From the Ruins of the Caliphate: Sri Lanka’s Bloody Easter

No sooner had the news of the serial bombings in Sri Lanka on Easter Sunday spread than fevered attempts were made to pin the attacks to the known brands of international terrorist outfits like the Islamic State (IS) and Al-Qaeda in the Indian Subcontinent (AQIS).

While a handful of experts argued that the “DNA of the attacks” matched that of IS and that the scale clearly shows signs of the involvement of a foreign hand, some others disagreed and said this looked to be more up AQIS’ street.

On Tuesday, two full days after the attacks, an account on Telegram claiming to be “official IS” sent out a message taking responsibility for the attacks. This was followed by a longer press release and a video showing the supposed attackers in front of the Islamic State’s black flag, swearing allegiance to the cause of the Caliphate. While that invariably closes the debate over which brand the attacks will be associated with, not everything adds up neatly.

The Easter Sunday bombings might actually herald a new era of pan-South Asian jihadist violence — one that has learned some hard lessons from the fall of the Caliphate in Mosul.

Is It IS?

Before IS claimed the attack as their own, three main reasons were cited by those who said the group was responsible. First was the choice of Christian churches (over sites specific to Sri Lanka’s Buddhist majority) and the suggested plot that this was a revenge attack for the Christchurch mosque shootings. Second was the “scale of attacks,” which according to some could not have been achieved without foreign assistance. Speaking to the Sri Lankan parliament, Prime Minister Ranil Wickremesinghe said “evidence had been found on foreign links of the attacks.” A third element cited by those arguing for IS culpability was the use of suicide bombers, which is infrequent in South Asia but very common for IS in the Middle East.

It’s important to look carefully at the assumptions that underline these reasons, because on closer examination, none are foolproof identifiers of IS.

Sri Lanka witnessed one of the world’s bloodiest and longest civil wars in modern history from 1983 to 2009 when the Tamil secessionist movement was at its peak. During this time coordinated bombings using improvised explosive devices (IEDs) were a regular phenomenon.

The Liberation Tigers of Tamil Elam (LTTE) extensively used IEDs against an array of targets, including Sinhalese residential areas, high-value targets like lawmakers and heads of state, and financial hubs like the Central Bank of Sri Lanka.

The Tamil separatists were not alone in using such tactics. Maoist offshoots of the erstwhile Ceylon Communist Party regularly used IEDs and hand-assembled mines to carry out ambushes and attacks. In fact, through the now-defunct Revolutionary Internationalist Movement, Sri Lankan guerrillas had well established channels of skill sharing and training with the Maoists of India and Nepal.

While Tamil separatism may now be a spent force, the skills involved in making IEDs, the availability of the raw material needed, and the training and organization required to plan and trigger them in unison are well within the reach of several local outfits.

“The explosives used in these attacks are available all around Sri Lanka,” Sirish Thorat, a private intelligence expert specializing in the Maldives and the Southern Indian peninsula, said in an interview with The Diplomat. “Even fishermen use it to bomb shoals of fish! Wouldn’t IS have something better?”

As for suicide bombings, before IS or even al-Qaeda were even conceived, the LTTE had an entire wing dedicated to this form of warfare.

As early as 1987, the LTTE was using suicide bombing tactics. On July 5 that year, Vallipuram Vasanthan drove an explosive-laden truck into the Sri Lankan military base at Jaffna and killed 40 military men, sending political shockwaves through the establishment. The successful attack led to the formation of the feared and revered Black Tigers unit of suicide bombers.

Just as jihadists do now with their suicide bombers, the Black Tigers were personally vetted by the chief (in the LTTE’s case, Velupillai Prabhakaran himself), and they were made to undergo at least a year of isolated indoctrination before becoming commissioned operatives.

Over the decades the Black Tigers suicide bombers carried out several mass bombings like the Easter Sunday attack and took down super high-value targets like Indian Prime Minster Rajiv Gandhi in 1991 and Sri Lankan President Ranasinghe Premadasa in 1993, as well as several high ranking ministers and parliamentarians.

The LTTE learned suicide bombing and the use of explosive laden trucks from contemporary Middle Eastern insurgencies, but the rigor and discipline they brought to this form of warfare changed it forever. In a way, the post-9/11 jihadist movements learned from the Sri Lankans and not the other way round.

So to see IS influence simply in a man carrying a backpack filled with explosives and blowing himself up is at best myopic, and at worst an agenda-driven conclusion drawn disregarding a whole body of well recorded and recent history.

By far the most non-IS like feature of the Easter bombings was the time taken by IS to make their claim.

Speaking to The Diplomat, Hormis Tharakkan, a former chief of India’s intelligence agency, the Research and Analysis Wing (R&AW) who specialized in the southern Indian sector, took a jibe at the IS claim, saying: “Looks as if ISIS came to know [of the attacks] from the media!”

