Terrorism on the Teardrop Island: Understanding the Easter 2019 Attacks in Sri Lanka

In the space of 20 minutes from 8:45 AM local time on Easter Sunday April 21, 2019, in Sri Lanka, there were a series of seven coordinated suicide bomb attacks in popular hotels and historical churches across the capital city of Colombo, other coastal cities in the west, and towns in the east of the country, killing hundreds as they gathered for Easter. Hundreds more were injured.¹ The bombers’ devices were packed with iron nails, ball bearings, and TATP, an explosive previously used in Islamic State terrorist attacks in Paris and Brussels.²

Among the attackers, who were all Sri Lankan and who communicated via an encrypted messenger service,³ was the cell’s suspected leader, Zahran Hashim, a 34-year-old radical preacher who, according to Sri Lankan police, was one of two suicide bombers who blew themselves up at the Shangri-La hotel. (See Table 1.) The other bomber at the Shangri-La was identified by Sri Lankan officials as Ilham Ibrahim,⁴ the 31-year-old son of one of Sri Lanka’s richest spice traders.⁵ He is believed to have been a driving force behind the organization of the attacks.⁶ Ilham’s elder brother Inshaf Ibrahim, whose father had set him up with a copper pipe factory, blew himself up at the Cinnamon Grand hotel.⁷ Some investigators believe their wealth possibly financed the entire plot.⁸ In Negombo, 20 miles north of the capital, Achchi Muhammadu Mohamed Hasthun, who is suspected of being one of the bomb makers, detonated his suicide device at St. Sebastian’s Church.^a

Around five hours later, another bomb went off at a hotel in the Colombo suburb of Dehiwala, killing two. The bomber was named as Abdul Lathief Jameel Mohamed,⁹ who studied for a time in Australia and the United Kingdom before returning to Sri Lanka.¹⁰ His original target was apparently the five-star Taj Samudra hotel in Colombo, but it appears that after his bomb failed to detonate, he made his way 10 miles south of the center of Colombo to a guesthouse in Dehiwela.¹¹ He checked in around 9:30 AM, likely visited a nearby mosque, and then returned to the guesthouse several hours later. At 1:20 PM, the bomb went off, perhaps as he was trying to fix whatever had malfunctioned.¹²

At 2:25 PM, the eighth explosion occurred at a housing complex in the Colombo suburb of Dematagoda after the Special Task Force (STF) stormed the premises. According to Sri Lankan police, Fatima Ibrahim, the wife of Inshaf Ibrahim (the Cinnamon Grand bomber), blew herself up, killing three STF officers. The blast also killed her three young sons, as well as herself and her unborn child.¹³

More than 250 were killed in the Easter attacks, making it one of the deadliest terrorist atrocities ever anywhere.¹⁴ There was a sense of shock in Sri Lanka and around the world compounded by the fact that the attacks had seemed to come out of the blue. While Sri Lanka had suffered acutely from terrorist incidents until the military defeat of the Tamil Tigers in 2009, the country had had no history of deadly jihadi violence. The day after the attack, though, some Sri Lankan politicians admitted that there were precise warnings given by Indian intelligence several times in early April 2019, which were either ignored or failed to land on the desk of appropriate individuals in government. The warnings were precise enough to not only name Zahran Hashim but also noted that he was planning to attack “popular Catholic Churches and the Indian High Commission.”¹⁵ This lapse in security is an ongoing point of debate and controversy as the country moves toward its presidential election in late 2019.

Two days later, the Islamic State claimed the attacks via its Amaq news agency, stating the attackers were “Islamic State fighters” and had “targeted citizens of coalition states and Christians in Sri Lanka.”¹⁶ The group quickly followed up with a statement in which it provided the purported kunya (fighting name) of seven attackers and the locations of their attacks.¹⁷ (See Table 1.) Then came a release of a picture of the attackers standing in a row¹⁸ and a 59-second video release (see Figure 1) from the Islamic State purporting to show the attack cell pledging allegiance to Islamic State leader Abu Bakr al-Baghdadi.¹⁹ Eight individuals rather than seven were shown in the picture and video,^b with the suspected ringleader Zahran Hashim identified by Sri Lankan investigators as standing at the center of the group because he was the only one not wearing a mask.²⁰ (See Figure 1.)

