12 April 2020: First anniversary of 2019 Sri Lanka Easter hotel and church bombings – field notes from ground truth deployment
12 April, 2020 Hotel Attacks
12 April, 2020 Hotel Attacks
Shortly after the ISIS bombings in Sri Lanka on Easter Sunday 2019 against four hotels and three churches, Muir Analytics, as part of its SecureHotel Threat Portal product, deployed an analyst there to secure ground truth regarding damages, and to ascertain additional information about the attacks that killed 259, wounded over 500, and severely damaged Sri Lanka’s economy.
On the first anniversary of those attacks, here, then, are select and edited field notes from that deployment.
On 29 April 2019, I arrived in Colombo, Sri Lanka, eight days after Easter Sunday, when eight suicide bombers proclaiming allegiance to the Islamic State executed an attack on three churches and three luxury hotels, killing 259 people. I stayed for five days in two of the hotels that were attacked to survey the situation on the ground.
I also traveled around the city, observed the areas near two of the churches that were attacked, and interviewed many people both formally and informally. Among them were Christian Sri Lankan business owners, a leader in the Muslim community, a Sri Lankan military officer, a US military attaché, a Muslim gemstone store manager, a Buddhist taxi driver, a Muslim tuk-tuk driver, two hotel managers, three other hotel staff, and a retired American journalist and long time resident of Sri Lanka. Through them, I was able to make general assessments about the security situation, the state of sectarian tensions, the political climate, and the impact on businesses and tourism up to that point.
Tensions between Sri Lanka’s Muslim and Buddhist communities had been simmering for years. Part of this was due to the radicalization programs of Zaharan Hashim, the Easter bombings’ purported mastermind. Several Muslim communities banished Hashim and his brand of Islamist jihad, and they reported him to the authorities. After a Buddhist man was beaten by Muslim youth during a traffic dispute in the city of Kandy in March 2018, Buddhists rioted against Muslims in five days of religious violence, where 20 were killed, 20 mosques were sacked, 224 houses were damaged, and 119 businesses were destroyed. Muslim-Buddhist tensions increased, and Hashim released a video calling for the killing of non-Muslims in Sri Lanka, saying police officers should be attacked, and that bombs should be set off all over the country.
Based on this statement, the discovery of terrorist training camps, and the relative sophistication of the bombs and attacks, planning may have begun at that time – about a year before the bombings themselves – giving the planners sufficient time to collect funds and materials, train recruits, and practice bomb-making.
According to Army General Senanayake, the plan to attack on Easter was decided in early April during a meeting of the two Islamist militant groups that were involved, the National Thowfeek Jamaath (NTJ), and the Jammiyathul Millathu Ibrahim (JMI), overruling some members’ desire to wait to conduct a more significant attack on Buddhist targets during a significant Buddhist holiday. The decision to attack churches, the Indian High Commission, and other targets were known in India and communicated to Sri Lanka as early as 4 April. The Sri Lankan Chief of National Intelligence had sent a memo on 9 April to the Inspector General of Police about the matter. Despite this, the government took no actions to alert churches or other targets. It is not entirely clear when or if hotels were known to be targets.
As a foreigner traveling to Sri Lanka from Singapore, I received a visa to Sri Lanka online quickly without trouble, and there were no signs that extra vetting took place. There was also little to no observable security check of passengers checking in to fly to Sri Lanka or upon arrival. The ban on social media had already been lifted close to my arrival date. Still, a ban on face coverings had just gone into effect, preventing Muslim women from wearing the more conservative niqabs and burkas. On 26 April, a few days before I arrived, nearly the entire family of ringleader Zaharan Hashim had self-detonated after a firefight with Sri Lankan security forces, but not before releasing a video promising more attacks to come. By 29 April, Islamic State leader Abu Bakr al Baghdadi released a video claiming the attacks for ISIS as retribution for the loss of the Caliphate.
The airport was on high-security alert, and armed forces with many bomb-sniffing dogs outnumbered arriving passengers. A massive pipe bomb had also been found near the airport on Easter Sunday, as well as copious explosive material and numerous detonators at a terrorist safe house. As many as 10,000 army personnel were reportedly on the ground conducting search operations throughout the affected areas, and 120 suspects had been arrested.
My taxi driver went through two checkpoints, both less than a minute from my first hotel, manned by five to eleven armed men. He was required to show his identification as well as my hotel booking and passport. My luggage was searched lightly at the second checkpoint. Numerous armed security personnel stood guard at churches, mosques, official buildings, banks, and other locations throughout the city.
Upon leaving several days later, the airport continued to be on high alert. All passengers were checked at least four times, the first time in the arriving vehicle before entering the airport (a vehicle search), and then a personal search before entering the airport building, and then two more searches with luggage scanners once inside the airport. There was a wider variety of armed personnel operating at the airport at this time, and they still outnumbered passengers departing.
