By RIAZAT BUTT

WASHINGTON — In the chaotic final days of the U.S. withdrawal from Afghanistan in August 2021, U.S. military analysts observed a white Toyota Corolla stop at what they believed was an Islamic State compound.

The Americans were already on edge. Three days earlier, a suicide bomber had killed scores of Afghans and 13 U.S. troops at a main gate of the Kabul airport. Now, officials had intelligence that there would be another attack there, and that it would involve a white Corolla.

They tracked the car around Kabul for the next several hours. After it pulled into a gated courtyard near the airport, they authorized a drone strike. Hours later, U.S. officials announced they had successfully thwarted an attack.

As reports of civilian deaths surfaced later that day, they issued statements saying they had “no indications” but would assess the claims and were investigating whether a secondary explosion may have killed civilians.

But portions of a U.S. Central Command investigation obtained by The New York Times show that military analysts reported within minutes of the strike that civilians may have been killed, and within three hours had assessed that at least three children were killed.

The documents also provide detailed examples of how assumptions and biases led to the deadly blunder.

Military analysts wrongly concluded, for example, that a package loaded into the car contained explosives because of its “careful handling and size,” and that the driver’s “erratic route” was evidence that he was trying to evade surveillance.

The investigation was completed a week and a half after the strike and was never released, but The New York Times has obtained 66 partially redacted pages of it through a Freedom of Information Act lawsuit against Central Command.

Central Command declined to provide additional comment beyond statements it had previously made about the strike. The Pentagon previously acknowledged that the strike was a “tragic mistake” that killed 10 civilians, and told The Times that a new action plan intended to protect civilians drew on lessons learned from the incident.

Among those killed was Zemari Ahmadi, a longtime aid worker and the driver of the car.

Responding to a description of the document released to The Times, Hina Shamsi, an American Civil Liberties Union lawyer representing families of victims, said the investigation “makes clear that military personnel saw what they wanted to see and not reality, which was an Afghan aid worker going about his daily life.”

The Attack

On Aug. 29, 2021, an American MQ-9 Reaper drone shot a Hellfire missile at a white Toyota Corolla in a neighborhood near the Kabul airport.

in 20 minutes, multiple military officials and members of the strike team learned that analysts had seen possible civilian casualties in video feeds, according to their sworn statements for the investigation.

Two to three hours after the attack, analysts who had reviewed the footage frame by frame assessed that three children had been killed. An officer then shared that information with two top commanders in Afghanistan, Maj. Gen. Christopher Donahue, the ground force commander, and Rear Adm. Peter G. Vasely.

In sworn statements, six of nine witnesses described learning immediately after the strike that civilians were in the area and may have been killed.

Later that day, Central Command said in a statement that officials were “assessing the possibilities of civilian casualties” but had “no indications at this time.”

An update several hours later noted that powerful subsequent explosions may have caused civilian casualties but did not mention that analysts had already assessed three children were killed.

Three days later, Gen. Mark A. Milley, the chairman of the Joint Chiefs of Staff, told reporters that the strike was “righteous” and had killed an ISIS facilitator as well as “others,” but who they were, “we don’t know. We’ll try to sort through all of that.”

Over the next several weeks, Pentagon officials continued to say that an ISIS target was killed in the strike, even as evidence mounted to the contrary.

On Sept. 10, a Times investigation based on video evidence and interviews with more than a dozen of Mr. Ahmadi’s co-workers and family members in Kabul found no evidence that explosives were present in the vehicle.

Mr. Ahmadi, who worked as an electrical engineer for a California-based aid group, had spent the day picking up his employer’s laptop, taking colleagues to and from work and loading canisters of water into his trunk to bring home to his family.

Officials insisted that their target had visited an ISIS “safe house,” but The Times found that the building was actually the home of Mr. Ahmadi’s boss, whose laptop he was picking up.

A week after the Times investigation was published, military officials acknowledged that 10 civilians had been killed and that Mr. Ahmadi posed no threat and had no connection to ISIS.

