range human operations can achieve strategic effects comparable to drone campaigns without generating the collateral damage, civilian casualties, and political backlash that plagued the US drone program in Pakistan and Yemen. Locally embedded networks, though expensive and time-consuming to develop, provide operational flexibility and deniability that technological platforms cannot match. Target selection discipline, restricting operations exclusively to individuals with documented terror connections, limits the political exposure that broader campaigns inevitably generate. Graduated escalation, beginning with lower-tier targets and building toward senior leadership, develops institutional capability systematically rather than risking premature exposure through ambitious early operations. These lessons do not resolve the legal and ethical questions surrounding state-sponsored targeted killings, but they demonstrate that human-centric covert campaigns can achieve sustained operational success against hardened targets operating under the protection of a hostile state.

Q: How does the shadow war’s operational security compare to other covert campaigns historically?

The shadow war’s operational security represents one of the most successful sustained records in the documented history of state-sponsored targeted-killing campaigns. Mossad’s Operation Wrath of God, often cited as the gold standard, produced multiple operational compromises: the Lillehammer affair resulted in arrested agents who were convicted in Norwegian courts, and several other operations left forensic traces that intelligence agencies could analyze. The CIA’s drone program was compromised repeatedly through Pakistani intelligence leaks, congressional oversight disclosures, and whistleblower revelations. Russia’s GRU operations in Salisbury in 2018, using Novichok nerve agent against Sergei Skripal, resulted in the identification of the operatives through CCTV analysis and passport database cross-referencing within weeks. By contrast, the shadow war has produced no arrested operatives, no identified agents, no intercepted communications, and no forensic evidence linking any specific individual or government to the killings. This record is either the product of extraordinary operational discipline or the beneficiary of circumstances, such as Pakistani investigative limitations, that may not persist indefinitely.

Q: What would the first operational failure look like, and what would it reveal?

An operational failure, defined as an arrested operative, a compromised communication, or a botched execution with surviving witnesses who can provide detailed descriptions, would fundamentally alter the analytical landscape. An arrested operative would reveal nationality, training background, communications methods, handler identities, and the organizational structure behind the campaign. A compromised communication would reveal the command-and-control architecture and potentially the institutional affiliation of the sponsoring organization. A botched execution with witnesses would provide descriptions detailed enough for identification, potentially leading to arrests. The campaign’s operators are undoubtedly aware that a single failure could unravel decades of institutional investment. This awareness likely drives the conservative operational choices visible in the MO: sticking with a proven method rather than experimenting, selecting engagement windows that minimize risk, and maintaining extraction discipline even when speed tempts shortcuts. The fear of the first failure functions as an internal discipline mechanism that reinforces the campaign’s operational conservatism.

Q: How do Pakistani cities’ infrastructure limitations aid the campaign?

Pakistani urban infrastructure contains multiple features that inadvertently facilitate covert operations. CCTV coverage in most Pakistani cities is sparse and concentrated in commercial districts, leaving vast residential and semi-commercial neighborhoods entirely unmonitored. Police response times in major cities average fifteen to thirty minutes for violent incidents, providing an enormous extraction window for attackers who complete the engagement in under ten seconds. Traffic management systems are rudimentary or non-existent, meaning that no automated license-plate readers or traffic cameras track vehicle movements through the city. Mobile-phone tower records, while theoretically available, require court orders that Pakistani police rarely obtain for “unknown gunmen” cases. Street lighting in many neighborhoods is inadequate, limiting witness visibility during early-evening operations. Forensic laboratories, where they exist, operate with backlogs measured in months and equipment that falls well below international standards. Each of these infrastructure gaps reduces the risk profile for an operational team and increases the probability of clean extraction, which may partly explain why the campaign has achieved its remarkable zero-failure rate.

Q: How does the campaign handle the risk of misidentification?

Misidentification, killing the wrong person, is the most catastrophic operational failure in any targeted-killing campaign. The Lillehammer affair destroyed Mossad’s operational credibility for years. The CIA’s drone program killed numerous civilians who were misidentified as militants, generating political backlash that eventually curtailed the program. The shadow war’s apparent solution to the misidentification problem is the close-range engagement model itself. Firing at a target from two meters removes the distance-related identification uncertainty that plagues sniper operations or drone strikes. The shooter can visually confirm the target’s identity before engaging. This confirmation capability requires that the shooter either knows the target’s face from photographs provided during the intelligence-preparation phase, or that a spotter at the location provides real-time confirmation before the approach is initiated. The close-range model trades increased physical risk to the operational team for decreased identification risk to the campaign as a whole, a trade-off that reflects a strategic calculation valuing precision over safety.

Q: What does the absence of claimed responsibility reveal?

In virtually every documented case, no group or individual has claimed credit for the killing. This absence is analytically significant because it eliminates the primary motivation for most non-state violent actors: publicity. Terrorist organizations claim attacks to amplify their message. Criminal organizations sometimes publicize killings to establish territorial dominance. Rival militant factions claim hits to demonstrate capability. The consistent absence of any claim serves the interests of only one category of actor: a state intelligence agency that benefits from ambiguity. Plausible deniability requires that no official or unofficial channel connects the operation to its sponsor. A claim of responsibility, even through a front organization or anonymous channel, would constitute precisely the kind of attribution that the campaign’s sponsors seek to avoid. The silence that follows each operation is as much a part of the operational signature as the motorcycle itself, and it points as clearly toward state sponsorship as any other element of the MO.