Most of the other passengers on the plane to Sri Lanka appeared to be locals returning home rather than tourists. While life resumed for Sri Lankans during my stay, most returning to work, tourists and foreigners remained scarce. There were only two occasions in five days that I saw foreigners walking around freely in the streets of Colombo outside the hotels, and just a very few were inside the hotels. Normally packed with tourists and holding weddings, the hotels were now virtually empty. The lavish breakfast buffet at the Cinnamon Grand served only one other person. I was invited to a country club outside the city center as well, which was mostly empty. It was only upon departure that I encountered western foreigners in any numbers. Many had stayed in the hotels along the beach rather than in Colombo.
Managers of both the Cinnamon Grand and Kingsbury said the attacks had severely impacted their occupancy rates. A US military attaché who had previously lived in Colombo said the Cinnamon Grand was usually packed every day all year long due to its popularity as a wedding venue. The Kingsbury, popular with Casino goers and Chinese nationals working on the Colombo Port City project next to the hotel, also a vulnerable target, was nearly empty. However, a wedding did take place near the end of my stay, and there were three to four East Asian guests as I checked out.
Three Buddhist Sri Lankans I spoke with, a taxi driver and two hotel employees, had become deeply suspicious of the Muslim community, while claiming to have Muslim friends and no antipathy for the community as a whole before the attacks. It should be noted that while in the past few years, Sri Lanka had seen a rash of communal violence, Colombo itself had not been as impacted as other areas.
The Sri Lankan Muslim population descended from Muslim traders who married local Tamil women. The community has long dominated several lucrative sectors, including gemstones and spices, affording them considerable political clout despite being a minority in a Buddhist majority country. Two of the suicide bombers were the sons of a politically connected, highly successful spice trader, and one of Colombo’s wealthiest families. While some in the Muslim community had begun to wear more conservative clothing and grew beards, a practice that started in the 1980s, many Muslims from the business-owning classes in Colombo and elsewhere were indistinguishable from their non-Muslim countrymen. Those based in Colombo were well educated and/or from a high socioeconomic class.
After showing me several mosques, the Muslim tuk-tuk driver drove me to a Muslim-owned gemstone store where he receives a commission to bring tourists. During the ride, he insisted that the majority of Muslims in Sri Lanka were peaceful, unlike the suicide bombers. In the empty store, the manager demonstrated a signed guest book with many satisfied foreign customers. When asked if he was worried about his safety, the store manager said he was not.
I also met with an outspoken Muslim leader who, in contrast, was deeply concerned about retaliatory attacks against the Muslim community. He feared the government’s aggressive approach toward Muslims during the search for suspects, including, he said, male police and military officers physically handling Muslim women – which was televised – would further incite the Muslim community, exacerbating existing tensions. (Note: my military contact explained that these searches were televised for messaging purposes, and several women were among the suicide bombers and planners.) Muslim-Buddhist violence would erupt on 7 May, shortly after my departure, and again more violently on 13-14 May.
The Muslim leader, a moderate, had personally delivered to authorities evidence of terrorist ringleader Hashim’s radical preaching years and even months before the attacks, but to no avail, just as the intelligence warnings of the attacks were ignored. He and three other people I interviewed alluded to the political infighting that had left the government’s security and intelligence apparatus dysfunctional. Virtually everyone I spoke with blamed the government for failing to act.
I was able to stay in two of the hotels that were successfully hit by the suicide bombers: the Kingsbury Colombo, and the Cinnamon Grand. The Shangri-La was closed for business due to the location of the blast, which was visible from the street. Hotel officials did not permit access to the site of the attacks, and the affected areas were already under repair and renovation.
Security at the hotels after the suicide bombings was high. At both the Kingsbury and the Cinnamon Grand, several armed military personnel were posted immediately outside the front entrance, overseeing guests as they fed luggage and handbags through a scanner before submitting to a full body search. The searches were thorough, and nobody appeared to be exempt, including all members of a wedding party that was entering the Kingsbury. The Cinnamon Grand had set up a checkpoint at the entrance to its driveway, and it had bolstered security at its front entrance. It also had armed military personnel in residence at the hotel, which could be seen walking around.
First, since the warning of the attacks came from Indian intelligence, which had uncovered the plot in the process of investigating an ISIS cell in Coimbatore (a major city in the Indian state of Tamil Nadu,) the Indian High Commission probably increased security at least by 4 April when the Indian government first alerted Sri Lanka of the pending attacks. If so, then the High Commission’s increased security most likely spooked the bombers to abandon it as a target. This may also explain why the Shangri-La had two suicide bombers rather than one.