Tracking a White Toyota

A subsequent review led by the Air Force inspector general, Lt. Gen. Sami D. Said, remains classified. But the general acknowledged that confirmation bias — a tendency to look for, analyze or remember information in a way that supports an existing belief — was an important factor in how Mr. Ahmadi became a target.

The documents obtained by The Times offer specific examples of how confirmation bias led to errors, including the military’s conclusion that the car it was looking for was the one Mr. Ahmadi was driving.

According to the documents, U.S. intelligence reports on Aug. 29 indicated that an Islamic State affiliate known as ISIS-K was planning an imminent attack on the airport that could involve suicide bombers, “rockets on timers” in the back of a vehicle, and a white Toyota Corolla.

Surveillance aircraft began tracking the white Corolla that Mr. Ahmadi was driving after it stopped at an “established ISIS-K compound.” Drones followed the car to “a second building,” where they observed Mr. Ahmadi as he “carefully loaded” a “package” into the trunk. Analysts assessed the package to be explosives “based on the careful handling and size of the material.”

Over the next several hours, analysts watched as the car made stops and dropped off “adult males,” some of whom were carrying “bags or other box-shaped objects.” At one point, an analyst described how the car was “gingerly loaded with a box carried by five adult males.”

The investigation notes the car’s other movements that day, including that it entered a mall parking garage, that “bags” and “jugs” were unloaded from the trunk, and that it stopped at a Taliban checkpoint.

Analysts said the car followed an “erratic route” that was “consistent with ISIS-K directives to avoid close circuit cameras and pre-attack posture historically demonstrated by the group.”

A man who was seen opening and closing the gate for the car was also assessed to be a part of the threat. “I personally believed this to be a likely staging location and the moving personnel to likely be a part of the overall attack plot,” one official recounted to investigators. “That was my perception, and it was largely based on both someone immediately shutting the gate behind the vehicle and someone running in the courtyard.”

At this point, new intelligence indicated the airport attack would be delayed until the following day, according to one of the investigation’s interviewees, but military personnel were concerned that they could lose the target.

Thinking that the walls would limit the blast radius from reaching pedestrians on the street, the strike team launched a Hellfire missile at the vehicle. Shortly after impact, witnesses said they saw large secondary explosions, which helped confirm investigators’ belief that the vehicle contained explosives.

But the documents present a less definitive understanding of the source of the secondary explosion. “Conflicting opinions from experts regarding the secondary explosion makes it inconclusive regarding the source of the flame seen after the strike,” according to the report’s findings, which recommended further investigation.

Footage of the minutes after the strike obtained by The Times shows a fireball from the blast, which expands several seconds later. On Sept. 17, after additional review, military officials said the explosion was probably a propane or gas tank.

The investigation refers to an additional surveillance drone not under military control that was also tracking the vehicle but does not specify what it observed. The Times confirmed that the drone was operated by the C.I.A. and observed children, possibly in the car, moments before impact, as CNN had reported.

The military investigation includes recommendations for better coordination, but the documents do not mention that the C.I.A. drone observed children before impact.

“When confirmation bias was so deadly in this case, you have to ask how many other people targeted by the military over the years were also unjustly killed,” Ms. Shamsi said.

The investigation noted that a rocket attack at the airport did occur the next day, about 200 meters from the supposed “ISIS compound” where Mr. Ahmadi first stopped — the event that triggered the initial surveillance. Times journalists identified the car from which the rockets were launched as a white Toyota.

A year later, in August 2022, the Pentagon announced a plan for preventing civilian deaths in U.S. military operations that includes imposing a new system to reduce the risk of confirmation bias and misidentifying targets.

The Pentagon is still developing the policy, which incorporates training on mitigating cognitive bias and creates “civilian harm assessment cells.” It will also give the U.S. military more ways to respond to victims, in addition to condolence payments to survivors and family members of those harmed.

None of Mr. Ahmadi’s surviving relatives have received monetary assistance from the U.S. government as a result of the strike.

One of Mr. Ahmadi’s brothers, Emal Ahmadi, whose toddler Malika was also killed in the strike, arrived in the United States last week.

“I thought the U.S. government would welcome us, meet with us,” he said. “We are waiting for them.”

Christoph Koettl and Eric Schmitt contributed reporting.