Insecurity and Industrial Organization: Evidence from Afghanistan

One-fifth of the world's population lives in countries affected by fragility, violence and conflict, impeding long-term economic growth. However, little is known about how firms respond to local changes in security, partly because of the difficulty of measuring firm activity in these settings. This paper presents a novel methodology for observing private sector activity using mobile phone metadata. Using Afghanistan as the empirical setting, the analysis combines mobile phone data from over 2,300 firms with data from several other sources to develop and validate measures of firm location, size, and economic activity. Combining these new measures of firm activity with geocoded data on violent events, the paper investigates how the private sector in Afghanistan responds to insecurity. The findings indicate that firms reduce presence in districts following major increases in violence, that these effects persist for up to six months, and that larger firms are more responsive to violence. The paper concludes with a discussion of potential mechanisms, firms'strategic adaptations, and implications for policymakers.


Policy Research Working Paper 8301
This paper is a product of the Office of the Chief Economist, South Asia Region and the Macroeconomics, Trade and Investment Global Practice Group. It is part of a larger effort by the World Bank to provide open access to its research and make a contribution to development policy discussions around the world. Policy Research Working Papers are also posted on the Web at http://econ.worldbank.org. The corresponding author may be contacted at tghani@wustl.edu.
One-fifth of the world's population lives in countries affected by fragility, violence and conflict, impeding long-term economic growth. However, little is known about how firms respond to local changes in security, partly because of the difficulty of measuring firm activity in these settings. This paper presents a novel methodology for observing private sector activity using mobile phone metadata. Using Afghanistan as the empirical setting, the analysis combines mobile phone data from over 2,300 firms with data from several other sources to develop and validate measures of firm location, size, and economic activity. Combining these new measures of firm activity with geocoded data on violent events, the paper investigates how the private sector in Afghanistan responds to insecurity. The findings indicate that firms reduce presence in districts following major increases in violence, that these effects persist for up to six months, and that larger firms are more responsive to violence. The paper concludes with a discussion of potential mechanisms, firms' strategic adaptations, and implications for policymakers.

