Jihadist terrorists strike Sri Lanka: political division and intelligence failure

in Robert Joseph Ahola, Terrorism
0 0 0 One comment

By Jaime Luis Zapata

On Easter Sunday morning, April 21, Jihadist terrorists attacked Sri Lanka in a series of coordinated actions that resulted in 253 people dead. The attacks were favored by religious fractionalization and a political division that led to a failure in intelligence and security services. This scenario was a structure of political opportunity for an already well-established terror platform that combined support networks, wealthy coordinators and executors, local and international connections, and an efficient mixture of material and human resources. In this report, we give you a summarized account of what happened, the domestic political factors that favored the attacks, and an analysis of the actors, connections, and networks needed for the disastrous result.

“The aftermath of an explosion in St. Sebastian’s Church in Negombo, Sri Lanka, on Easter Sunday, April 21, 2019. (Courtesy: St. Sebastian’s Church)”. Source: The Times of Israel.

How the attacks unfolded

The main target was the city of Colombo, but other towns were affected: Negombo, Batticaloa, Dehiwala-Mount Lavinia and Demotogoda. Specifically, the Jihadist terrorists directed the attacks against churches and hotels. In total, nine bombings exploded in:

-St. Anthony’s Shrine, Colombo.

-St. Sebastian Church, Negombo.

-Zion church, Batticaloa.

-Kingsbury Hotel, Colombo.

-Shangri-La Hotel, Colombo.

-Cinnamon Grand Hotel, Colombo.

-Dehiwala Zoo, Dehiwala-Mount Lavinia.

-A house in Mahawila Gardens in Dematogoda in a police raid.

Source: The Telegraph.

Political opportunity for terrorism: political division that led to intelligence failure

Sri Lanka suffered a long civil war that lasted from 1983 until 2009, though its main causes can be retraced to colonial times. The tensions between the Singhalese majority and the Tamil minority gave rise to open violence. In the final stages of the conflict, 2005-2009, the president Percy Mahendra Mahinda Rajapaksa (2005-2015) led a forceful and controversial victory over the insurgent Liberation Tigers of Tamil Eelam. With the help of international factors, this strategy involved massive human rights abuses and an emphasis on the military elements over the political factors that sustained it, in a typical manifestation of an enemy-centric counterinsurgency policy model.

The end of the conflict, nevertheless, did not bring the end of the domestic tensions in a very diverse country regarding religion and ethnicity. In religion, according to the latest data, out of a population of 21.4 million, the 70.2% corresponds to Buddhists, 12% to Hindus, 9.7% to Muslims, and a 7.4% to Christians, from which more than 80% are Roman Catholic. Regarding ethnicity, almost 75% are Sinhalese, around 11% are Sri Lankan Tamils, 9% of Sri Lankan Moors, 4% of Indian Tamils, and the rest are Sri Lankan Malays and Burghers. Despite this diversity, since the end of the armed conflict, tensions seemed to have quieted down. In fact, according to Iselin Frydenlund(video), Associate Professor at the Norwegian School of Theology, in Sri Lanka there have not been manifestations of political Islam or Muslim insurgencies, but rather there has been coexistence.

But in 2016 clashes and discriminatory incitements(video) of religious and ethnic nature emerged again, especially between Buddhists and Muslims, following a worldwide trend(video) of an increase of government restrictions on religion from 2007 to 2016. Now, while the actions of Muslim groups were against state symbols or Buddhist symbols and an expression of resistance against the majority and state oppression, the attacks of Easter Sunday had a different meaning, Frydenlund said. They were attacks by a religious minority against another religious minority and cosmopolitanism. According to Amarnath Amarasingam, researcher at the Institute for Strategic Dialogue who studies extremism in Sri Lanka and the region, this international component and the animosity of Muslims against Christians was the main element that gave rise to the hypothesis that it was not a terrorist attack of only local roots, but that perhaps it received support and guidance from an international Jihadist actor as al-Qaeda or the Islamic State (ISIS).