In its communiques, the Islamic State named the Dematagoda bomber as “Abu Abdullah”²¹—an unknown male—and failed to mention the presence of Fatima Ibrahim.²² Reuters reported that according to “a source close to the family,” it was Ilham Ibrahim who detonated the bomb that killed his wife and his children. This contradicted the official Sri Lankan version of events but meshed with the Islamic State version, as the group did not provide a kunya for a second bomber at the Shangri-La hotel.²³ (See Table 1.) Given The New York Times reported that “CCTV footage from the Shangri-La shows Ilham stepping into the elevator and later into the Table One restaurant with another man who has now been identified as Zaharan Hashim,”²⁴ it seems likely the Islamic State made a mistake in its official releases.^c

One thing is clear. The Islamic State, after losing all its territory in Syria and Iraq, viewed the Sri Lanka attacks as a significant breakthrough in its attempts to reset the narrative about its decline. On April 29, 2019, the Islamic State released a video of Abu Bakr al-Baghdadi in which he presented the Easter attacks as vengeance for the Islamic State’s March 2019 defeat in Baghuz (the last territory the group held in Syria) and thanked the attackers for their pledge of allegiance.^d

Table 1. Real names of attackers and location of attacks in comparison with the kunyas of the attackers at each location provided by the Islamic State. The details on timings are taken from a Criminal Investigation Department (CID) document dated May 7, 2019, obtained by the author. 

Time	Place of attack	Real name of attacker(s) (according to authorities)	Kunyas corresponding to location of attacker(s) given in Islamic State releases
8:45 AM	Shrine of St. Anthony Church (Colombo)	Alwudeen Ahamed Muaath	Abu Hamzah al-Ceyloni
8:47 AM	Kingsbury hotel (Colombo)	Mohamed Azaam Mohamed Mubarak	Abu Mukhtar al-Ceyloni
8:47 AM	St.Sebastian’s Church (Negombo)	Achchi Mohammdu Mohammadu Hasthun	Abu Khalil al-Ceyloni
8:54 AM	Shangri-La hotel (Colombo)	Zahran Hashim; Ilham Ibrahim	Abu Ubaydah al-Ceyloni (referring to Zahran Hashim)
9:00 AM	Cinnamon Grand hotel (Colombo)	Inshaf Ibrahim	Abu al-Bara
9:05 AM	Zion Church (Batticaloa)	Mohamad Nazar Mohamed Aazath	Abu Mohammed al-Ceyloni
1:20 PM	Tropical Inn Guesthouse (Dehiwala suburb of Colombo)	Abdul Lathief Jameel Mohamed	No mention by Islamic State
2:25 PM	Dematagoda Housing complex (Colombo suburb)	Fatima Ibrahim (wife of Ilham Ibrahim)	Abu Abdullah (no mention of a female suicide bomber)

 

With the investigation still in its early stages, much remains unknown about the genesis of the Sri Lanka attacks. According to an internal report on the attacks written by the Criminal Investigation Department (CID), dated May 7, 2019, and given to the author by a local journalist, investigators have taken 56 people into custody. As the report states, “they are being currently grilled at the CID.” Interestingly, the CID report also states that an individual named Mohamed Ibrahim Mohamed Naufer is among those currently in custody and that he is thought “to have been appointed to succeed the leader of the group who perished during the suicide attack at Shangri-La hotel.”²⁵

This article, based on a thorough mining of open-source and media reports on the attack as well as several interviews with religious leaders and activists in the affected areas, attempts to outline what is known so far about the terrorist network that carried out the attack and its links to the Islamic State, and what it might say about the Islamic State’s shifting strategies outside of Syria and Iraq after the fall of the so-called caliphate. Before delving into the terrorist network itself, though, it is important to briefly unpack the history of anti-Muslim violence in Sri Lanka and the broader context of ethno-religious relations that formed the backdrop to the attack and that will inevitably color what happens next on the island.²⁶

Anti-Muslim Violence and the Historical Context of the Easter Attacks
In order to fully grasp the Easter Sunday bombings in Sri Lanka and the radicalization of individuals like Zahran Hashim—the purported mastermind of the attacks—it is necessary to briefly unpack the broader context of anti-Muslim violence in the country, going back as far as the riots of 1915.²⁷ Particularly since independence from the British in 1948, anti-Muslim sentiment in Sri Lanka has not been colored by some of the kind of animus seen in the Western world. It is not a discussion, for example, about how Muslims hate democracy or how Islam is antithetical to Western liberalism. Rather, in Sri Lanka, the place of the Muslim community has existed between competing nationalisms—Tamil and Sinhalese—and the purging of Muslim identity has been used to establish the “purity” of either the sought-after independent Tamil state or the majoritarian Sinhala state.²⁸

Muslims, even dating back to the 19th century, have been seen by some in the Sinhalese community as having “entered the country as invaders” and lacking indigenous origin. The Tamil community, for its part, has sometimes sought to label the Muslims as ethnically, culturally, and linguistically Tamil, only to have Muslim leaders disagree and point to “their Arab origins as a means to gain separate Muslim representation in the political sphere.”²⁹ In a country where demographic positionality is intricately linked to political opportunity, ethnic and religious identities become deeply contentious.³⁰ The Muslim community in Sri Lanka itself is profoundly religiously diverse, existing across a wide spectrum of religious interpretation—from Sufi to salafi—and also divided across socio-economic and rural/urban divides.³¹

As the military conflict between the LTTE and the Sri Lankan government heated up in the late 1980s, the Muslim community in the northern and eastern provinces of Sri Lanka—which constituted the separate state envisioned by the Tigers—came under suspicion. In the Northern Province, the LTTE argued that there were too many spies in the Muslim community and that they posed a security threat. In the Eastern Province, the LTTE and the Tamil community generally faced violence at the hands of Muslim “home guards,” a civil defense force mobilized by the Sri Lankan government to protect the “borders” between areas of LTTE and government control.³² Based on both of these reasons, the LTTE launched a merciless campaign against the Muslim community, the effects of which are still being felt today.