Introduction
In textbook models of economic growth and development, a powerful underlying assumption is that market exchange takes place almost exclusively in non-violent settings where property rights are secure. 1 That premise is at odds with the actual experience of many countries and the households and firms within them. The 2011 World Development Report (WDR) counted a billion and a half people living in countries affected by fragility, conflict or violence, and it identified organized violence as an impediment to long-run economic growth (World Bank, 2011).
The recent academic literature points out that insecurity can influence a nation's development and growth through many different channels. These include a fall in output due to the loss of physical capital and drop in investment by firms; the misallocation of human capital from production to protection; the erosion of human capital due to the shift in public spending toward the military and away from social goods like education and health care; the disruption of labor markets and transportation networks; the drop in consumer demand; and the weakening or destruction of the political, social, and economic institutions that markets require, including property rights (Blattman and Miguel, 2010;Miguel and Roland, 2011). 2 A separate channel that has recently received attention in this literature is via the industrial organization of sectors and firms (Amodio and Di Maio, 2017;Besley and Mueller, 2017). How persistent are the effects of insecurity, and how does this contribute to firm growth and survival? Do firms make strategic decisions on where and when to invest based on patterns of violence? And does insecurity affect all firms equally, or are certain firms more 1 Terms like "civil war" and "rebellion" generally do not appear in the leading textbooks on economic growth (see, for example, Jones (2002)). One of the best-selling texts on development economics devotes just one paragraph to political instability including inter-state and civil wars, coups d 'etat, and rebellions (Perkins et al., 2013). 2 The link between such institutions as property rights and long-run growth has been of particular concern to economists since at least the pioneering work of North (1981). Svensson (1998), for example, extended North's research by modeling the effects of political instability on property rights and, in turn, on investment rates. Gradstein (2004) argues that the enforcement of property rights and economic growth are self-reinforcing. Building on this and related research, the WDR emphasizes the crucial role of improved governance in securing people and property if growth is to be achieved (World Bank, 2011). impacted -such as larger firms who may become prominent targets? These questions are of crucial importance for economic development because the industrial organization of sectors and firms determines the possibilities for entry, exit, and innovation, and thus for market competition and the provision of goods and services (Cefis and Marsili, 2005;Godfrey, 2008).
Studying firms and sectors in conflict-affected countries, however, poses several empirical challenges. In particular, reliable quantitative data is often scarce in insecure contexts, and gathering new data through surveys, for example, may be difficult and even dangerous. As Besley et al. (2011) put it, "We have a paucity of firm-level data during or immediately after [...] conflict." Past research has either focused on publicly traded firms or on specific settings where high-quality administrative data is available (Guidolin and La Ferrara, 2007;Bruck et al., 2012). Novel methods for measuring the micro-level dynamics of firm activity have the potential to unlock new research avenues into private sector activity in violent settings.
In this paper, we explore the application of commercial mobile phone data as a novel source of information about firm behavior in conflict-affected countries, using Afghanistan as our empirical setting. Our methodology extends work by Blumenstock et al. (2015), who use mobile phone data to analyze the distribution of wealth and poverty in Rwanda. 3 We combine 45 months of comprehensive mobile phone records from over 2,300 firms with administrative data from the Afghan government and an original survey of Afghan firms to create and validate measures of firm location, firm size, and aggregate economic activity. 4 To our knowledge, this is the first concerted effort to measure the activity of private firms in developing countries using passively-collected digital data. 5 Our validation exercises suggest 3 In recent years, scholars have made great progress integrating new sources of large-scale digital data in empirical social science research (Einav and Levin, 2014;King, 2011). While the vast majority of this work has focused on industrialized economies where internet and social media proliferate, a more recent strand in this literature attempts to adapt these insights to the context of developing and conflicted-affected countries (Blumenstock, 2016). In these environments, fewer sources of 'big data' exist, but mobile phone metadata is a prominent exception. Increasingly ubiquitous in even the most remote and dangerous regions, mobile phone networks generate terabytes of information that can provide a novel perspective on growth and development (de Montjoye et al., 2014;Eagle et al., 2010). 4 The mobile phone Call Detail Records (CDR) data used in this paper cover the period from April 2013 to December 2016. 5 This approach also relates to recent work using satellite imagery to measure productivity and wealth (Henderson et al., 2012;Jean et al., 2016), but such approaches do not typically differentiate private sector that the phone-based measures have promising potential to complement and extend traditional sources of data collection on firms in developing and conflict-affected countries, with advantages in terms of cost and fidelity.
We use this new measure of firm activity to develop a more nuanced understanding of how the private sector in Afghanistan responds to violence. To provide intuition for this response, we first present a detailed case study of the response of the private sector to the Taliban's September 2015 attack on Kunduz, the country's fifth largest city. An empirical analysis of the phone-based measures of firm activity in Kunduz illustrates the short-and long-term response of firms to a massive security shock, and helps further develop our approach.
We then expand our quantiative analysis to all of Afghanistan by combining terabytes of mobile phone data with four years of geocoded data on confirmed fatalities. We employ an increasingly restrictive series of econometric specifications to identify the effect of unexpected violence on firm activity, and to explore heterogeneous effects by firm type.. We find that in response to local insecurity, firms decrease presence in affected areas.
Specifically, we find a significant, negative impact of major violent events on firm presence, which persists for up to six months. The effect in our sample is driven by the response of larger firms -where firm size is measured by the total number of subscribers (phone numbers) assigned to a corporate account. This suggests an under-studied channel through which insecurity may impede the growth of firms in poor economies. 6 We explore the mechanisms underlying the heterogeneity by firm size using original survey data from a subsample of more than 450 firms and show that larger firms are significantly more likely to report business disruptions from anti-government group activity and to adapt their business practices in response to such experiences.
Our work engages two existing literatures that currently have limited intersection: the first on the economic consequences of conflict, and the second on the industrial organization from other economic activity.
6 Recent work by Hsieh and Olken (2014) using data from India, Indonesia and Mexico indicates both medium and large-firms may be underrepresented relative to small firms in emerging economies compared to the size distributions observed in developed economies. 4 of firms in developing countries. The economics of conflict literature extends the focus of North (1990) on national institutions and strong property rights regimes (Svensson, 1998) to highlight the effects of a breakdown in institutionally-enforced order. Classic examples have highlighted the macro-economic consequences of violent conflict on GDP in Spain (Abadie and Gardeazabal, 2003), on investment in Israel (Fielding, 2004), and on housing prices in Ireland (Besley and Mueller, 2012). In the spirit of Guidolin and La Ferrara (2007), who study the effect of Angola's conflict on diamond companies, we focus on the micro-level of firm behavior in conflict settings, and introduce a novel measurement approach that enables a focus beyond publicly-traded firms. 7 We also build on recent work by Besley and Mueller (2017) who use World Bank enterprise survey data on the costs of protection that firms incur in insecure environments. Consistent with their suggestion that large firms in such contexts will be more susceptible to predation, we find that the negative effects of violence are concentrated among larger firms, though it is unclear if this effect originates from large firms being more affected by violence or more capable of responding.
Regarding industrial organization, Klapper and Richmond (2011) note that research on "the survival of formal firms has important implications for development strategies. In order for the private sector to act as an 'engine of growth' and advance the development process it is necessary for firms to survive and grow." While generally not written in the context of conflict settings, the literature on industrial organization, including in developing countries, can help generate hypotheses regarding the structure of firms in such environments. 8 As Cefis and Marsili (2005) observe, "the growth and survival of firms will depend on their ability to successfully adapt their strategies to changing environments." The behavior of smaller firms is of potential importance to the competitiveness and growth of a nation's economy as well. As Beck et al. (2005) point out, bilateral and multilateral aid agencies have sought to promote the Small and Medium-Sized Enterprise (SME) sector through various programs 7 As a complement to Ciarli et al. (2015), who find higher rates of self-employment in conflict affected areas of Afghanistan using household survey data, we examine the behavior of private firms.
8 For a recent review see Li and Rama (2015). and subsidies in developing countries in order to increase competition and productivity, and generate employment. To date, much of the literature and related policy analysis has emphasized the role of weak institutions, credit constraints and access to information on firm growth in the developing world (Laeven and Woodruff, 2007;De Mel et al., 2008;Jensen and Miller, 2017); insecurity may provide another channel.
We proceed in four sections. In the next section, we briefly review Afghanistan's economic and security background during the period of our data collection. In Section 3, we summarize our data and measurement validation exercises. Section 4 provides our results on insecurity, including the Kunduz case study and the nationwide analysis, and highlights potential mechanisms and adaptation strategies for future exploration. We conclude with recommendations for further research and discuss implications for policymakers.
2 Economy and Security in Afghanistan