At the same time, the attacks were preceded by Government division and instability, which arguably led to severe intelligence failures with disastrous consequences. A political crisis that started in October 2018 was the cause of a lack of coordination between political institutions and a weak Government. It has to be said that the institutional arrangements contributed negatively to this. According to Sri Lankan Ambassador to France, Buddhi Athauda, the President commands the defense ministry, which shows a lack of specialization in the Government tasks.

The political crisis started when on October 26 last year, the President Maithripala Sirisena dismissed the Prime Minister Ranil Wickremesinghe, arguing a lack of investigation over a plot to have him killed and mismanagement of the economy. Sirisena also proceeded to dissolve the cabinet, suspend parliament and order elections on January 5th. He also appointed former President Mahinda Rajapaksha as PM. This meant an irregular transfer of power in the oldest democracy in Asia in which universal suffrage has been effective since 1931. On November 13, the Supreme Court put an end to Sirisena’s adventure ruling the actions unconstitutional and calling Sirisena to reinstate Wickremesinghe, but even on November 15 rival lawmakers got into a physical fight at the parliament.

This division affected internal affairs up to the point of compromising national security. Reports say that different factions of the police, intelligence and military are aligned to different politicians and political parties. According to Cabinet spokesman and Health Minister Rajitha Senaratne, the PM and his Cabinet were in the dark about intelligence information previous to the attack. In particular, the meetings of the Security Council were run without the PM’s participation since October. The PM asserted the same lack of warnings. Senaratne said that information about a possible attack was available since at least April 4 from Indian intelligence sources, but was not passed on to the PM. A detailed letter by the chief of national intelligence even referred with proper names to the members of the terrorist organization, but the PM was unaware of it. There was also a memo dated April 11 and signed by Sri Lanka’s Deputy Inspector of General Police Priyalal Dissanayake which remained unknown to the PM’s office.

In fact, Sri Lanka had been receiving multiple signals and warnings that something was taking place since January. In this month, Sri Lanka’s security forces found 100kg of explosives and 100 detonators in a natural park, detaining four Muslims of an extremist wing. As a consequence of these failures, Sri Lanka’s police chief Pujith Jayasundara and defense ministry official Hemasiri Fernando have resigned. Sri Lankan President Sirisena has said that this could be a new strategy of ISIS: to profit from small countries with soft and weak intelligence apparatuses.


Terrorism is the expression of political dissent through organized and irregular violent means in order to generate psychological effects in an audience. Jihadism is a form of terrorism with ideological roots in Sunni Wahhabist and Salafist schools of Islam, wanting to return to the earliest stages of its practice, isolating the community of believers from foreign and modern influences.

What has come to be termed Global Jihadism is the combined of worldwide manifestations that follow that objective and that include organized and hierarchical structures of the al-Qaeda type, or those with a territorial basis trying to exert a monopoly on violence as ISIS, or isolated actions of the lone wolf type, or even as a mixed structure with cells and networks.

Global Jihadism has turned out to be the most adaptable species of violent political dissent. The adaptations that it makes have an impact in their strategy and organizational structure, affecting also the effectiveness of their attacks. The most efficient Jihadist structure ideally has a combination of several strategic elements, and the more they are present in a potential terrorist act the more damage it will cause. Such elements are support networks, political entrepreneurs, hierarchical and decentralized structures, common values, use of imperfect information, and material and human resources. As we will see, besides all the contextual elements (divisions of ethnic and religious nature and intelligence failures) that were a structure of political opportunities for the occurrence of the Easter Sunday attacks, the strategic elements were very present and they help to understand the extent of their success.

1. Support networks. They stimulate cooperation and collaboration and can function as fora for establishing connections. They can be a complex of individual citizens, Mosques, or cultural organizations infiltrated by terrorist agents or sympathizers.