On August 3, 1990, the LTTE massacred 140 Muslims praying at a mosque in Kattankudy and, nine days later, killed another 122 Muslims at a mosque in Eravur, both in the Eastern Province. The bullet holes remain in the walls of the mosques almost 30 years later, “left there, performing as markers of Muslim vulnerability.”³³ Then in October 1990, the LTTE, in the span of two weeks, forcibly expelled close to 75,000 Muslims from the Northern Province without any of their belongings.³⁴ As Sharika Thiranagama writes, “Muslims are the absent but pregnant emptiness in the heart of Tamil nationalism. The north, easily assumed to be a mono-ethnic Tamil space, was only created as such after … the expulsion of Muslims.”³⁵ As a former leader in the LTTE similarly told this author, “millionaires became paupers overnight. And these are people who had only known Jaffna. Born in Jaffna, lived in Jaffna. What the LTTE did was very wrong.”³⁶

Over 20 years later, with the war in Sri Lanka between the LTTE and the Sri Lankan government over, the Muslims would once again become victims to another nationalism. This time, Sinhala-Buddhist extremist groups, like the Bodu Bala Sena (BBS) and its supporters, aided by social media conspiratorialism, turned on the Muslim community and began to see them as demographic and economic threats to the Sinhalese community, resulting in several years of sporadic riots, destruction of mosques, and killings.

In September 2011, a 300-year-old Muslim shrine in Anuradhapura was destroyed by a mob of 100 people, led by Buddhist religious leaders, who argued that the shrine was “on land given to Sinhala Buddhists 2000 years ago.”³⁷ In April 2012, thousands of people forcibly entered a mosque in Dambulla and destroyed everything inside. The then Prime Minister, to the shock of many, ordered that the mosque be moved to another part of town since the area it was currently located was considered “sacred to Buddhists.”³⁸ These attacks against the Muslim community by the BBS escalated in subsequent years and peaked around two events in 2014 and 2018. These events, interviews conducted by the author suggest, were important in radicalizing some young men in the country.³⁹

In June 2014, the towns of Aluthgama, Dharga Town, Valipanna, and Beruwela—cities on the southwestern coast of Sri Lanka—saw several days of communal violence.⁴⁰ The violence seems to have been sparked by a local altercation between three Muslim youth and a Buddhist monk. As the situation grew tense, meetings between the police and religious leaders were convened to try and establish calm. On June 15, 2014, the BBS held a meeting in Aluthgama laced with racism, hate speech, and suggestions of violence. Crowds streamed out of the meeting and started confronting Muslims they saw on the streets. Both sides started to throw stones. Violence began in surrounding villages as well, and several businesses and homes where attacked and burned. The result is that to this day the relationship between the Sinhalese and Muslim communities in Aluthgama remains strained.⁴¹

While the role of social media in spreading misinformation and conspiracy theories in Sri Lanka, which often spurred on this kind of communal violence, has been well documented,⁴² platforms like Facebook and WhatsApp played a particularly destructive role in subsequent violent episodes in the country.⁴³ Bizarre rumors have long existed online and have played into Sinhala nationalist fears of losing their majority status on the island. The 2013 violence against Muslim-owned businesses like Fashion Bug, for instance, were spurred on by rumors that Muslims were selling Sinhalese women underwear laced with sterilization cream.⁴⁴ A similar rumor in late February 2018 would lead to another major episode of anti-Muslim violence in Sri Lanka, one that, some locals say, had a particularly strong impact on Zahran Hashim, the mastermind of the Easter attacks.⁴⁵

In late February 2018, an altercation started in Ampara, a small town in the Eastern province, when a Sinhala patron began berating a Muslim restaurant owner about something he found in his meal.⁴⁶ Prior to this encounter, conspiracy theories had been circulating on Facebook that 23,000 sterilization pills had been seized from a Muslim pharmacist. The viral rumor seemed to confirm long-running fears among some in the Sinhalese community that Muslims were secretly plotting to demographically supplant them in the country. In a shaky cell phone video, the customer yells at the store owner in Sinhala, “You put in sterilization medicine, didn’t you?” The store owner, who does not understand Sinhala, just nods in agreement to the questions being shouted at him.⁴⁷ The crowd that had gathered then beat the store owner and set fire to a nearby mosque. As Amanda Taub and Max Fisher rightly point out, “in an earlier time, this might have ended in Ampara,” but as the cellphone video was posted to Facebook and spread, communal tensions started to simmer.⁴⁸