Afghanistan's Economy
The World Bank defines Afghanistan as a "deeply fragile and conflict-affected state." From an economic perspective, "GDP per capita is among the lowest in the world, poverty is deep and widespread, and social indicators are still at very low levels" (World Bank, 2016).
Although it was the world's single largest recipient of official development assistance in 2014, Afghanistan's GDP per capita was measured at just $660 that year (IMF, 2014). Growth in Afghanistan has been "rapid and volatile" over the past decade, owing to changes in inflows of development assistance, changes in agricultural prices, and changes in military spending (World Bank, 2016). 9 For a decade following the 2002 removal of the Taliban from power, growth averaged 9.4 percent per annum. These high growth rates would seemingly make Afghanistan a promising 9 For a recent overview of the private sector in Afghanistan drawn from the existing official data and interview sources, see Ghiasy et al. (2015).  Regarding the private sector, "there is little data on investment activity in Afghanistan," a gap this study seeks in part to redress (World Bank, 2015). The Integrated Business Environment Survey (IBES) in 2009 estimated approximately 400,000 firms operating in Afghanistan, in a variety of sectors. The vast majority of these firms (94 percent according to IBES) are small, containing less than 9 employees. However, firms with over 500 employees, which constitute just .17 percent of all firms, support nearly one-third of all industrial employment. The firm size category which contributes the least total employment is SMEs (here between 10-499 employees), suggesting a missing middle in the size distribution.
In sum, the Afghan economy presents a number of puzzles. Despite a long period of near double-digit growth, and massive inflows of foreign aid and military expenditure, the country has not yet found a sustainable growth path and has faced a sharp contraction since 2012. A range of serious challenges related to limited infrastructure, weak institutions, and related issues-all exacerbated by four decades of conflict-continue to impede progress in reducing national poverty levels. Despite the agreement of Afghan and US policymakers on the need for a transition to Afghan leadership in the ongoing counter-insurgency conflict, the process has not been without consequence or controversy. As Figure 1 shows, the five years from 2012-2016 in our security data has marked a steady increase in the number of confirmed fatalities due to the ongoing conflict and a corresponding increase in the number of districts perceived as insecure.

Insecurity in Afghanistan
This recent trend of increasing violence motivates our interest in how the Afghan private sector responds to rising insecurity and further emphasizes the need for novel measurement strategies given the challenging setting for data collection.

Data
In this study, we combine three complementary data sources to achieve a uniquely detailed perspective on the economic behavior of private firms in Afghanistan: administrative mobile phone records, administrative government records, and original firm survey data. Since 2002, mobile phone penetration in Afghanistan has grown rapidly, with four private operators and one public operator serving a total market of over 19.7 million subscribers out of an estimated population of 21.5 million adults (World Bank 2015).

Summary Statistics
As a measure of firm activity, we use anonymized call detail records (CDR) covering April 2013 -August 2016 from the one of the countrys largest mobile network operators. As in prior studies using CDR data (c.f. Blumenstock et al. (2015)), we do not observe the identity of the calling or called parties, nor do we observe the content of their communication. We do observe a record of each call that was initiated, including anonymized identifiers for the calling and called parties, the date and time of the call, and the coordinates of the cell phone tower of the calling party. Unlike prior work, we focus our attention on CDR data of corporate line customers, a subset of subscribers who have signed up for a corporate pricing plan in which multiple phones belong to a single account. We observe the company names of corporate line customers, and screen these to remove public or non-profit organizations, including health, education or media groups, leaving us with a sample of more than 2,300 private organizations covering over 125,000 subscribers active during our 45 months of data from April 2013 to December 2016. These data include 1,350 active cell phone towers distributed across 266 of Afghanistan's 398 districts, which collectively cover over 80% of the population. 11 As shown in Table 1, the average (median) firm is active for 34 (45) months and is observed to operate in 38 (24) districts. While the average firm has 52 subscribers, the median firm has 4, implying a skewed distribution of firm size with a small number of very large firms. The mobile network operator provides coarse sectoral information about firms in the form of an internally recorded "segment." We see that 42% of firms are in either trade or manufacturing, 19% are in construction, 12% are in transportation, with less than 5% in finance, IT or security, and 24% labeled as other.
Firms with corporate phone accounts present in our data may be different from "typical" Afghan firms. While we would like to be able to characterize this selection of firms relative to all others, there is no existing census of firms covering the period of our data. 12 Some administrative datasets do exist for this period, but each have their own limitations for example, official business registration databases simultaneously under-count firms that do not register to evade tax obligations and over-count the registration of "ghost" firms created to pursue contracts. One reasonable benchmark is the World Bank's Enterprise Survey conducted in May-July 2013, which includes a random stratified sample of 416 firms reweighted based on firm size, sector and location strata. In Table A1, we show that on average the firms in our CDR data appear to have twice as many subscribers as the number of employees from firms in the Enterprise Survey sample, that the CDR firms are less likely to appear in trade and manufacturing categories, and that CDR firms are more likely to have their headquarters based in Kabul. We note that firms that register for corporate lines are unlikely to be representative of all firms in the country, particularly small, informal firms operating outside urban areas. Still, larger firms based in major urban areas compose a significant portion of formal employment, and thus may be of particular interest. The non-representativeness of the CDR is an important caveat in interpreting the results that follow.
For our analysis, we aggregate the CDR data to the district-month level. 13 We address potential measurement concerns about mobile network coverage being mechnically correlated with violent events by dropping any district-month that has less than one week of coverage, and we also confirm that our results are robust to dropping any district that ever has a month without coverage. The data aggregation process results in an unbalanced panel of 10,642 district-months, with an average (median) district-month including 81 (41) active firms and 391 (100) active subscribers. We merge this district-month panel with geocoded data from the Global Terrorism Database (GTD) on over 10,000 confirmed fatalities from terrorism in Afghanistan. 14 In Table 1, we show the mean (median) district-month records 1.4 (0) GTD killings, with a maximum value of 246 killings. 15 We also report that 12% of district-months are categorized as insecure in internal security tracking data from a national survey firm. 16 In Figure 2, we conduct a principal component analysis of the three main sources of variation in our district-month panel (log of active firms, active subscribers and calls) and plot the first principal component for April 2013 on a map of Afghanistan's districts. As expected, major urban centers such as Kabul (center-north), Kandahar (south), Hirat (west), Mazar 13 A brief description of the data processing required to complete this task is included in Appendix A1. 14 Maintained by National Consortium for the Study of Terrorism and Responses to Terrorism (START) at the University of Maryland, the GTD database is constructed from keyword filtering of high-quality media sources and hand coded by teams of researchers, including providing geo-coordinates for the city or district an event takes place. Killings include confirmed fatalities of either victims or attackers. Thus, in order to be included in our dataset, a killing must be recorded by a credible media source and meet the GTD coding teams definition of terrorism: "the threatened or actual use of illegal force and violence by a nonstate actor to attain a political, economic, religious, or social goal through fear, coercion, or intimidation." While this introduces the likelihood of under-measuring violent incidents, it increases our confidence that we are focused on meaningful events. 15 The second highest value of 244 killings corresponds to the attack on Kunduz in September 2015 that we discuss in detail below.
16 A coding of insecure indicates the survey firm was unwilling to send enumerators to that district in that month for survey data collection activities.
(north-west), Kunduz (north-west) and Jalalabad (east) are clearly visible. We include red dots at locations of GTD killings from May 2012-April 2013, demonstrating the nationwide geographic distribution of violence that we exploit in the analysis below.

