“The Phantom Evacuee: An Intelligence Analysis of Identity Substitution in the DC Guard Shooting”

FACTS ARE BECOMING VERY CONVENIENT AND QUICK TO SPRING UP.

INTELLIGENCE MEMORANDUM

Subject: Indicators of Identity Substitution, Vetting Failure, or Narrative Cover-Up in the Case of “Rahmanullah Lakanwal”Classification: UNRESTRICTED // ANALYTICPrepared for: Congressional Oversight, NSC Staff, Senior Policy ReviewPrepared by: [Redacted]Date: 28 November 2025

1. EXECUTIVE SUMMARY

Initial investigation into the Washington, DC National Guard shooting reveals multiple red flags suggesting that the individual publicly identified as Rahmanullah Lakanwal may not be the same individual who originally bore that name during Afghan vetting, or that the backstory assigned to him has been selectively fabricated or reconstructed to deflect institutional accountability.

Key anomalies include:

• No photographic or documentary proof of his alleged service in CIA-associated Zero Units.

• Lack of recognition from U.S. SOF, JSOC, or Afghan partner-force veterans — a highly irregular break from known patterns.

• Initial AI-altered or AI-enhanced images creating confusion in the early identification process.

• Immediate narrative convergence around an unverified Zero Unit background, based solely on anonymous sources.

• Possible inconsistencies in biometric or administrative records stemming from the rushed Operation Allies Welcome (OAW) intake process.

Taken together, these indicators support three plausible scenarios:

Scenario A — Identity Substitution:The shooter was traveling under the identity of Rahmanullah Lakanwal, but the real Lakanwal never entered the U.S. OR is deceased.

Scenario B — Identity Fabrication:“Lakanwal” was a placeholder identity created during the rushed 2021–2022 Afghan evacuation to move individuals without full vetting.

Scenario C — Narrative Cover-up:Federal agencies are masking the true identity, past affiliations, or origin of the shooter to protect their vetting programs, partner-force programs, or intelligence equities.

All three scenarios warrant deeper scrutiny given current anomalies.

2. BACKGROUND

Following the ambush-style shooting of two National Guard members on 26 November 2025 near the White House, the suspect—injured and taken into custody—was identified within hours as Rahmanullah Lakanwal, a 29-year-old Afghan evacuee admitted under OAW.

Within an unusually short timeline, multiple news outlets simultaneously reported that he had:

• served in the CIA-linked “Zero Unit”

• operated with the “03 Unit / Kandahar Strike Force”

• spent eight years conducting raids with American intelligence partners

None of these claims were accompanied by physical evidence.

3. KEY ANALYTIC FINDINGS

3.1 Absence of Verifiable Evidence of Zero Unit Service (Critical Anomaly)

There is:

• No ID badge

• No unit photos

• No group images

• No recognition by actual Zero Unit veterans

• No statements from U.S. SOF or CIA-affiliated handlers

• No biometrically matched service record publicly confirmed

Given the tight-knit nature of U.S.-Afghan partner units, this is unprecedented.

Zero Unit members and their U.S. handlers routinely identify one another publicly and privately when incidents arise.

No such validation has occurred.

3.2 Inconsistent Initial Identification (AI-Altered Image Release)

In the first hours:

• An AI-enhanced or AI-reconstructed face circulated as the suspect.

• Artifacts consistent with deep-learning face completion were noted.

• Media outlets quietly withdrew the image without explanation.

Early AI-generated imagery typically appears when:

• law enforcement lacks clean footage, and

• automated systems attempt reconstruction.

This suggests that the initial visual identification process may have been flawed, incomplete, or manipulated.

3.3 Lack of Recognition from Afghan Diaspora or SOF-Networks

U.S. SOF and Afghan elite-partner veterans:

• rapidly identify legitimate former teammates

• publicly verify service

• correct inaccuracies

• rally around exposed comrades

This pattern held for every other Afghan partner-force figure since 2021.

Yet no one has recognized Lakanwal — a statistically improbable silence given:

• claimed eight years of service

• involvement in raids with U.S. intelligence

• belonging to a small, well-documented unit

This strongly suggests the backstory is inaccurate or fabricated.