The anger around the sterilization rumors would converge with the death of a Sinhalese man, who had been beaten by several Muslim youth after a traffic dispute, in Kandy on March 3, 2018. The violence began in Kandy and surrounding areas on March 4 and would finally cease on March 9, 2018. At the end of the violence, two people lay dead and around 20 mosques, 224 houses, and 119 businesses were either damaged or destroyed.⁴⁹ The government, like it would after the Easter bombings, temporarily blocked social media platforms in order to prevent further attack planning and spreading of disinformation.⁵⁰

The Muslim community in Sri Lanka, which had been facing waves of anti-Muslim violence since the end of the war against the LTTE in 2009, rarely put up any coordinated resistance, but researchers who have conducted fieldwork in these communities note that Muslims were worried this was just going to continue indefinitely, whenever it was politically expedient to rile up the Sinhala nationalist base—and they would eventually need to stand up for themselves.⁵¹ Given the level of anti-Muslim violence, though, it is perhaps surprising that the country did not witness some level of militant Islamist—let alone jihadi—mobilization in all these years. While reports suggest that around 32 individuals left Sri Lanka to join the Islamic State since 2013, there has been no evidence of local plots in Sri Lanka until 2019.⁵²

The Tawheed Movement in Sri Lanka
A few days after the Easter 2019 attacks, the author phoned a contact—who he will call Riyaz—in the Ceylon Tawheed Jamaat (CTJ) to get a sense of how the Muslim community was feeling and what was known locally about Zahran Hashim, the purported mastermind of the Easter attacks, and the organization he had started, the National Tawheed Jamaat (NTJ). “They have taken away the peace and freedom of the Muslims,” Riyaz told the author. “The trust others had in Muslims, the relationship of a 1,000 years has been taken away in a single day.”⁵³ Riyaz spoke eloquently in Tamil about the history of the Tawheed Jamaat movement in Sri Lanka and the way in which the various organizations under the tawheed (oneness, in Islam) label sought to unify Muslims in Sri Lanka and re-educate worshippers on the foundations of the faith.

The earliest Tawheed organizations in Sri Lanka—largely salafi in outlook—date back to the mid-1950s. They started to preach to communities, but also began to provide social services. The funding started to come in from the Saudi Arabian government and other donors locally and abroad.⁵⁴ As money started to roll in, divisions also started within these early organizations. As Riyaz says, “it’s because they didn’t focus on the religion that other organizations, with different names, started cropping up.” One of these was the All Ceylon Tawheed Jamaat (ACTJ), which was created in 1998.⁵⁵ More disagreements about funding sources and overall direction led to the formation in 2005 of the Sri Lankan Tawheed Jamaat (SLTJ).⁵⁶ As Riyaz told the author, “the decision we made is that we will not take any funding from foreign organizations or foreign governments. We will only work with the financial support of the Sri Lankan people.” The SLTJ, though, formed a partnership with its counterpart in the Indian province of Tamil Nadu and worked closely with them.

It is around this time that Zahran Hashim was finishing his theological studies at Jamiathul Falah Arabic College in Kattankudy, a traditional madrassa in Sri Lanka established in 1955.⁵⁷ Upon leaving the madrassa, Zahran along with some people he knew in Kattankudy founded an organization called Darul Athar (the abode of tradition) in 2007.⁵⁸ This organization, according to locals, had nothing to do with the SLTJ, and they often disagreed with each other on various theological issues. In 2012, some members of Darul Athar called Zahran in for an “investigation” into his thinking and religious beliefs. After failing to assuage their doubts and concerns, Darul Athar decided to ban him from the organization. Zahran then, in 2012, created the National Tawheed Jamaat (NTJ).⁵⁹

What is clear from the above, then, is that while there were some fears of extremist preachers and some sense that segments of the community were becoming conservative, the idea that some in the Muslim community would mobilize, or had mobilized, to the extent of carrying out attacks was simply not conceivable.⁶⁰

The Radicalization of Zahran Hashim
The National Tawheed Jamaat, according to Riyaz, began simply as an organization made up of Zahran Hashim and his close and extended family.⁶¹ In the beginning, the NTJ also sought to preach and provide social services to the community. There was no immediate concern among those in Kattankudy that Zahran was radicalizing young people or was planning an attack locally.⁶² Locals thought his beliefs were a bit unorthodox, and becoming extreme, but did not consider Zahran to be a security threat.⁶³ As Riyaz told the author, for reasons that remain unclear, Zahran’s beliefs started to become more extreme after 2016. His talks were increasingly supportive of global jihad and suicide bombings, and his online videos became more popular.