Measurement Validation
A key methodological question in this study is how strong is the correlation between activity in the CDR and more traditional measures of firm activity. We complete three different validation exercises using a combination of official government data sources and original survey data.
First, we validate the physical location of firms against CDR measures in Table A2. For each firm appearing in the CDR, we compute the top one, five and ten "modal districts" by first calculating the most commonly used district in all outgoing calls for each subscriber in each month, and then recording the frequency with which each district appears as the mode for all of the firm's subscribers. 17 In Panel A, we compare these modal districts to the headquarter district locations from two official business registration sources collected in 2016: the Central Business Registry (CBR), where formal firms must register to receive a tax identification number, and the Afghanistan Investment Support Agency (AISA), for firms seeking foreign investment. We successfully name match 934 firms to the CBR dataset and 110 firms to the AISA dataset, and find that 74% (80%) of firm headquarters matched the top modal district and 87% (93%) matched one of the top five modal districts in CBR (AISA).
Using original survey data collected from over 400 firms in spring 2017, we complete a second validation exercise in Panel B where we include self-reported districts of headquarters and other offices in either 2014 or 2017. We find that 67% of 2017 office districts match the top 5 modal towers and that 70% match the top ten modal towers, with similar percentages in 2014.
In sum, these findings increase our confidence in the potential of CDR data to proxy for the physical locations of employees, especially when using spatially and temporally aggregated measures.
Next, we validate the size of firms against CDR measures in Table A3. For each firm, we calculate the number of unique subscribers (phone numbers) active from January-March 2014, where we winsorize the top 1% of values to address large outliers. We then compare these subscriber totals to the total firm employment numbers gathered during April and May 2014 as part of the screening survey for the Central Statistic Office's Integrated Business Enterprise Survey (IBES). 18 We successfully name matched 190 firms to this dataset, and find a robust, positive relationship between these two independent measures of firm size; the cross-sectional correlation is .49 in levels in Column (1) of Panel A (p < .01) and .23 in logs in Column (1) of Panel B (p < .01). We again extend this exercise comparing our original survey data from spring 2017 with the number of unique subscribers in October-December 2016 and three years earlier in October-December 2013, and find a strong cross-sectional correlation between self-reported employees in 2017 of .57 in levels (p < .05) and .23 in logs (p < .01). These results suggest that even when discounting the role of firm outliers, active mobile subscribers may provide useful information about firm size. In general, substantial caution is warranted when using subscribers as a proxy for firm size, given that firms may either maintain more phone lines than employees or alternatively may not provide corporate lines for all of their employees.
Third, we validate aggregate economic activity against CDR measures in Table A4. For each province-month, we calculate the number of total corporate calls, and compare this to province level tax revenue records from the Ministry of Finance's Afghanistan Financial Management Information System (AFMIS). Using currently available data, we have 17 overlapping months for a panel of 34 provinces during 2013 and 2014. We find a positive relationship between calling time and tax revenues: a one standard deviation increase in calls in a province is associated with a .85 standard deviation increase in provincial tax revenues (p <.01). The relationship is robust to controlling for unobserved time-invariant factors: the coefficient and significance is unchanged when adding month fixed effects and remains similar (.70 standard deviations at the 10% level) when also adding province fixed-effects.
Overall, theses validation exercises establish a promising basis for the use of CDR data as a proxy measure of firm activity. Firm location, firm size and aggregate tax revenues are all correlated with CDR based measures, with the validation of firm location measures proving particularly compelling. Limitations notwithstanding, this suggests the potential of this methodological approach, particularly in settings like Afghanistan where reliable data on the temporal or spatial distribution of firm activity is scarce.