The first intelligence reports referred to a not so known organization called National Thowheeth Jamaat, with variations as Towheed Jamath, Tawheed Jamath, Nations Thawahid Jaman and National Thowfeek Jamaath. In any case, Thowheet stands for oneness of God and Jamaat for brotherhood. This organization took part in the incitements and clashes of religious nature mentioned previously, vandalizing Buddhist statues in 2016. It had been accused of promoting hatred, fear, and division, indoctrinating children and provoking the Buddhist majority. The leader and secretary of the group, Abdul Razik, had been detained in 2016 for comments about other religions and in November was arrested for inciting religious disharmony. Another organization accused of taking part in the attacks is the Jammiyathul Millathy Ibrahim, about which there is even less information available.

The NTJ took roots and developed in Kattankudy, a town near the city of Batticaloa, in the Eastern Province, and where Salafism and Wahhabism have prospered thanks to funding by Persian Gulf groups over the last years. Kattankudy is also the place of origin of the leader of the terrorists, Mohammed Cassim Mohamed Zaharan, alias Zaharan Hashmi. Several chapters with the same name of the organization have been formed in other countries with Sri Lankan communities. However, the NTJ’s origins can be traced back to South India, in the state of Tamil Nadu in the early 2000s, according to Saroj Kumar Rath, a terrorism expert at the University of Delhi. Other sources also confirm this information. Another expert, Iromi Dharmawardhane, from the Institute of South Asian Studies in the National University of Singapore, says that an organization of similar extremist character operated there under the name of Tamil Nadu Thawheed Jamaath and probably influenced the NTJ. It is also believed that the NTJ splintered from the organization Sri Lanka Thowheed Jamath (SLTJ) in 2016.

The NTJ is said to have between 100 and 150 members, while the other group mentioned, the Jammiyathul Millathu Ibrahim has been recruiting for ISIS since 2015 and has from 150 to 200 members.

2. Political entrepreneurs. These are individuals or agents that assume the costs of starting the terrorist enterprise and of coordinating the actions needed in order to establish the organization and carry out the objectives.

One of the two bombers who stroke the Shangri-La hotel, Insan Setiawan, also referred to as Seelavan, was the owner of a copper factory. Another one, Jameel Mohammed Abdul Latheef, and the only one whose attack failed was educated in Britain and did postgraduate studies in Australia before returning to Sri Lanka. Overall, they were well-educated, had traveled abroad and come from middle and upper-middle class families, having financial stability. According to experts, the operation must have cost between $30,000 and $40,000, so there must have been good financial support. 

3. A combination of hierarchical and decentralized structures. The organization can be more effective if it is large enough to have sufficient material and human resources, allowing it to give good incentives for those who participate. But it also needs to have the support of decentralized networks, dispersed to amplify the local knowledge and facilitate the deployment of activities and resources, with a degree of autonomy. They also serve as an incentive to make members feel that their contribution matters.

The NTJ does not have a complex hierarchy or organizational structure, and groups of this kind are preferred by ISIS to establish links and cooperation. This merge with local groups is being used as a strategy by ISIS at least since 2000, with the attack of Jemmah Islamiyah in Indonesia. Another example was the 2005 attack in Jordan at the Grand Hyatt hotel. According to an ISIS member arrested by the Indian intelligence in Tamil Nadu, he trained suicide squads in Sri Lanka, starting to prove the link between the NTJ and ISIS, not only ideologically but also operationally. The first assumptions were that there was important support from an international Jihadist organization, given the degree of planning and coordination involved in the attacks. This was confirmed when ISIS claimed responsibility through its news agency Amaq.

4. Common values. They could be the result of religion and can be intensified by blood ties, or a long term friendship. Religious leaders are very relevant in this case because they emphasize the sense of belonging to a common identity, motivating sacrifice and unselfishness.

Reports say that the leader of the NTJ was Mohammed Cassim Mohamed Zaharan, alias Zaharan Hashmi. He was very active in his community preaching slaughter against other religions and even Muslims that did not agree with the extremist creed. In an ISIS video that claims responsibility for the attacks, he appears directing the group in a swear of allegiance to its chief Abu Bakr al-Baghdadi.