Around this time, Zahran also came into conflict with the SLTJ. The two organizations were planning to organize a public debate around religious ethics and theological disagreements that existed between them.⁶⁴ Zahran refused to take part unless he was given all the topics and questions beforehand.⁶⁵ Some members of the SLTJ, during this period, had tipped off Sri Lankan intelligence that Zahran was preaching extreme messages and that he was someone the government should watch closely.⁶⁶ What happened next shocked Riyaz: “I got a call soon after from Zahran’s followers asking me if I provided information about Zahran to intelligence. You see how they function? We pass on information for the good of the country, and it comes back to bite us. Zahran was furious with us after that.”⁶⁷

Starting in late 2016, Zahran’s public speeches were more and more openly extreme and supportive of the Islamic State.⁶⁸ Sometime in January or February 2017, Zahran rented out a public space in Kattankudy and gave a controversial speech, for over 90 minutes, fully in support of the Islamic State and urging Sri Lankan Muslims to support the Islamic State in Syria. As one community activist told the author, “it was a full house. Everyone was there, including law enforcement and Sri Lankan government intelligence officials. Everyone came.”⁶⁹ The community in Kattankudy responded by staging its own event on February 3, 2017.⁷⁰ (See Figure 2.) The flyer for the event reads: “A conference to raise awareness about the terrorist group ISIS, that terrorizes the world.” In hindsight, and based on interviews by the author, it is astonishing just how early Zahran’s pro-Islamic State talks began, how swift and punishing the community response was, and how little law enforcement agencies had paid attention to what the community was telling them.⁷¹ Indeed, a recent New York Times report quotes former Sri Lankan army chief Daya Ratnayake, stating that the Muslim community had sounded the alarm a few years ago and had been told to try to bring the radicals back in the mainstream and not “isolate them.”⁷²

One of the pivotal events that precipitated Zahran Hashim’s radicalization to violence, happened on March 10, 2017, in direct response to the community backlash he began to receive after his public pro-Islamic State preaching.⁷³ There had at times been historical tensions between Sufi practice, particularly dargah (shrine) worship, and more conservative salafi beliefs in Sri Lanka, which occasionally resulted in violence and persecution of Sufi communities.⁷⁴ On March 10, 2017, Zahran organized another public meeting near the Badhriyyah Jummah mosque of Sufi Moulavi (scholar) Abdul Rauf. According to Abdul Rauf’s supporters, Zahran and his entourage did not show up simply to debate, but had brought swords, rods, and petrol bombs.⁷⁵ A fight erupted, which became known as the Aliyar junction clash, and police arrived on the scene. Several NTJ members, including Zahran’s father and brother, were arrested.⁷⁶ Zahran and his other brother Rilwan, who would later be seen in an Islamic State photo with an injury to his eye and missing several fingers, managed to escape.⁷⁷ Rumors began to circulate that they had fled to the Maldives, which the Maldivian government has rejected,⁷⁸ or to Tamil Nadu. Sri Lankan police put out a warrant for Zahran’s immediate arrest.⁷⁹ It is also possible, some say, based on the videos he continued to release while in hiding that he was still in Sri Lanka for the most part.⁸⁰ One of the videos released by Zahran during his time in hiding argued that he would never surrender to police because he only recognizes the laws of Allah, not the Sri Lankan state.⁸¹ A report in The Wall Street Journal suggested that during this period of hiding, Zahran may, in India, have made contact with veteran Islamic State fighters.⁸²

Other members of the NTJ, who had become worried about Zahran’s pro-Islamic State stance and the violence he was arousing, decided, upon his disappearance, to ban him from the organization.⁸³ This letter by the NTJ to Zahran, sent to the author by several local journalists, is dated December 29, 2017, and reads:

Over many years, our (NTJ) Jamath’s campaigner, a person who held many responsibilities in our organization, Moulavi MCM Zahran,^e for some months has been conducting activities unrelated to our Jamath, and against our religious laws. Our organization has irrevocably decided to relieve Moulavi MCM Zahran of all responsibilities related to the Jamath. Therefore, we would like to state that the Jamath is not responsible for any of the actions and opinions of Moulavi MCM Zahran.^f

The Muslim community in Kattankudy carried on as normal, assuming Zahran and his associates had permanently gone into hiding. Then, the March 2018 Kandy riots took place. Zahran Hashim released a video that same month in which he called for the killing of non-Muslims in Sri Lanka, argued that police officers should be attacked, and that bombs should be set off all over the country.⁸⁴ Shocked, Riyaz and other members of Muslim organizations handed over the video to Sri Lankan police.⁸⁵

Early Warning Signs of a Terrorist Cell
In subsequent months in Kattankudy and nearby cities, a variety of seemingly disconnected events started to occur, which have been—only in hindsight and through law enforcement investigation, as illustrated below—linked to Zahran and his close associates. The first was a brutal killing of two police officers in Vavunathivu, a town near Batticaloa in the Eastern Province, on November 30, 2018. One of the officers was stabbed 25 times in the chest and head before being wrestled to the ground and shot dead.⁸⁶ The other officer was also stabbed numerous times before being shot to death at close range. The guns used in the killings belonged to the two police officers themselves and had gone missing after the brutal murders.⁸⁷ Law enforcement officials had initially blamed Tamil Tiger supporters for the murders and two former LTTE cadres were arrested.⁸⁸ The true perpetrators of the attack would remain a mystery until after the Easter attacks (see below).