Insecurity and Industrial Organization
How does insecurity affect the spatial and temporal organization of firms in Afghanistan?
We take a two-pronged approach to this question using our CDR measures. First, we provide an empirical case study of a shock to local security in Kunduz, Afghanistan's fifth largest city; second, we quantify the effects of violence across the country using a district-month panel fixed effects model. These two complementary approaches allow us to first exploit the uniquely fine-grained features of the CDR data in the context of a high-profile event, and then demonstrate generalizability and examine persistence and heterogeneity of effects.

Kunduz Case Study
To develop our theory of how business responds to violence, and our research design for testing that relationship, we begin with a brief case study. On 28 September 2015, Taliban fighters overran Kunduz city, following a battle that had ebbed and flowed since the previous During the early 2000s, however, conflicts between different ethnic groups continued to fester in Kunduz, as the Pashtuns argued they had been displaced from their land by Tajikled forces (what constitutes an individuals land in Afghanistan remains contested given the weak property rights regime). According to one report, "the justice system in Kunduz is barely functioning and instead the local population prefers to use the informal justice system" (Devlin et al., 2009). Given this background, the Taliban have been able to maintain pressure on Kunduz despite the success of Operation Enduring Freedom in removing them from power in Kabul.
The Taliban renewed their offensive against Kunduz on 24 April 2015 by striking at four districts outside the city. By the end of that week they controlled several major suburbs. In response, the Government of Afghanistan dispatched ANA forces, supported by U.S. fighter jets. Still, throughout the summer the Taliban continued to make gains around the city. On the morning of 28 September, Taliban troops routed the government troops that were holding the city. The following day, the ANA launched a counterattack with support from US special forces and airstrikes. Fierce fighting continued to October 13, with claims and counter-claims about who controlled the city. Nonetheless, on 13 October the Taliban withdrew, citing "the prospect of additional casualties and ammunition expenditure" (Nordland, October 13, 2015).
We exploit the CDR data to demonstrate how subscribers from private firms, along with general mobile phone users, responded to the unexpected Taliban seizure of Kunduz in late-September and October 2015. In Panel A of Figure 3, we plot normalized call volumes for all towers in a 70 km radius of the Kunduz city center over a 24-week period centered on the takeover of the city on September 28 (marked by the black dashed line). We divide calling towers into two categories based on if the tower is located within a 10 km radius of the city center and thus covers urban areas (marked in green), or if the tower is located in a 10-70 km radius and thus covers rural areas and neighboring small cities (marked in orange). 21 We also divide callers based on if they are corporate lines subscribers (dashed line for "private"), or if they are part of the entire population of subscribers (solid line for "all"). These two categorizations result in four combinations, and we normalize each over the 24-weeks by subtracting the mean and dividing by the standard deviation for comparability. 21 Appendix Figure A1 shows a map with the locations of towers in each radius. Figure 3a shows a relatively smooth pre-trend in all four groups leading up to the seizure of Kunduz on September 28th, followed immediately by a sharp fall in the volume of calls originating from towers inside the city (green lines) and a corresponding spike in calls originating from towers outside the city (orange lines). This effect lasts until the city is cleared in mid-October, and suggest some signs of persistence in that the level of activity inside the city returns to a level that is roughly 1 standard deviation lower in November and December 2015 than the previous levels in August and September. 22 While details on casualties during the Battle of Kunduz remain contested, the United Nations reported that at least 848 civilians were killed, and some 100,000 residents had been displaced, though many returned following the Taliban retreat (Mackenzie, December 12, 2015). One concern in interpreting Figure 3a might be that these effects could be driven by an increase in the calling activity of subscribers outside the city as opposed to the physical relocation of subscribers. In Figure 4, we demonstrate that the displacement of calls from inside to outside the city is associated with the movement of subscribers from locations inside the city to locations outside of it, consistent with these journalistic reports. Specifically, we can see that the mass of private line subscribers moves from being primarily located within Kunduz city 1 week prior to the attack, to outside Kunduz city 1 week after the attack, before returning 1 month later.
The Taliban's retreat from Kunduz in October 2015 was tactical, and did not signal a permanent return to security. Sporadic violence occurred over the following year, and in the summer of 2016, a new offensive was launched in several rural districts surrounding the city.
On October 3, 2016, the Taliban claimed to have seized control of Kunduz city's central roundabout, but they were displaced by ANA forces on October 4th and cleared from the city entirely after 10 days on October 12th. In Figure 3b, we demonstrate that the October 22 In Appendix Figures A2 and A3, we show placebo plots for calling activity over the same time period in four other provincial capitals: Kandahar and Lashkar Gah, both located in the more violent southern region of the country, and Hirat and Mazar, located in the west and northwest of the country closer to Kunduz. We do not find evidence of a similar response in any other city when Kunduz is seized, though we do note a secular decline in the activity of subscribers in Hirat and Mazar in November and December, which may be consistent with migration patterns during winter months. 2016 attack, while less severe than the September 2015 attack, resulted in a very similar response with the short-term adjustment of subscribers to areas outside the city.
The business community reported feeling the effects of the Battle of Kunduz starting in the summer of 2015. One news report cited a businessman who "said insecurity, abduction, and looting on gun point were major threats they were facing in Kunduz. Every businessman stopped more investment in Kunduz and waiting to observe future security situation, he remarked" (Hamdard, July 2, 2015). A year after the first takeover attempt, violence continued to affect the business community, as the following October 2016 media report from by leaving the city more quickly than regular users but also returned earlier. The same pattern reappears in Figure 3b with the October 2016 attack, suggesting that the behavior of corporate line subscribers may be a leading indicator of trends by all subscribers. The underlying mechanism for this effect is unclear, and might include more resources for travel, better information on the security situation, or higher risks of being targeted individually. Overall, this micro-level evidence of how one large shock to security affects firm behavior measureable in CDR data motivates our shift to a large panel data analysis.