Second, the fact that the bombing targets were, 1) high-end hotels filled with Westerners, 2) the Indian High Commission, and 3) Catholic Churches, indicates that ISIS’ targeting regimen superseded the Sri Lankan Islamists’ ideal target set: Sri Lankan Buddhists. The target sets the Sri Lankan terrorists attacked are all standard targets for ISIS.
Third, Buddhist temples and holidays were almost certainly the targets for the second wave of attacks, which could have taken place on 18 May, the celebration of the Buddha’s birthday known as Vesak. Hashim’s wife had survived the suicide bomb that killed most of the rest of his family, and she had just two days before Easter purchased white dresses that are traditionally worn by women during Buddhist celebrations, even though the decision to attack Christian targets on Easter was already made earlier in April. Hashim’s sister was also still alive, and despite publicly condemning her brother’s preaching, she was found to have received a large sum of money from him, purportedly to fund the church bombing in Batticaloa. These two women, then, probably would have served as suicide bombers for an attack on Vesak celebrations.
Fourth, for maximum casualties – also an ISIS goal – the attacks appear to have been timed to occur nearly simultaneously at around 8:45 am, prime time for both Easter Sunday Mass as well as lavish Easter Sunday brunches in high-end hotels catering to foreigners.
Fifth, it seems likely that mosques were used as safe houses and/or rally points for the attacks. Scores of mosques were within walking distance of each of the churches that were attacked. Current reporting says the bombs were assembled outside Colombo and delivered the day before the attacks, making the nearby rally point scheme reasonable. Despite both Muslims and Christians being minorities in Sri Lanka, churches and mosques are abundant and often located within walking distance of each other. This was the case for all of the churches that were attacked – mosques were within a short walking distance of each target. Additionally, two of the suicide bombers were seen in CCTV footage spending time in mosques before their attack runs, including a failed attempt to blow up a specific church (Saint Mary’s) and yet another failed attempt to blow up a specific hotel (the Taj Samudra.)
Sixth, the bombers benefited from targeting multiple hotels along the 2 km stretch of Galle Main Rd. Why? Because these targets made sense for the operation of just a few suicide bombers aiming to have a high impact. The hotels were relatively close to each other, and high destruction at each one in close succession would produce sensational shock and horror. And it did.
Additionally, if one target in this particular area became unreachable, such as the Indian High Commission, then scores of other hotels packed with Westerners presented themselves. A captured cell phone of the bomb plotters later revealed what appears to be a reconnaissance mission down Galle Main Road, pointing out hotels, including the Shangri-La. So, it seems they likely identified optional targets ahead of time.
Moreover, all four hotels targeted, plus the High Commission, had immediate access to Galle Main Rd, which has good traffic flow, even in its busiest hours. At the same time, more congested interior city roads are prone to gridlock. A small, ubiquitous tuk-tuk can snake down Galle, even if cars and trucks are unable to. This would, in theory, allow any of the suicide bombers to either travel to another planned target less than a few minutes away, or egress quickly enough to another location for further instructions or to reassess. This appears to be what one suicide bomber did after his bomb failed to detonate in the Taj Samudra.
This latter bomber looks to have traveled down Galle Rd and further south 20 minutes to a small guesthouse where the bomb he had would eventually explode, perhaps by accident. Interestingly, shortly before that, he can be seen on CCTV resting in a mosque that was also near another Catholic Church with a large congregation. By the time he arrived, however, the mass would have been nearly over.
The Kingsbury hotel room I stayed in also offered a view of the World Trade Center, which had been targeted in the past by a Tamil Tiger assault team. The hotel itself is located next to the Central Bank and the entrance to the Sri Lanka Navy Headquarters. Had the suicide bomber failed to detonate inside the Kingsbury, he could have taken a very short walk and attacked other high-value targets or even crowds of pedestrians nearby. However, casualties would have been lower on a Sunday. This may explain the heavily manned checkpoint located less than 50 meters from the hotel (if it was not for the hotel itself.)
Seventh, over the course of my stay, I observed the military checkpoint near the Kingsbury become increasingly relaxed in the number of vehicles searched and the number of armed men stationed there, reflecting possibly the arrests and deaths of what were believed to be the key participants of the planned, second wave of attacks.
Given, 1) the terrorists’ plans to carry out more bombings, 2) the seizure of bombing materials, 3) more suspects being identified, 4) Sri Lanka’s ongoing political dysfunction, which clouded effective security decision-making, 5) plus the unresolved sectarian friction between Muslims, Buddhists and now Christians, there would still be no reason for the Kingsbury or any other high-end hotels in Sri Lanka to reduce security for the foreseeable future.
END
Copyright © Muir Analytics 2020