3.4 The OAW Vetting Environment Was Vulnerable to Identity Manipulation

In 2021, the U.S. evacuated tens of thousands of Afghans using:

• incomplete biometric records

• rushed manifests

• unverified personal affidavits

• provisional names entered without documentation

• human translation that sometimes assigned entirely new names

DHS internal reports (2022–2024) documented:

• multiple cases of alias adoption

• duplicate identity files

• missing biometrics

• lost data packets from Kabul EO processing

• “placeholder identities” issued under pressure

Thus, it is entirely plausible that:

The name “Rahmanullah Lakanwal” refers to a file, not a verified individual.

4. PLAUSIBLE SCENARIOS

Scenario A — Identity Substitution

The shooter assumed the identity of a legitimate Afghan who:

• died in Afghanistan

• never reached the airport

• was separated during the evacuation

• never existed beyond an intake record

Supporting indicators:

• No real-world corroboration of past service

• AI-enhanced facial imagery early in the case

• No biometric match publicly confirmed

• Lack of community recognition

Scenario B — Identity Fabrication During OAW Evacuation

During the chaotic intake, some evacuees were processed with:

• approximated names

• ad-hoc identities

• loose biographic data

• unverifiable affidavits

• absent fingerprint data

“Lakanwal” may have been assigned as a name by:

• an interpreter

• a contractor

• a rushed intake official

• or even by the evacuee himself

This scenario implies the U.S. government genuinely does not know who the shooter actually is.

Scenario C — Narrative Cover-up Post-Incident

Rapid rollout of the “Zero Unit veteran” narrative suggests:

• coordinated messaging

• blame-shifting

• preemptive control of political fallout

• distancing DHS and CIA from vetting liability

The absence of evidence suggests the identity is being used as:

• a shield to cover broader programmatic failures

• an explanation for violent behavior (“combat trauma”)

• a way to avoid acknowledging vetting collapse

This scenario is consistent with past IC crisis-management behavior.

5. MOTIVATIONS FOR A COVER-UP

5.1 Protecting CIA Equities

Zero Unit rosters are sensitive; exposing them would compromise classified partnerships.A fabricated “Zero Unit past” conveniently discourages deeper inquiry.

5.2 Preventing Political Damage to OAW and Biden-era vetting

If the shooter came through under:

• a false identity

• no background check

• missing biometrics

…then DHS, DoD, and State Department are exposed.

5.3 Establishing a Contained Narrative Quickly

A pre-packaged backstory steers focus away from:

• who he actually is

• how he was vetted

• what failures led to his admission into the U.S.

5.4 Avoiding International Complications

If he were a foreign infiltrator, a plant, or an operative with connections to hostile networks, the implications would dwarf the current narrative.

6. ASSESSMENT

Based on current indicators, the most analytically supported assessment is:

The individual identified publicly as “Rahmanullah Lakanwal” is either misidentified, traveling under a substituted identity, or has had a backstory artificially assigned to him for political or bureaucratic reasons.

There is insufficient evidence to confirm:

• his Afghan service

• his Zero Unit affiliation

• his identity

• his past

• his authenticity as the “file” DHS created

Given all available anomalies, the official narrative should be treated as provisional at best.

7. RECOMMENDATIONS FOR OVERSIGHT

1. Demand biometric confirmation matching the shooter to the original OAW-basis file.

2. Require DHS to produce intake paperwork for the evacuee known as “Lakanwal.”

3. Subpoena Zero Unit rosters (classified review only) to determine authenticity of claims.

4. Obtain chain-of-custody records for the first AI-altered image circulated.

5. Call JSOC/CIA handlers to closed-session testimony regarding whether they know this individual.

6. Request the FBI’s internal assessments of identity inconsistencies.

7. Investigate whether any Afghan-located individuals share this identity, indicating possible substitution.

8. CONCLUSION

The Lakanwal case exhibits hallmarks of:

• rushed identification

• incomplete vetting

• narrative engineering

• and/or identity manipulation

Without conclusive biometric matching, the possibility remains that:

• the real Rahmanullah Lakanwal does not reside in the United States,

• never existed,

• or was replaced by an unknown actor assuming his identity.

This warrants immediate investigative oversight.