District-Month Panel Results
Next, we exploit our panel dataset of CDR measures and GTD killings to explore the generalized relationship between local changes in district-level insecurity on firm and employee presence. As our main dependent variables, we construct aggregate totals of the number of active corporate line firms and total of individual corporate subscribers in each districtmonth covered by our CDR data. We convert these into logged values to minimize the impact of extreme outliers and ease interpretation of coefficients in percentage terms. 23 To construct our main independent variable, we first calculate the total number of killings in a district-month and select the top 1% of this distribution (23 or more killings). We then create an indicator variable, Major Violent Event, that equals 1 if 23 or more killings took place in that month in that district; we count 111 such events distributed across 54 districts across the country and appearing in 41 of our 45 months of data.
We begin by estimating the relationship between the count of firms present in a district and recent killings using the following semi-log model: where ln(Y dt ) is the log of total active firms in district d and month t, 1MajorV iolentEvent dt−1 is the indicator variable for 23 or more killings in district d in month t − 1, θ d and δ t are district and month fixed effects, respectively, and γ d * t and µ d * t 2 are district linear and quadratic time trends. Throughout, we cluster our errors, dt , at the district-level. Our coefficient of interest is β, which we interpret as the average treatment effect of a major 23 A subscriber is counted as active if s/he makes at least one call from a tower in that district in that month; a firm is active in that district-month if it has at least one active subscriber. A district-month is included in the panel if it contains at least one week of mobile network coverage. 20 violent event on aggregate firm presence. The identifying assumption here is that killings are independent of economic factors after conditioning on α d , γ t , γ d * t and µ d * t 2 .
Table 2 displays our results. In column 1, we show the raw correlation without fixed effects, which is positive but statistically insignificant. This may be because terrorist killings often take place (and are reported) near urban centers with more economic activity. In column (2) we include district fixed effects to control for differences that are constant within geographical units, and find a significant, negative correlation. In column (3), we add month fixed effects to control for unobserved time trends across our sample like seasonal fighting or migration patterns. The magnitude of our estimated coefficient on violence implies that a major violent event is associated with a 6.4 percent reduction in the number of active firms in the following month. In column (4) we show that the estimated effect attenuates and falls just outside of conventional levels of statistical significance (p = .103).
Next, we turn our attention to the persistence of these effects. In Figure 5, we show the coefficients from the following event study specification of major violent events on log active firms while including three leads and eight lags in addition to district and month fixed effects and district linear and quadratic time trends.
In column (13) of Table 3, we present the corresponding coefficients for the event study.
We see no evidence of a significant pre-trend in the three months prior to a recorded killing.
In the month of the event itself, we find a negative effect of 4.9 percent (p < .1). And in the first month after a major event, we observe the effect grow in magnitude to 6 percent (p < .05), which then persists for up to five months after the event. 24 Six months after the event, the estimates are no longer statistically distinguishable from zero.
In Table 4, we implement a difference in difference specification where we include a post-treatment indicator variable set equal to one in all months after a major violent event. In column (3) we observe that when including district and month fixed effects and district linear and quadratic time trends, a major violent event is associated with a 5.7 percent reduction in number of active firms in a district.
One concern about this result would be if firms that experience violent events are generally more violent and thus more likely to have experienced other major events or are more likely to experience additional major events in the future. If either of these are the case, the estimates in column (3) may not reflect the response to a discrete change in security. To address the concern of previous major violent events, we exclude 30 "pre-treated" districts from the sample who experienced what would have been a major event in the months for which we have violence data but before the CDR data begin in April 2013. Column (4) shows that the estimated effect increases in magnitude to 8.6 percent when excluding "pretreated" districts. The second concern would be that responses to future violent events are being attributed to the response to the first violent event that we observe (and around which we build our difference in difference treatment). In columns (5) and (6) we address this concern by using the number of major violent events as our independent variable. The magnitudes remain almost identical to those estimated in columns (3) and (4). Table 5 explores heterogeneity in our main effects based on firm size to provide insights into which types of firms are most affected by violence. Given our unit of observation is a district-month, for size heterogeneity we calculate separate subtotals for the relevant subsample of firms across the panel of 10,642 district-months. Specifically, we divide our firms into two groups based on the total number of unique subscribers in a firm: firms with 1-4 subscribers and firms with 5 or more subscribers (4 is the median firm size in our data).
In columns (3) and (6) we find evidence that our negative effects are concentrated primarily in the sample of larger firms.
To begin exploring mechanisms behind our results, Table 6 summarizes survey data from a subsample of over 450 firms that shows that larger firms are significantly more likely 22 to report business disruptions from anti-government groups and to adapt their business practices in response to such experiences. For this analysis, we divide our sample into above and below the median number of current employees (12 in our data), and refer to those above the median as "large firms" and those below the median as "small firms." In Panel A, nearly four out of five firms are likely to report being adversely affected by antigovernment group activity during the past three years, with large firms are 9 percentage points more likely to do so (p = .02). Large firms also report significantly higher likelihoods of employees being threatened, injured, or killed, and firm assets being threatened or critical public infrastructure destroyed. In Panel B, we find that large firms are also more likely to report taking steps to respond to government violence, including being 26 percentage points more likely to invest in private security (p < .01), 24 percentage points more likely to make protection payments (p < .01), and significantly more likely to take additional steps including relocating staff from a district or stopping operations permanently. While not causal evidence of the role of firm size, this correspondence between self-reported behavior in the survey data and the patterns in the administrative data from Table 5 suggests large firms respond differentially more to insecurity.