Often in the past, IS sent out messages declaring their plans to attack a city or a region ahead of the actual strike. No such warning was given out before the Easter bombings.

Furthermore, IS has a demonstrated history of taking credit for the smallest of deeds by Muslim insurgents, no matter how remotely they were connected to the main network based in Syria and Iraq. This habit is an essential part of their propaganda tactics of appearing larger and more global than they actually were.

In the Holey Artisan Bakery attack in Dhaka, Bangladesh, IS imparted no real military training nor provided any funding or matériel to the hostage-takers. Nevertheless, they had their promotional material ready well before the hostage-taking had started. And even before the smoke and dust settled at the bakery, photos of the hostage takers posing with their black flags were shared on the internet, accompanied by declarations of gratitude and extolment to the fallen martyrs.

In the case of the New York Port Authority Bus Terminal bombing, the wannabe Bangladeshi terrorist Akayed Ullah, was “self-radicalized” — meaning all he did was watch videos and consume jihadist promotional material online. Even the bomb he tried to detonate on Christmas Eve was a dud and didn’t do any real damage. Yet IS’ internet channels immediately hailed him as one of their own. This genre even has its own name now: IS “inspired” attacks.

But in the Sri Lankan case, no known IS social media handles came out with claims or prepared propaganda for a good two days. Even the darknet sites and bulletin boards frequented by IS supporters have continued the deathly silence that has descended on them since the onset of the Russo-Syrian-PKK offensive on Mosul.

The first IS claim came on Tuesday, through a Telegram handle claiming to belong to Amaq — IS’ official publicity organ.

An al-Qaeda Connection?

“Al-Qaeda is better at exploiting local strife than the IS ever was,” Sirish Thorat, the private intelligence gatherer, said. “There has been a lot of strife between Muslims and other communities in Sri Lanka and there is obviously a good amount of resentment and anger, which can be directed towards acts like the Easter bombing.”

There is another good reason to name AQIS as a more likely candidate for the Easter Sunday bombings — the fact that the Indians and Bangladeshis knew about it before anyone else.

According to sources close to Indian intelligence who spoke to The Diplomat, R&AW and the Intelligence Bureau (IB) picked up “extremist chatter” through their signals intelligence arm, the National Technical Research Organisation (NTRO). A source in the Bangladeshi Directorate General of Forces Intelligence (DGFI) also confirmed picking something up in their locality and passing it onto the Indians.

This information was passed to the Sri Lankan security authorities through a diplomatic channel via a report that The Diplomat has viewed.

The report is as detailed as intelligence briefings go and lists target sites and accurately names the operatives. But other than naming a local group, the National Towheed Jamaat, the agencies remained noncommittal about naming any international group involved.

Speaking to this reporter, a recent member of the board of advisors to the national security advisor of India said: “I have reason to believe that Indian intelligence did pick up some extremist chatter that led to an initial suspicion that the Indian high commission in Colombo and some hotels may be targets of suicide bombing soon. So the Sri Lankans were perhaps alerted. But they still have to build on the initial Intel and figure who exactly was behind the attack.”

India’s SIGINT and HUMINT capabilities are almost entirely focused on Pakistan. Given that al-Qaeda’s traditional South Asian networks have been very close to the Pakistani military establishment, Indian intelligence could have picked up said “extremist chatter” from the AQIS network alone.

Rana Banerjee, a former R&AW operative responsible for the Af-Pak region, agreed, saying: “India’s main focus and strength have been in that [Af-Pak] region and we get good SIGINT from these listening posts,” he said. “So yes, there is a strong likelihood of the news spreading through the AQIS network.”

Yet in the same breath, he added: “But what we have [from the Sri Lankan attacks] is too little to go on.”

In part, skepticism about AQIS involvement is rooted in the fact that the once smoothly functioning hierarchy of anti-India jihadist groups is now in disarray.

On the one hand Bangladesh, Nepal, Bhutan, and Afghanistan have carried out sustained crackdowns on anti-Indian groups that had bases on their soil. On the other hand, the Pakistani military and its intelligence wing, the Inter-Services Intelligence (ISI), are reported to be severely cash strapped and unable to keep its flock intact. As a result, even long-time operatives of the subcontinent have turned their coats, gone freelance, or hung up their insurgent boots and taken on regular jobs.

The Local Element

While there can be little disagreement about the “foreign hand” in the Easter Sunday bombings, the local political and criminal scene demands close scrutiny. What lies within points to designs of greater enormity than just the April 21 bombings.

“This is no ‘intelligence failure,’” Saikiran Kannan, a Singapore-based, Tamil-speaking hacker, said in an interview with The Diplomat. A financial consultant by day, Saikiran specializes in open source investigations, tracking and analyzing jihadists on social media.

“Forget Indians giving foreign intelligence to the Lankan government, there were inputs from the country’s own Muslim population that said something was up. The Lankan security establishment just didn’t act.”