On December 26, 2018, several youth on motorcycles damaged a few Buddha statues in and around Mawanella, a town just west of Kandy.⁸⁹ Two of the alleged ring leaders, the brothers Mohammad Sadik Abdul-haq and Mohammad Shaheed Abdul-haq, managed to steer clear of the law enforcement dragnet for a time. They would eventually be arrested hiding in their uncle’s shoe store a week after the Easter bombings.⁹⁰ Their father, Rasheed Mohamed Ibrahim (no apparent relation to two of the Easter Sunday attackers), had been arrested on January 22, 2019, on suspicion of involvement.⁹¹ After the Easter bombings, locals in Mawanella suggested that the individuals who carried out the desecration of the Buddha statues were radicalized by Zahran Hashim and that Hashim had been living in Mawanella for some months in 2018 as well.⁹²

The subsequent police investigation into the Mawanella incident led to the arrest and interrogation of at least 13 other youth.⁹³ One of these youth tipped off Sri Lankan law enforcement to a stash of weapons and explosives on a coconut estate in Wanathawilluwa in the northwest of the country.⁹⁴ On January 17, 2019, police arrested four suspects at this estate for possessing nearly 100 kilos of explosives, detonators, 20 liters of nitric acid, wire cords, firearms, and a stock of ammunition.⁹⁵ While many politicians and journalists wondered out loud, at the time, why someone would be stockpiling weapons at this scale, the connections were not made in time to prevent the Easter bombings.⁹⁶ After the Easter attacks, one of the individuals arrested was Zahran Hashim’s driver, Muhammad Sharif Adam Lebbe. He would prove to be quite valuable. Lebbe admitted that he and members of the NTJ were responsible for the killings of the two police officers in Vavunathivu in November 2018, and his information led law enforcement officials back to the same coconut estate in Wanathawilluwa where they found a second stash of weapons along with the two missing revolvers that belonged to the murdered policemen. These finds further cemented the links between Zahran Hashim and all of these seemingly disconnected events.⁹⁷

After the flurry of law enforcement activity following the killing of the two police officers, the Mawanella desecration of the Buddhist statues, and the recovery of a weapons cache in Wanathawilluwa, things were relatively calm until the Easter attacks.

The Islamic State Connection
While the precise role of the Islamic State in either inspiring or directing the Easter attacks are still being pieced together, some evidence has emerged. For one, the sheer fact that the photos of the attackers and the oath of allegiance video were released through official Islamic State channels on Telegram suggests at the very least that one of the attackers was plugged in with the Islamic State media network. The question remains whether there was something more, whether some of the attackers had traveled to join the Islamic State in Syria or to its Khorasan Province (Afghanistan, Pakistan, and “nearby lands”⁹⁸), whether they had received training or finances, and whether they had some outside help in making explosives.

At the time of writing, answers to most of these questions remain fuzzy. In the week after the attacks, for instance, both The New York Times and The Wall Street Journal wrote about the Islamic State connection and came to conflicting conclusions.⁹⁹ Investigators, journalists, and researchers, though, are zeroing in on particular individuals to try and unpack these potential connections with Islamic State central.

One of these potential connections seems to lie in a series of investigations by the Indian National Investigation Agency (NIA) into foreign fighters and Islamic State supporters in Kerala and Tamil Nadu.¹⁰⁰ In June 2016, Indian media reported that 16 Muslim youth from Kerala had “disappeared” and that family members feared they had left to join jihadi groups in Syria.¹⁰¹ It was later reported that many of the individuals leaving from Kerala were not only heading to Iraq and Syria, but were also being encouraged to join the Islamic State’s Khorasan Province (ISKP). In the middle of 2018, three of these individuals returned to India and were arrested. One of those arrested, known only as “Basit,” revealed the presence of an Islamic State cell in Coimbatore to Indian officials.¹⁰²

On September 2, 2018, the NIA raided several locations in Kerala and Tamil Nadu based on tips from Basit. Several individuals were arrested, and charged with plotting to assassinate Hindu leaders in Coimbatore.¹⁰³ Some links were discovered between the Coimbatore cell and Zahran Hashim. A “huge haul of data” was seized during these raids.¹⁰⁴ The Coimbatore cell had copies of Zahran’s speeches, and phone records showed that Zahran had been in contact with Islamic State fighters in Bangladesh and Afghanistan.¹⁰⁵ It is not clear at the time of writing (late May 2019) whether Zahran was influenced by these connections or whether, given the fact that they had copies of his speeches, Zahran was the influential voice.