Discussion
We use a novel data source, corporate cell phone account records, to test the hypothesis that firms and employees operating in conflict-affected settings respond to increased local insecurity by decreasing their local presence. Using our GTD measure of major violent events in which 23 or more media-confirmed fatalities from terrorism were recorded, we find the number of active firms decreases by approximately 5-6% in the next month, and that these effects can persist at similar magnitudes for up to six months.
We find evidence that our effects are concentrated in large firms as proxied by number of unique subscribers; a result consistent with existing work suggesting that large firms are more vulnerable to predation. Theoretically, the direction of heterogeneity by size is am-biguous and potentially non-linear, with large firms more able to privatize their own security provision (and thus become resilient to insecurity) and better equipped to adjust their areas of operation, but also more exposed to risks associated with their level of investment and public profile.
Three key questions arise at this time, which we are pursuing in ongoing work. First, when do the effects we observe constitute a temporary displacement of firm activity versus a permanent change in where some firms will operate? Second, what additional insight can be gained on the mechanisms behind the firm-level responses we find here? Rising insecurity may signal substantive increases in the fixed and variable costs of operating a business, including disruptions to the labor supply, threats to capital investments, new operating costs from private security provision and various forms of predation, as well as decreases in demand from local and international buyers. To develop more effective business and policy responses, it is crucial to better understand the relative importance of such channels, as well as the understudied role of perceptions of insecurity as distinct from observed realities.
Third, how are firms adapting to persistent insecurity, which at this stage has lasted years if not decades. For example, are they more likely to privatize their security provision (which may only make sense given a certain scale of operations), or to restrict growth and attempt to "fly under the radar" to mitigate risk to property and self, and which approaches are associated with greater firm survival?

Conclusion
To our knowledge, ours is the first study to use call detail records of mobile phone subscribers to understand firm behavior in a conflict-affected country, or indeed in any developing country. From a methodological standpoint, the validation exercises in this study suggest the promise of this approach -not as a substitute to the crucial work of collecting survey and administrative data on firms in such settings, but as a complement, particularly in fragile states where collecting firm-level data may prove challenging. By using CDR, researchers, businesses and policymakers can extend the temporal and spatial fidelity of traditional data sources at low cost. The application of CDR data to examine micro-level responses to the takeover of Kunduz by Taliban insurgents in September-October 2015 also increases our confidence that these data contain information that can expand our understanding of the relationship between conflict and economic activity, as we demonstrate in our district-month panel results.
We contrast our findings with those of Besley and Mueller (2012), who estimate the peace dividend using increases in housing prices in Northern Ireland at the end of The Troubles.
The internal logic of their setting is a virtuous cycle of decreased killings, leading to increased asset values, which in turn motivates increasing public investment in security. Tragically, like many other conflicts in developing economies, Afghanistan suffers from a vicious cycle in which increases in killings lead to decreases in economic activity, which in turn undermine state capacity to deliver security and public perceptions that the situation will improve. In the case of Kunduz, public perceptions about the long-term ability of the government to protect the city may have been at least as important in explaining firm behavior as realities on the ground. In future work, we plan to more deeply explore the gap between security perceptions and realities, and the corresponding implications for business and public policy in insecure settings like Afghanistan.
Based on our research to date, we note three potential implications for policymakers to consider from this work, all of which deserve further consideration. First, given scarce resources for the provision of security, a potential tradeoff exists between providing security in urban areas where economic activity is concentrated and in rural areas where the insurgency maintains its strongholds. While both objectives are clearly important, most economic activity occurs in cities, so failing to secure the urban cores could have grave consequences for long-term development. Second, the costs of security provision raise costs for firms, with potential consequences for industrial organization and the size distribution of enterprises. If, for example, the cost of security raises barriers to entry, then this could have competitive effects that influence the long-run trajectory of private sector development and, eventually, economic growth. Clearly, understanding the longer-term consequences of conflict on firm structure and growth deserves further research and policy analysis. Third, given the nexus between economic activity and security that we (among others) have established, it is worth examining how donor support to private sector development can be most effective in conflict settings. For example, policy efforts aimed at improving institutions, relieving credit constraints and promoting access to information have featured in many bilateral and multilateral attempts to bolster the local private sector. Our research suggests that these policies must be nested within a context of security provision if they are to have their greatest impact.
More generally, academics and policy-makers need to improve their understanding of how and where economic life evolves in the absence of generalized security, and the conditions under which targeted efforts to support the private sector might break a vicious cycle and reinforce the incentives for the public provision of security.