According to Saikiran, there can only be two explanations for this inaction.

Either the Sri Lankan military and police didn’t know how to act on this input — which in Saikiran’s words is “rather hard to sell” — or elements in the country’s polity, including the defense and security establishments, wanted this to happen as a way of damaging the incumbent government.

Sri Lanka goes to polls in 2020. Given the tradition of acrimonious political infighting in the country, using an event as violent as the Easter bombings for short-term political gains isn’t that far fetched.

Prime Minister Ranil Wickremesinghe and President Maithripala Sirisena have been bitter political rivals since the latter abruptly sacked the former in October 2018 and installed Mahinda Rajapaksa, the country’s former president, as the new premier.

Though Rajapaksa was ousted less than two months later when the Sri Lankan courts overruled Sirisena’s move, the Wickremesinghe-Sirisena rivalry hasn’t died out.

In fact, some of Colombo’s political journalists (who cooperated with the writing of this report) minced no words in saying how the bombings dovetail into election season and the internecine power struggles of the Sri Lankan polity.

What lends credence to this conspiracy theory is also the overt bias shown by the military establishment in favor of the president.

Notably, Sirisena also holds the country’s defense minister portfolio and the military establishments report to him, while the civilian police report to Wickremesinghe.

According to Dr. Rajitha Senaratne, a government spokesperson, there had been multiple warnings issued since April 4. The first memo was issued by Sisira Mendis, chief of national intelligence, to the inspector general of police on April 9.

Deputy Inspector General (DIG) Priyalal Dassanayake then wrote to a slew of agencies — including the Security Division, Judicial Security Division, Retired Presidents Security Division, Acting Directors of Diplomatic Security Division, and Acting Directors of Retired Presidents Security Division — on April 11 requesting that security measures be tightened.

Nothing was done.

Sirisena, who left the country on a private trip to Singapore before the Easter bombings, has to date refused to confirm or deny if he was aware of these reports.

Moreover, when Wickremesinghe called an emergency meeting of the security heads immediately after the bombings, several key members failed to show up.

“I can say with 90 percent surety that was some support within the [security] agencies as much as it was IS inspired,” Saikiran said.

Saikiran’s views about deliberate inaction by the Sri Lankan security agencies tie in with The Diplomat’s aforementioned source in the national security advisory board of India.

“We can’t force the Lankans to act,” he said. “But we couldn’t afford an attack on the Indian High Commission. So we independently went into a security overdrive and took a slew of protective measures. We reinforced the inner perimeter, slowed down visa processing, and heavily profiled visitors to the embassy.”

The Usual Suspects

Another glaring aspect of this story that deserves attention is the manner in which the Sri Lanka government apparently turned a blind eye to the hateful preaching of Zahran Hashim, reportedly the lead suicide bomber, and the wealthy Ibrahim family that sponsored him and later participated in the Easter Sunday bombing.

Hashim wasn’t someone who was under the radar; he was quite prominent.

An alumnus of several fundamentalist madrasas in Sri Lanka, India, Pakistan, and the Maldives, Hashim reportedly travelled to Syria. When Hashim returned to his homeland in Kattankundy, he decided to start his own mosque and madrasa. He broke from the famous Sri Lankan Tawhid Jamaat and started a group called the National Tawhid Jamaat. It was this group that Indian intelligence named in its communique warning of an impending attack.

Hashim had been openly preaching hate and calling for violent jihad for several years.

The Islamic State’s official internet video channel, Al-Ghuraba, had featured Hashim’s Tamil language videos, in which he exhorts young Sri Lankan Muslims to dedicate themselves to the cause of the Caliphate by taking up arms, giving money, and joining the jihad.

Hashim had also had several run-ins with the law, including once when several Muslim families in Kattankundy reported him for hate mongering and trying to cause rifts in the community. As per some reports, the Criminal Investigations Department (CID) of the police had a running file on him.

The involvement of the Ibrahim family is another clear indicator that strong local political undercurrents are at play here. The Ibrahims are a family of rich spice traders who have hobnobbed with the Sri Lankan political elite. Three members of the Ibrahim family were part of the suicide squad: brothers Inshaf and Ilham, and Inshaf’s wife Fatima.

Fatima wasn’t named early on, but according to Saikiran Kannan, Fatima can be seen in the IS photo standing behind the men.

On April 24, M. L. A. M. Hizbullah, governor of the Eastern Province, was called in for questioning by the CID for his proximity to the National Tawheed Jamaat. In addition to being close to the Ibrahims, Hizbullah is a well-known Sirisena/Rajapaksa loyalist who chose to go against Ranil Wickremesinghe during the October 2018 turmoil.

The Easter Sunday bombings may have breathed new life into the Islamic State brand in its post-Mosul existence. But this new version of IS won’t just be a copy of what was in Syria and Iraq; it will be South Asia’s own. One that has evolved from the failed mission in Syria and adapted to suit local political and social conditions.