CNN reporting, though, suggests that an Islamic State suspect, who is not named, revealed to Indian interrogators that he trained Zahran and played a role in his radicalization.¹⁰⁶ This dovetails with the Wall Street Journal reporting cited above suggesting Zahran may have made contact in India with veteran Islamic State fighters.¹⁰⁷

In addition to the Indian angle, some initial reporting on the profiles of some of the attackers suggests that there may be an Islamic State connection. According to The Australian, Abdul Lathief Jameel Mohamed, the Taj Samudra attacker whose explosive device malfunctioned, was investigated during his postgraduate studies in Australia after “intelligence emerged” linking him to Islamic State fighter Neil Prakash (Abu Khalid al-Cambodi), currently in prison in Turkey.¹⁰⁸ Mohamed and Prakash likely did not know each other while the two were in Australia, but Prakash was very active online and encouraged plots all over the world.¹⁰⁹ Mohamed studied aerospace engineering at Kingston University in southwest London from 2006 to 2007, before arriving in Melbourne for a postgraduate degree. According to his sister, he was radicalized in Australia and came back to Sri Lanka in 2013 a completely changed man.¹¹⁰ The question of whether Mohamed traveled to Syria and joined the Islamic State also seems unclear, with some reports suggesting that he only got as far as Turkey, and others stating that he entered Syria and may have engaged in training.¹¹¹

Another intriguing connection has emerged. Reuters reported that “a Sri Lankan software engineer suspected by authorities in Sri Lanka of having provided technical and logistical support to the Easter Sunday suicide bombers was monitored by Indian intelligence agencies three years ago for links with Islamic State suspects.”¹¹² This individual, 24-year-old Aadhil Ameez who is in police custody but who has not as of late May 2019 been charged, is also alleged to be the link between the National Tawheed Jamaat (NTJ) and the Jamathei Millathu Ibrahim (JMI), whose members included, according to Reuters reporting, Inshaf and Ilham Ibrahim, the Cinnamon Grand and Shangri-La hotel bombers.¹¹³ It suggests an intriguing answer to the initial mystery of how two wealthy businessmen from the capital came into a trusted relationship with an extremist preacher from the east of the island. It is suspected that Aadhil Ameez, Zahran Hashim, and Ilham and Inshaf Ibrahim are the ones who leased the Wanathawilluwa coconut estate discussed above, which was meant to be used as a training camp before it was discovered by law enforcement officials in January 2019.¹¹⁴ More details are still emerging about the precise nature of this network, and missing pieces are likely to be filled in as the investigation continues.

Emerging profiles of some of the attackers has once again brought to focus an old debate in terrorism studies: the role of socio-economic status and education in promoting violent extremism.¹¹⁵ While the stereotypical profile of a terrorist is someone who is poor, aggrieved, and unemployed, decades of research has shown this to be far more nuanced.¹¹⁶ A similar debate arose after the July 2016 attack on the Holey Artisan Bakery in Dhaka, Bangladesh,¹¹⁷ as it became clear that several of the attackers were highly educated and middle class.¹¹⁸ Indeed, at least with the Ibrahim brothers, it was likely that their wealth and business prominence¹¹⁹ protected them from any kind of outside suspicion, while they slowly helped plot the attack.

Aftermath of the Attacks
By the morning after the attack, over 20 suspects had been arrested,¹²⁰ and the number would only grow throughout the week. While some of these individuals may have been connected to the attacks in some way, others were likely vacuumed up to not only show the public that something was being done, but also to ensure that no stone was left unturned after it became apparent that the government had received several warnings in the weeks leading up to the bombings.¹²¹

Some in the Muslim community hoped¹²² that the Islamic State claim on April 23, 2019, would make clear to the larger Sri Lankan population that this was a clear indication that their youth were recruited “from abroad,” that it had nothing to do with their mosques, their religious leaders, or their beliefs—that this was not entirely homegrown. They hoped that they would not experience another Aluthgama, another Kandy.

Three days later, in the evening of April 26, 2019, police raided a house in Sammanthurai in Ampara District in Sri Lanka’s Eastern Province.¹²³ The information reportedly again came from Muhammad Sharif Adam Lebbe, Zahran Hashim’s captured driver.¹²⁴ In the house, police recovered a drone, bomb-making materials, suicide vests, as well as the Islamic State flag and clothing worn by the bombers in the pledge of allegiance video.¹²⁵ Sri Lankan authorities videotaped the seizure and broadcast it on television.^g