Response of Log Active Firms to Major Violent Events
Notes: Coefficients from regression of Log Active Firms on 3 leads and 8 lags of Major Violent Event (=1) with district and month fixed effects and district linear and quadratic time trends. 90% confidence intervals shown. See text for details.             (3) and (4). The top 1% of Total Subscribers values has been winsorized in all columns.

A1 CDR Data Appendix
Our study relies on data from one of Afghanistan's largest private telecommunications operators. The original data contain three different types of information that are used in our empirical analysis. These data do not contain the contents of phone calls and text messages, but rather the metadata about calls and text messages -i.e., information regarding the parties involved in the communication, as well as the timing and location of the communication.
As this data is sensitive and confidential, all personally identifying information was removed prior to our analysis. All research was reviewed and approved by the internal review boards at our respective institutions.

A1.1 Three Different Data Sources
Call Corporate Subscribers The final related dataset is the list of corporate phones. For each month the provider lists which phone id's are registered as business phones, and provides basic information on the firm. From this list, we exclude public and non-profit organizations, such as health, education or media groups, and in case an organization possesses multiple accounts, we merge these into a single one. We refer to these private sector numbers as "corporate subscribers".
As phone numbers occasionally move between different accounts, we disregard numbers that are assigned to multiple business accounts, do not have valid account id, or have other irregularities (this amounts to approximately 0.5% of the business phones). Over the observation period, slightly less than 200,000 phones belong to private organizations out of approximately 10 million distinct numbers in the data. This information allows us to distinguish between general call activity and business-related activity. It also permits to assess the size of the firms (in terms of corporate phones), and their geographic and temporal activity patterns. We further categorize the firms into industry-related "segments" based on the operator's internal categorization. The segments are construction (con), finance (fin), IT and telecommunication (it), manufacturing and trade (trade), security (sec), transportation (trans), and "other". Note that we cannot use the standard ISIC codes because the operator's internal classification is based on a different categorization.

A1.2.1 Constructing Panel Data
Our central empirical approach relies on monthly panel data on firm activity by Afghanistan districts, and on similar panels defined on quarters, weeks, and provinces. We count all calls and distinct active subscribers by each firm in each spatio-temporal cell. Based on whether the firm was active in the given cell, we also define it's binary "activity" in the cell.
As expected, activity distributions by firms show a prominent right tail while the activity is rougly constant in time. The median value of firm size (subscribers it posesses) is 4, while it's mean is 52.25 and the maximum value is 10686.
For district-based approach, we further aggregate the firm level data on districts, separately counting for call activity for different activity segments and firm size classes. This forms our base data to describe firm activity. Again, the distributions are highly skewed with Kabul region clearly dominating the the spatial picture but the other major cities are also clearly present.

A1.2.2 Tower-Level Data
In order to analyze short-term responses to particular events (such as the Battle of Kunduz), we count the total number of daily calls per network tower. We compute two separate sets of values: one for all calls (including non-corporate subscriber calls) for analyzing the general population behavior, and the other for corporate subscriber calls, to see if there are any distinct differences between business and general behavior. We do not select non-corporate subscribers for the figure for two reasons. First, as the number of corporate subscribers is only 2% of the total subscribers in the data, it makes only a little difference; and second, presumably a substantial number of phones that are primarily used for business purposes are not registered as such. While we have no information on private use of registered business phones but during quickly evolving disruptive events, like the Battle of Kunduz, private usage may even dominate.

A1.2.3 Individual Locations
We use location of individual firms and towers for two purposes. First, in case of validating the location of firm's headquarters and regional offices, we calculate the modal district (in terms of calls made) of each phone associated with the given firm. We then order the resulting districts by the number of phones in each, and compare the top 5 districts to the recorded locations of headquarters and regional offices in other administrative and survey data sources. Second, for the Kunduz empirical case analysis we also use an approximation of individual subscriber locations. We compute centroid of cellphone towers where the phone is active during the day-of-interest, while weighting the tower locations by the number of calls by the phone through that respective tower.  All phones include all phones, including corporate subscribers. The center is defined as the centroid of the towers in the corresponding district (in practice it locates the center into the major city). The usage is normalized with respect to the mean and standard deviation of the corresponding time series. The normalization is performed over 12-week window. -the day of attack which occured early morning; c) one week after the attack (during the ongoing battle); and e) 1 month after the attack when Taliban had retreated from the city.

A1.3 Figure Explanations
In all, there are 6727 phones active in the region between August 15th and November 15th, 53 2015, but on a given day the number is lower. The centroid is average of the location of the towers the phone has made at least one call, weighted by the number of calls in these towers. Figure A1: Mobile Tower Locations near Kunduz The maps of the towers for the corresponding usage graphs. Towers up to 10km from the center are green, 10-70km orange, same colors as used on the usage graphs. The center is defined as the centroid of the towers in the corresponding district (in practice it locates the center into the major city).