The Afghan who opened fire on a high-ranking delegation visiting a military complex in Kabul, killing U.S. Major General Harold Greene, had served in the army for three years, an Afghan defence official said on Wednesday.
In the immediate aftermath of Tuesday's attack, the Defence Ministry had described the gunman, who was also killed, as a "terrorist in army uniform", indicating its belief he was an Islamist militant who had infiltrated the army from outside.
While details about the identity of the soldier and his motivation remain sketchy, the fact that he had spent so long in the army before turning on fellow soldiers is likely to be a major line of inquiry in an investigation launched on Wednesday.
"What motivated the shooting is still under investigation, but the shooter was an army soldier, not a terrorist from outside the base," said the official.
Initial findings from the investigation were due to land on Afghan President Hamid Karzai's desk by the evening.
Greene was the most senior U.S. military official killed in action overseas since the war in Vietnam. A German general was also among 14 coalition troops wounded after the man opened fire with a light machine gun.
The attack has raised fresh questions about the ability of NATO soldiers stationed in Afghanistan to train local forces, and will undermine trust between them at a crucial time.
Most foreign soldiers plan to withdraw from the war-torn country by the end of 2014, but, recognising the challenge Afghan forces face in battling a vicious insurgency led by the Taliban, a contingent could remain beyond the deadline in a training and counter-insurgency role.
"LISTENING TO A SPEECH"
At their peak in 2012, so-called "insider" attacks threatened the very foundation of the U.S.-led mission in Afghanistan and prompted the coalition to bring in a host of measures to reduce interaction with their local allies.
The number of incidents fell from nearly 50 in 2012 to about 15 last year.
"Despite all security measures, such attacks by insiders can never be totally ruled out," a German defence ministry spokesman said.
The coalition, called the International Security Assistance Force (ISAF), insisted the attack would not compromise their plans to train and assist Afghanistan's fledgling armed forces, built from scratch after the Taliban were ousted in 2001.
"We do not view the incident at Marshal Fahim National Defense University in Kabul yesterday as representative of the positive relationship which we have nurtured," it said in a statement.
According to a spokesman for the German forces' mission command in Potsdam, near Berlin, the shooting at the complex on the outskirts of Kabul came from a neighbouring building.
"The ISAF delegation was listening to a speech in the open air on the premises of the Marshal Fahim National Defense University when somebody opened fire," he said.
The attack was initially believed to have taken place at the British-backed officer training academy nicknamed "Sandhurst in the Sand".
The coalition later clarified that it happened on another part of the complex, where security was managed by the Afghans.
High-ranking officers, including Greene and Brigadier General Michael Bartscher of Germany, were likely to have had their own protection teams.
According to an Afghan Interior Ministry official, initial information suggests that the attacker was called Rafiullah.
The defence official said he was a low-ranking soldier who was recruited to join the army from Paktika province in eastern Afghanistan bordering Pakistan.
The area is a hotbed of Taliban activity and a stronghold of their Islamist militant allies, the Haqqani network.
The soldier's reasons for opening fire may never be known, but the fact that the Taliban, who regularly make exaggerated claims of attacks on foreign forces, have remained silent suggests the soldier may have acted of his own accord.
© 2015 Thomson/Reuters. All rights reserved.