Meanwhile, a separate safe house in Kalmunai, around five kilometers north of Sammanthurai, began arousing the suspicion of neighbors.¹²⁶ They noticed that new people had moved in and rented a house in their town. They went to say hello and were rebuffed. They went a second time, this time accompanied by a local police officer. A youth met them at the door and fired several rounds at them. The police officer managed to escape and informed the military and the STF.¹²⁷ Then all hell broke loose. At the end of the raid, 15 people lay dead, including six children—all family members of Zahran Hashim.¹²⁸ Sometime before they died during the raid, Zahran’s father and his two brothers, Rilwan and Zainee, recorded a shaky cell phone video, which later made the rounds on Telegram channels run by Islamic State supporters. In it, Rilwan, one eye damaged and missing several fingers, declares that they are currently “surrounded by dogs,” signaling that their hideout had been discovered, and says that they will teach the country a lesson for “oppressing the Muslims.”¹²⁹ The next day, the Islamic State claimed the Kalmunai raid and released a photo of Zahran Hashim standing beside his brother Rilwan. The claim, however, mistakenly noted that 17 Sri Lankan police officers were killed in an Islamic State ambush. In fact, there were no law enforcement casualties.¹³⁰

Conclusion
A month after the Easter bombings, two questions remain heavily debated in Sri Lanka and among terrorism analysts: first, with so many warnings from various intelligence agencies abroad, the many raids and arrests discussed above and the local community calling for the banning of the NTJ since early 2017, why was nothing done? And second, what can the attacks in Sri Lanka tell us about the Islamic State’s strategy going forward, after its loss of territory in Syria and Iraq? Answers to both of these questions, which are fundamentally important for understanding what happened and the road ahead, remain wanting.

The day after the attacks, cabinet minister and government spokesman Rajitha Senaratne went public to confirm rumors that “information about possible suicide attacks at Christian places of worship and tourist areas had been shared prior to the attacks by foreign intelligence and local intelligence.”¹³¹ The intelligence had been shared on three separate occasions—two weeks before the attacks, four days prior, and even 10 minutes before the bombs went off. The warnings went the extraordinary distance of identifying the NTJ, possible locations, as well as the names of some of the attack network.¹³² Both the State Minister for Defence, Ruwan Wijewardena, and the Prime Minister, Ranil Wickremasinghe, stated that they had not been informed of the threat beforehand. In an interview with India’s NDTV, Wickremasinghe stated that “India gave us the intelligence but there was a lapse on how we acted on that. Intelligence was not conveyed down the line.”¹³³ President Maithripala Sirisena similarly said that both the national police chief and the defense secretary had received warnings of imminent attacks, but had not informed him. They both resigned at his request.¹³⁴

Part of the problem was that both Sirisena and Wickremasinghe had a turbulent personal relationship, and had allowed national security to be politicized. In October 2018, President Sirisena fired Wickremasinghe and his cabinet and installed former President Mahinda Rajapaksa as the new Prime Minister. Wickremasinghe refused to leave, leading the country into a full-blown constitutional crisis, with two individuals claiming to be Prime Minister.¹³⁵ The Supreme Court overturned the move, and forced Sirisena to reinstate Wickremasinghe. At the time of writing (late May 2019), the precise details around who knew what, and when, and why nothing was done about it remains debated with all sides pointing fingers at one another. It will be some time before more precise details emerge with respect to what went wrong.

With respect to what the Sri Lanka attacks may reveal about the Islamic State’s strategy going forward, two factors are important. First, the author has been asked many times since the attack why the Islamic State would go out of its way to target a small island like Sri Lanka. This is largely the wrong question. As has been seen in Dhaka, Quetta, and other places that have experienced recent attacks, it is not so much that the Islamic State is targeting these countries as it is accepting allegiances by local groups who want to bridge localized grievances with a more transnational brand. As such, it is not that the Islamic State targeted Sri Lanka, but that groups like the NTJ are aligning their cause with international terrorist groups. This goes a long way to explaining, for example, the targeting of Christians and tourists in Sri Lanka, which fits more the modus operandi of the Islamic State, rather than being in line with historical ethno-religious faultlines on the island.¹³⁶

Second, over the last two months, the Islamic State has been, quite intriguingly, picking apart its Khorasan Province and declaring each subsection to be its own wilayah (province). On May 10, 2019, it declared Wilayah Hind (Indian province),¹³⁷ and on May 15, 2019, it declared Wilayah Pakistan (Pakistan Province)¹³⁸—both of which were historically part of Khorasan Province (ISKP). This sort of trend affecting ISKP is interesting because last year saw the exact opposite phenomenon with respect to its provinces in Syria and Iraq. In July 2018, the Islamic State restructured its over 20 provinces in Syria and Iraq. As the researchers at BBC Monitoring noted, the Islamic State stopped referring to its provinces in Raqqa, Kirkuk, Northern Baghdad, and other places as separate entities, and instead grouped them under the Wilayah of Iraq and the Wilayah of Sham (Syria).¹³⁹ At least one reason for breaking apart larger conglomerates is, as Syria analyst Hassan Hassan noted, to insulate cells from each other in order to “minimize infiltration and maximize agility.”¹⁴⁰ Whether this trend means that the world will witness increased attacks in parts of South Asia remains to be seen.