Lead: On Wednesday in Washington, D.C., a gunman opened fire on National Guard members outside a Metro station, critically wounding Army Spc. Sarah Beckstrom, 20, and Air Force Staff Sgt. Andrew Wolfe, 24. Authorities detained 29-year-old Afghan national Rahmanullah Lakanwal after he was shot and taken into custody; officials later said one guard member had died. The FBI and federal partners are leading an active investigation into the attack, while the suspect’s asylum and resettlement record are under scrutiny. Law enforcement say motive remains unclear even as searches and digital forensics continue across multiple states.
Key takeaways
- Two National Guard members were ambushed outside a D.C. Metro station; the victims were identified as Spc. Sarah Beckstrom, 20, and Staff Sgt. Andrew Wolfe, 24.
- Authorities detained 29-year-old Afghan national Rahmanullah Lakanwal; he entered the U.S. in September 2021 and was granted asylum in 2025.
- Federal prosecutors announced charges including three counts of assault with intent to kill and a firearms count; charges could change depending on victims’ outcomes.
- Investigators say the suspect fired an initial four rounds, then took a fallen Guard member’s weapon and continued shooting before being stopped by other Guardsmen.
- Searches executed in Washington state and leads traced to San Diego yielded numerous electronic devices seized for forensic review.
- The CIA confirmed the suspect previously worked with U.S. forces as part of a partner unit in Kandahar that ended in 2021.
- The Trump administration ordered a review of green cards for nationals from 19 “countries of concern” and paused Afghan immigration processing pending vetting reassessments.
- Authorities describe the attack as a calculated ambush; the suspect is not cooperating with investigators as of the latest briefings.
Background
The National Guard presence in Washington, D.C., has been used for high-visibility patrols to protect key locations and transit hubs; the two injured guardsmen were deployed to the district and had been serving there since August, according to military officials. Many Guard deployments in the capital involve deputization for limited public-safety tasks, which preserves their military status while enabling close coordination with civilian law enforcement. The suspect’s arrival in the United States traces to the 2021 evacuations from Afghanistan when thousands were paroled or otherwise admitted on humanitarian grounds after the U.S. withdrawal.
Parole and asylum pathways applied to Afghan evacuees in 2021 led to an influx of individuals admitted under humanitarian authority; some later pursued asylum claims through U.S. Citizenship and Immigration Services. Those processes, and their interaction with national-security vetting, have become politically charged, particularly after high-profile incidents. At the same time, federal investigators employ standard criminal and counterterrorism tools—search warrants, device seizures and digital forensics—when probing attacks on service members in public settings.
Main event
According to law enforcement sources, the suspect approached a pair of Guard members posted outside a Metro station and opened fire without warning in what officials characterized as a deliberate ambush. The first victim—a female Guard member—was struck immediately and collapsed; sources say she sustained at least two gunshot wounds. The suspect initially carried a handgun with four rounds, then allegedly grabbed the fallen guardswoman’s issued weapon and continued the assault, striking a second Guard member.
Other Guardsmen on patrol intervened: one reportedly stabbed the attacker with a pocketknife and another returned fire, striking the suspect multiple times and ending the shooting. The two wounded Guard members were transported for emergency surgery; officials later reported that one of the victims died and the other remained in critical condition. U.S. Attorney Jeanine Pirro said the victims had been sworn in for duty the day before the attack, and the Guard clarified they had been serving in the district since August.
Federal authorities executed search warrants at the suspect’s last known address in Bellingham, Washington, and followed leads to contacts in San Diego. Investigators seized numerous electronic devices—cellphones, laptops, tablets—and have interviewed multiple family members and associates as part of a broad forensic and background probe. The suspect has not been cooperative during questioning, officials said.
Analysis & implications
The incident has immediate operational and policy implications. Practically, the attack has prompted scrutiny of how Guard patrols are positioned and the interoperability between military personnel on deputized posts and civilian law enforcement response. The fact that the suspect allegedly used a service member’s weapon to continue the attack raises questions about gear retention and engagement rules in public-foot-patrol settings.
On immigration policy and vetting, the shooting triggered swift executive actions: a directed reexamination of green cards for nationals from a 19-country list of “countries of concern” and an indefinite pause on processing Afghan immigration applications. Those moves will reshape vetting procedures and are likely to provoke legal and diplomatic challenges, while also affecting thousands whose cases are pending.
For prosecutors, outcomes will hinge on both evidentiary findings and medical updates about the victims; charges already filed include multiple counts of assault with intent to kill and a firearms offense, but additional counts or enhancements could follow. Internationally, confirmation that the suspect had worked with U.S. partners in Afghanistan complicates narrative framing: it raises operational questions about post-evacuation admissions while also underscoring the varied backgrounds of evacuees.
Comparison & data
| Item | Detail |
|---|---|
| Suspect | Rahmanullah Lakanwal, 29 (Afghan national) |
| U.S. admission | Paroled into U.S., Sept 2021 |
| Asylum decision | Application granted in 2025 |
| Victims | Spc. Sarah Beckstrom, 20; Staff Sgt. Andrew Wolfe, 24 |
| Initial rounds fired | Four rounds reported before weapon change |
The table above highlights core timeline points and numeric details cited by officials. Those facts frame both criminal charges and administrative policy responses, and they will be central to any legal proceedings and interagency reviews that follow.
Reactions & quotes
Federal and local officials offered terse statements as the investigation unfolded, balancing condolence with procedural caution.
“They are receiving the finest medical care. It’s not clear how it’s going to end up.”
U.S. Attorney Jeanine Pirro (official statement)
Pirro emphasized uncertainty about outcomes while confirming charges and the ongoing investigation.
“We seized numerous electronic devices… and will go anywhere in the country or the world where the evidence leads us.”
FBI Director (press briefing)
The FBI summarized the multi-jurisdictional investigative steps, including warrants and digital forensics.
“He previously worked with the U.S. government, including CIA, as a member of a partner force in Kandahar.”
CIA spokesperson (agency statement)
The agency confirmation that the suspect had partnered with U.S. forces adds complexity to vetting and resettlement discussions.
Unconfirmed
- The authenticity of an ID badge circulated online linking the suspect to a so-called “Kandahar Strike Force” or specific unit has not been independently verified by investigators.
- Investigators have suggested the suspect may have suffered from paranoia or mental-health challenges, but a definitive motive or clinical diagnosis has not been confirmed.
- While no additional suspects have been publicly identified, the full scope of any co-conspirators or broader connections remains under active investigative review.
Bottom line
The attack on National Guard members in Washington, D.C., has produced a fast-moving criminal investigation intertwined with urgent policy responses on immigration vetting and refugee processing. Key facts—victim identities, the suspect’s admission history, device seizures and charges—are established by officials, but central questions about motive and broader connections remain unresolved. Readers should treat preliminary administrative responses and political commentary as separate from the evidence being collected by investigators.
Expect continued forensic analysis of seized devices, interviews with associates and possible refinements to charges as medical and technical evidence develops. The case will likely drive policy debate over vetting procedures while also prompting internal reviews of Guard protective missions and equipment protocols for high-visibility patrols.
Sources
- CBS News (news) — live updates and reporting on the D.C. shooting
- Department of Homeland Security (official) — statements on suspect identification and immigration actions
- U.S. Citizenship and Immigration Services (official) — information on asylum and processing
- Central Intelligence Agency (agency statement) — confirmation of prior partner-force work