Hashim received support from his family, as was shown when Sri Lankan security forces raided a house in Sainthamaruthu, near Kattankudy. There was an exchange of gunfire and three explosives were detonated. The bombers were killed, along with six children, three women, and other people. In total, 6 suspected Jihadist terrorists and 10 civilians. Some of the persons killed were Hashim’s relatives. Police forces found there even more explosives and Jihadist paraphernalia.

5. Use of imperfect information. Information is used for maximizing the reach of its ideological goals, therefore it needs to produce propaganda. The propaganda is directed towards the enemy and towards a potential contributor. It generates fear among the target population and motivates the potential contributor by signaling that his actions can be of huge difference.

As was shown, the NTJ and its leader exploited religious tensions in Sri Lanka. At the same time, the Sri Lankan Government fell into this trap by asserting publicly that the attacks were a response to the massacre in New Zealand on March 15, when a white supremacist started shooting at a Mosque. However, as was shown, the attacks in Sri Lanka seem to have been planned months ago.

6. Material resources. They need to be enough for financing, deployment of logistics, and training. Technology can also be part of this area and it must allow the execution of the attack as fast as possible with the greatest effect. In this sense, there needs to be real-time communication and powerful explosive devices and weapons.

The attacks must have required great logistical capacity and operability, as well as months of planning. At the same time, military-grade explosives and safe houses and workshops for bomb-making must have been needed. Stratfor analyst Scott Stewart agrees with these claims. For him, the case that all of the materials were detonated and did great damage, using military-grade explosives, shows a high degree of logistics network and funding. Stewart says that the type of explosive materials used, (C4, gelignite and Urea Nitrate) were more powerful than TNT, TATP or ANFO.

7. Human resources. They are the active agents of the operation and often must involve experienced combatants, intelligence gatherers, and skillful operative coordinators and executors. They are more effective when there is an interlinked dependency of the members, a chain of relations in which any member is important enough so to allow the act to happen.

In 2016, thirty-two Sri Lankan Muslims of upper-class families joined ISIS in Syria. With ISIS losing territory, some of these combatants returned and established links with local networks. In short, it is a similar phenomenon to the role of the returnees of al-Qaeda: they are rich in training and connections. It is said that Jameel Mohammed Abdul Latheef had trained with ISIS in 2014 from 3 to 6 months and then went back to Sri Lanka for recruitment and carrying out attacks. However, other sources claim that he only got as far as Turkey, and did not make it to Syria. In any case, Stewart says, there were people who went abroad and return to train locals. Besides, the making of the bombs and detonators implies high competence and skill. At the same time, In order to avoid any defection and ensure commitment, there needs to be continuous support by a handler.


As was shown, a series of factors of contextual and strategic nature was key for the disastrous effects of the Jihadist terrorist attacks in Sri Lanka. It is likely that the contextual elements of religious, ethnic and political division remain, and these will keep affecting the security and intelligence apparatus. All other measures could be effective in the short term but absent a deep reform that gives neutrality and independence to the security apparatus, while keeping political elites accountable, the political opportunity structure will remain, and Sri Lanka will continue to be attractive as a new basis for the Global Jihad.

It is almost inconceivable that around 300 Jihadists, counting the members of the NTJ and the Jammiyathul Millathy Ibrahim, lived without being checked or watched by the security apparatus. Other groups in the Indian Tamil Nadu must be inspected in order to avoid any dispersion of Jihadist cells and former combatants around South Asia looking to establish local support, that with the combination of material and human resources could give rise to a strong and international terror network.

  1. Reply

    The author here.
    “This merge with local groups is being used as a strategy by ISIS at least since2000, with the attack of Jemmah Islamiyah in Indonesia.”
    Correction: ISIS did not exist at that time. The organization that supported Jemmah Islamiyah was al-Qaeda.

Leave a Reply

Your email address will not be published. Required fields are marked *