Classic and modern theories of rebel warfare emphasize the role of unexpected attacks against better equipped government forces. We test implications of a model of combat and information-gathering using highly detailed data about Afghan rebel attacks, insurgent-led spy networks, and counterinsurgent operations. Timing of rebel operations responds to changes in the group’s access to resources, and main effects are significantly enhanced in areas where rebels have the capacity to spy on and infiltrate military installations. Results are supplemented with numerous robustness checks as well as a novel IV approach that uses machine learning and high frequency data on local agronomic inputs. Consistent with the model, shocks to labor scarcity and government surveillance operations have the opposite effect on attack timing. In addition, we investigate the impact of attack timing on battlefield effectiveness and find that it reduces soldier efficiency during missions to ‘find and clear’ roadside bombs and increases bomb-related casualties to government troops.