Reporting from the BBC, Reuters, and scores of other outlets said at least 11 terrorist bombs exploded in Sri Lanka on 21 April, hitting multiple targets. Seven of these were direct attacks against specific targets – three churches, and four hotels – and three appeared to be from law enforcement operations aimed at apprehending suspects or blowing in place bombs that authorities had discovered. The situation in Sri Lanka is highly fluid with new, highly significant data points developing every 12-24 hours. This is likely to continue for at least one more week, and possibly longer. No analyses presented here, then, should be considered definitive, but the information is, nevertheless, quality enough to be acted on for near term risk reduction. Muir Analytics will update its reporting at the appropriate juncture.

Main details of the bombings

• Reuters said the direct attacks were carried out by seven suicide bombers.
• CCTV from Sebastian’s Church, the Cinnamon Grand, the Shangri-La, and the Tropical Inn Guesthouse all showed bombers carrying backpack bombs. The first three appeared to be approximately 40-50-liter size. CCTV is too grainy to tell the size of the backpack of the Tropical Inn Guesthouse bomber.
• Press photos of the bomb damage at several sites demonstrated distinct blast patterns from the bombs, particularly regarding shrapnel pockmarking that show nearly uniform small and large sized holes punched into walls and windows.
• Reuters also said six of the seven direct attacks happened between 8:45am – 9:05am, with the other bombings happening between 1:45 – 2:15pm.
• The Guardian said on 25 April the casualty rate had been revised down after some miscounting: 253 killed, and approximately 500 wounded. The casualty count might change again.
• Reuters reported 38 foreigners were caught in the blasts. Indian, Turkish, Danish, British, US, Portuguese, Dutch, and Chinese citizens were among them.

The culprits

• The Sri Lankan government named the culprits, said the CBC and Al Jazeera: the National Thowfeek Jamaath (NTJ, roughly meaning, “National ‘One Religion/One God’ Organization,” also referred to as National Thawheed Jama’ut), and the Jammiyathul Millathu Ibrahim (JMI, roughlymeaning, “Organization of the Way of Abraham”). The government also said the bombers were connected to an international terror network that helped facilitate the attacks.
• On 23 April, ISIS claimed responsibility for the bombings in a video published by its Amaq news agency citing revenge for the 15 March 2019 New Zealand Christchurch mosque massacre by a right wing extremist. Asia Times showed parts of the video here. The Sri Lankan leader of the NTJ, Mohamed Zahran Hashim– also one of the bombers – was featured in the video along with the other bombers who remained hooded.
• The Voice of America said that, on 23 April, the SITE Intelligence Group translated a separate message from ISIS saying their fighters had targeted people at churches and specific hotels from “crusader” countries that had been part of the defeat-ISIS coalition in Syria-Iraq.
• The UK’s Channel 4 News said the Sri Lankan government has confirmed that some of the bombers involved had trained and fought in ISIS’ Syrian theater of operations.
• Reuters reported that most or all the bombers were Sri Lankan, well educated, and from financially well off families.

Government action

• The CBC said 58 suspects had been arrested.
• The CBC said police discovered 87 detonators at Colombo’s main bus station the day of the attack.
• The Sri Lankan president requested the resignation of the National police chief and the minister of defense because bomb warnings had been issued, but not widely enough disseminated to be acted on.
• The government declared a nationwide emergency, including a temporary 6:00pm – 6:00am curfew. Arrest and detention powers were widened, social media was curbed to prevent sensational rumor mongering and communal violence, and security was enhanced throughout the country, especially at government buildings and the airport. Hospitals put out a call for blood donations, which the population responded to.
• The UK’s Foreign and Commonwealth Office warned that all but essential travel to Sri Lanka should be avoided until the security situation there has stabilized. Law enforcement operations against suspects and terrorist safehouses continue. In one case, a security force engaged in a firefight with terrorists at a location 200 miles north of Colombo on 26 April. There, authorities found an ISIS flag, at least 200 sticks of high explosives (this from a photo of the explosives), thousands of ball bearings, multitudes of detonators, urea fertilizer, and other bomb making materials.
• Sri Lanka is no stranger to terrorism. It fought a brutal war with the insurgent/terror group, Liberation Tigers of Tamil Eelam (LTTE, or “Tamil Tigers”) for decades. That war ended in 2009.

