An Afghan man arrested for planning a terrorist attack on Election Day was working in Afghanistan as a security guard for the CIA, two sources familiar with the matter told NBC News.

Nasir Ahmad Tawhedi, 27, was arrested in Oklahoma on Monday and accused of plotting to kill Americans with an assault rifle on behalf of ISIS. Court documents say he donated to an ISIS charity in March and accessed ISIS propaganda online. However, it did not mention whether he became radicalized before or after his arrival in the United States in 2021.

A senior administration official said counterterrorism officials believed Tawhedi became radicalized during the three years he lived in the United States. A senior law enforcement official said the FBI is still investigating the issue.

The CIA declined to comment.

According to court documents, Tawhedi entered the country in September 2021, about a month after the U.S. military completed its chaotic withdrawal from Afghanistan after 20 years of war.

“Every Afghan resettled in the U.S. undergoes a rigorous screening and vetting process, regardless of which agency they worked with,” the official said. “This process includes review of all U.S. records and holdings,” the official said.

A senior administration official familiar with the details said Tawhedi passed two rounds of vetting without finding any derogatory information.

The official said Tawhedi was first screened before he entered the U.S. under a so-called humanitarian parole in September 2021, about 10 days after the last U.S. troops left Afghanistan. The source said he was re-screened while in Oklahoma City when he applied for a special immigrant visa. He was eligible for the visa because he worked for the U.S. government. The official said he had been approved for the visa, but had not yet taken the final steps to make it official. Special immigrant visas are available to Afghans who have worked with the US in Afghanistan after they pass the DHS exam.

The vetting process includes looking for possible links to terrorism, ISIS or the Taliban. It uses data from the applicant’s electronic devices, biometric data and other sources to search the extensive databases the U.S. has compiled over 20 years in Afghanistan.

The Justice Department’s indictment says he applied for a special immigrant visa and “is currently on parole pending a determination of his immigration case.”

However, two U.S. officials familiar with the matter told NBC News that the charging document was false and that Tawhedi entered the U.S. on parole for humanitarian reasons.

Officials say humanitarian parole generally requires far fewer reviews than a special immigrant visa.

The Department of Homeland Security, which is playing a leading role in the review, declined to discuss the case, saying in a statement that “Afghan evacuees seeking to enter the United States are subject to multi-layered vetting and vetting by intelligence, law enforcement, and authorities”. and counterterrorism information. If new information emerges after it arrives, appropriate action will be taken.”

But members of Congress and other U.S. officials said that as the U.S. evacuated tens of thousands of Afghans in the final days of the war, concerns arose that not all of them were being properly screened. A report from the DHS inspector general said the agency was “missing critical data” when vetting refugees.

The CIA conducted its own large-scale evacuation operation for Afghans who had worked for or helped the agency.

The question of how and why Tawhedi was in the country was politically contentious even before the revelation that he had worked for the CIA. Donald Trump Jr. wrote on Platform

He retweeted a post from Oklahoma’s Republican attorney general that said: “The American people must know that this radical Islamic terrorist was imported directly into the United States by the Biden-Harris administration as part of its controversial refugee resettlement program.” ”

It is not clear whether Tawhedi was a radical Islamist when he came to the United States

Sources familiar with his work in Afghanistan say he had minimal contact with Americans and was not a CIA informant or a member of the U.S.-trained and armed paramilitary force called the Zero Units. Many of these fighters were evacuated to the United States after strict controls and security checks.

According to court documents, Tawhedi stated in seized communications that he planned his attack for Election Day, Nov. 5. Authorities said that in an interview after his arrest he confirmed that the attack targeted large gatherings and that he expected the death of a martyr. Authorities say he planned the operation with a teenage co-conspirator described as an Afghan citizen with legal permanent resident status.

The pair were arrested after meeting two confidential individuals and an undercover FBI agent at a rural location in Western Oklahoma who posed as business partners to purchase rifles, 10 magazines and ammunition for the planned attack.

Biden administration officials note that the complaint alleges the unnamed teenage co-conspirator entered the country in 2018, during the Trump administration. That person also passed the review, a senior administration official said.