The church bombings

• The churches were attacked during Easter services. The Associated Press said the targets were:
  • Anthony’s Shrine: in Kochchikade, a district of Colombo, attacked at 8:45am.
  • Sebastian’s Church: in Negombo, attacked at 8:45am.
  • Zion Church: in Batticaloa, attacked at 9:05am.

The hotel bombings

• The hotel targets – specifically, hotel Easter brunch buffets in all but one attack – were in Colombo, and included:
• The Shangri-La: attacked at 8:45am by two bombers, said Reuters (other reporting said 9:00am).
• The Kingsbury Colombo-Sri Lanka: attacked at 8:45am, said Reuters.
• The Cinnamon Grand Colombo: attacked at 8:30 am.
• The Tropical Inn Guest House: in Dehiwala near the Colombo Zoo, attacked at 1:45pm, said ITV and Inter Press News Service. Reporting here is varied. The bomber detonated in, or next to, this guest house. News.com.au reported that the bomber here had originally targeted the luxury Taj Samudra hotel. His bomb failed to detonate, said The Times, so he returned to the group’s safehouse, had the device repaired, and then targeted the Tropical Inn Guest House where his bomb killed at least two people. An alternate version is that the bomber, after his device failed to detonate in the Taj Samudra, entered the Tropical Inn Guest House to repair it, and he accidentally set it off in the process, killing him and one other.

The remaining three bombs

• IPS News, the Hindu Business Line, and News.com.au reported that, when a SWAT team entered house of one of the Shangri-La bombers in Colombo at 2:15pm, the pregnant wife of one of the bombers, armed with a suicide bomb, detonated her device, killing herself, her two children, her unborn baby, and three police officers. (Some reports say two bombs exploded here).
• The CBC reported that a bomb disposal team found at least one or more unexploded devices in a van next to the bombed-out St. Anthony’s Shrine and tried to defuse it/them, but it/they exploded in the process.
• The Sydney Morning Herald and the Daily Beastreported that Air Force security personnel found what was described as a six-foot PVC pipe with explosives in it on the road to Bandaranaike International Airport. The CBC called it a “crude device.” An ordnance disposal team isolated the area and detonated it.

Background on Islamist jihadism in Sri Lanka

• In 2012, the Sri Lankan government kicked out 161 foreign Islamic fundamentalist clerics for sneaking into the country on tourist visas and illegally preaching conservative Islam. Most of these clerics reportedly belonged to Tablighi Jamaat (TJ), an organization that says it rejects violence. The Guardian said, however, that counter terrorism officials in countries such as France, the US, and the UK have accused TJ of grooming fundamentalists for entry into violent Islamist jihadist organizations.
• In July 2017, NTJ’s leadership faced Sri Lankan government legal prosecution for disparaging the Buddha and insulting the majority of the country who are Sinhalese Buddhists, reported the Jerusalem Post.
• The Nation reported that, in February and March 2018, there were Buddhist vs. Muslim riots that resulted in at least two killed, 15 wounded, and copious property damage. The riots began after four Muslim youth apparently murdered a Buddhist Sinhalese truck driver, reported India Today.
• The Guardian said in December 2018, four Buddhist holy sites in Mawanella were desecrated by Islamist jihadists. There had also been attacks on Sufi mosques, a Muslim sect the Islamists jihadists want to eradicate.
• Jamaat-e-Islami, an Islamist group accused of terror attacks in Bangladesh, increased its political involvement in Sri Lanka after these riots.
• The government and moderate Muslims had been aware of Mohamed Hashim’s radical preaching activities, and they had tried to quell it through societal pressure, but to no avail, reported The Guardian.
• Channel 4 News interviewed Hilmy Ahamed, Vice President of the Sri Lankan Muslim Council, who said his organization had, in the process of complaining about Buddhist on Muslim violence, provided the government with information on the threat posed by NTJ and its Islamist radicalization activities.
• The AFP and the Sri Lanka Mirror reported that on 17 January 2019, police raided a terrorist camp in a remote wilderness area, Wanathavilluwa, arresting four. They discovered 100 detonators, six 20-liter cans of Nitrate Acid, as much as 100 kilograms (220 lbs) of high powered explosives (maybe C4, said the press), and other weaponry and supplies. Authorities said the culprits at the makeshift camps were Islamist jihadists, and they were planning on destroying famous Buddhist shrines, and they were also indoctrinating Muslim youth with Islamist jihadist ideology. Their ultimate goal was to start a religious war in Sri Lanka, says Weekly Blitz.
• CNN reported that one of the suicide bombers from the Cinnamon Grand hotel, Ilham Ahmed Ibrahim, had previously been arrested by the government (date unknown), but later released. His father is a wealthy spice trader and is under arrest for allegedly aiding and abetting the attack.
• Reuters reported that Indian intelligence services provided threat warnings concerning church attacks to their Sri Lankan counterparts as early as 4 April. Reuters furthermore said it viewed an intelligence warning from 11 April that quoted a foreign intelligence agency warning Sri Lanka of possible attacks on churches via a threat made by the leader of the NTJ.

Sources and further reading:

“Sri Lanka bomber ‘radicalised in Australia’, says sister,” News.com.au, 26 April 2019.

“Fourth Sri Lanka hotel bomb failed to explode,” The Times, 25 April 2019.

“Death toll in Sri Lanka bombings revised down to 253,” The Guardian, 25 April 2019.

“Stumbling into hell: Australian tourists enter Sri Lankan hotel reception just minutes after bomb attack… and are confronted with blood-soaked victims being carried as they realise what has happened, Daily Mail, 25 April 2019.

“Pregnant wife of Sri Lanka bomber detonates suicide vest during raids, killing her children and three police officers,” News.com.au, 25 April 2019.

“Sri Lanka suicide bomber was previously arrested and then released,” CNN, 25 April 2019.

“Picture emerges of well-to-do young bombers behind Sri Lankan carnage,” Reuters, 24 April 2019.

“Sri Lanka president asks for resignations of top officials, attack death toll at 359,” CBC, 24 April 2019.

“Sri Lanka bombers seen smiling, plotting attack on hotel elevator: report,” New York Post, 23 April 2019.

“IS Claims Sri Lanka Attack as Revenge Against ‘Crusader Coalition’,” Voice of America, 23 April 2019.

“Sri Lanka attack ‘retaliation’ for NZ massacre: minister,” Al Jazeera, 23 April 2019.

“The moment ‘Sri Lankan suicide bomber walks into church with his device in a huge backpack’ moments before detonating it in Islamist attacks that killed 290 people,” Daily Mail, 22 April 2019.

“Unconfirmed reports blame Zahran Hashim for Sri Lanka attack. Who is he?,” Jerusalem Post, 22 April 2019

“Sri Lanka wakes to emergency law after Easter bombing attacks,” Reuters, 22 April 2019.

“Sri Lanka’s Easter Sunday Carnage: Quo Vadis?,” Inter Press News Service, 22 April 2019.

“Police in Sri Lanka say 290 people killed in attacks on churches, hotels,” CBC, 22 April 2019

“Timeline – Sri Lankan bomb attacks on hotels, churches: 20 minutes of carnage,” Reuters, 22 April 2019.

“Pipe bomb detonated on road to airport,” Sydney Morning Herald, 22 April 2019.

“Sri Lanka imposes emergency, says international network involved in attacks,” Reuters, 21 April 2019.

“Sri Lanka bomber waited in line at hotel buffet then unleashed devastation,” The Times of Israel, 21 April 2019.

“Seven arrested as Sri Lanka blasts at churches and hotels kill at least 207,” ITV, 21 April 2019.

“Sri Lanka explosions: More than 200 killed as churches and hotels targeted,” BBC, 21 April 2019.

“207 killed, around 500 injured as blasts hit churches, luxury hotels on Easter in Sri Lanka,” The Hindu Business Line, 21 April 2019.

“New nexus of Islamic State formed under the leadership of Jamaat e Islami in South Asia,” Weekly Blitz, 27 January 2019.

“Sri Lanka declares emergency to quell anti-Muslim riots,” The Nation, 7 March 2018.

“What was the Wanathavilluwa explosives for?,” Sri Lanka Mirror, 18 January 2019.

“Sri Lanka seize explosives from local Islamist radicals,” AFP via Economy Next, 18 January 2019.

“Jamaat-e-Islami Hind chief expresses concern over situation in Sri Lanka,” YouTube, 7 March 2018.

“Behind Kandy riots and emergency in Sri Lanka: A road rage incident and deeper communal malaise,” India Today, 6 March 2018.

“Sri Lanka: Colombo Orders Islamist Clerics to Leave,” Future Directions International, 11 February 2010.

“Inside the Islamic group accused by MI5 and FBI,” The Guardian, 19 August 2006.

Stanford University’s “Mapping Militant Organizations,” Liberation Tigers of Tamil Elam.

Copyright © Muir Analytics 2019