Two Sri Lankan Muslim extremists learned how to build the explosive devices that killed more than 250 people in churches and hotels by studying Islamic State designs on the internet and conducting trial-and-error tests, including one that cost a bomb maker several fingers last year, people involved in the probe said.
One plotter, Ilhan Ibrahim, the radicalised son of a wealthy Colombo spice trader, appears to have financed and organized the six nearly simultaneous attacks largely on his own, these people said.
Before the attacks—which were a year in the making—authorities were aware that all but one of the bombers were involved in extremist activities or suspected of other crimes, they said.
A lack of coordination between arms of the government hindered action being taken on the information, officials said.
The attacks showed Islamic State’s influence even in decline, and the ability of a small group of self-organized extremists to act on its message in a country not usually considered a target.
Investigators have drawn these early, still tentative, conclusions, which haven’t previously been reported, about the plot through evidence gathered from the computers and possessions of suspected plotters, caches of munitions, clothing and materials from safe houses associated with them, analysis of the bombs and interrogations of people arrested who either participated in the plot or knew those who did.
Questioning of members of the group arrested after the attacks suggests the targets and the timing—churches and hotels on Easter morning—were aimed at boosting Islamic State as its self-declared caliphate was collapsing, the officials said.
Islamic State had urged followers that couldn’t reach Syria to target their home countries.
“We haven’t seen anything on this scale before with the ISIS brand that’s not directed by them,” said Raffaello Pantucci of the Royal United Services Institute for Defence and Security Studies in London.
Gen. Senanayake said about three-quarters of the wider group of Sri Lankan plotters either died or have been arrested. Authorities said eight militants—including two women—who participated in meetings about the plot but didn’t join are among those being held, adding that at least some of them hoped to bomb other targets later.
Some people who participated in meetings where suicide attacks were discussed remain at large, he said. Authorities added that they believe they have secured most of the bomb-making materials and other equipment intended for additional attacks based on interrogations of those arrested.
Some religious services were canceled on Sunday and Catholic schools will remain closed on Monday when public schools reopen. The country remains under a state of emergency.
Those familiar with the investigation said Rilwan Hashim, brother of key plotter Zahran Hashim, and another bomber they knew, Mohammad Hasthoon, built the explosives for the attacks. Rilwan died in an explosion during a police raid after the attacks in eastern Sri Lanka, and Hasthoon detonated himself at a church in the town of Negombo.
Ilhan Ibrahim, who detonated himself with Zahran Hashim at the Shangri-La hotel, was the driving force in organizing and carrying out the complex attack, investigators said. When police entered Ibrahim’s home later that day, his wife detonated herself there, killing herself, her two children and three police officers.
Some plotters had connections to Islamic State. Jameel Mohammed Abdul Latheef, who was supposed to bomb the Taj Hotel, had been radicalized while studying in Australia and may have kept up contact with Islamic State veterans he met. Zahran Hashim once played what he said was a recording of an Islamic State official putting him in charge of the group in Sri Lanka, but authorities said they were unsure of the recording’s veracity.
Investigators believe he exaggerated the extent of his Islamic State contacts to his co-conspirators, repeatedly falsely claiming to receive instructions from Syria.
He appears to have made contact with veteran Islamic State fighters during illicit trips to India while hiding from Sri Lankan police after they sought to arrest him for an altercation in 2017. But they haven’t found evidence of him being in contact with top Islamic State figures. Investigators believe Rilwan also traveled to Turkey, where he may have received training, and was in contact with another Sri Lankan in Syria, but he was killed in 2017, Gen. Senanayake said.
The brothers’ preparations for a bomb attack began as long ago as early 2018, when Rilwan lost several fingers and injured his eye in an accident involving explosives, people familiar with the investigation said. He continued to experiment with explosives, using designs from Islamic State-related sites on the internet, the officials said.
They learned to use washing-machine timers as triggering mechanisms and blew up a motorcycle days before the attacks as they tried to refine the devices, the officials said. They used the same kind of timer for a car bomb on Easter Sunday—parked outside Saint Anthony’s shrine in Colombo and designed to strike survivors and rescuers after the suicide attacker had hit the shrine—but it didn’t explode.
More than a dozen of Zahran Hashim’s followers from the two militant groups gathered in early April, in the town of Panadura 15 miles south of the capital and decided to put the attacks in motion for Easter, Gen. Senanayake said.
Some who attended the meeting chose not to participate, arguing the group should wait to stage an even-larger attack including coming Buddhist festivals that would be heavily attended by Sri Lanka’s majority Sinhalese Buddhist community, the officials said.
At some point after meeting in Panadura, the eight bombers recorded a video of themselves led by Hashim declaring allegiance to Islamic State leader Abu Bakr al-Baghdadi for release after the attacks.
On April 19, the group began preparing bombs in the Colombo area. They were given to the bombers on April 20, the day before the attacks. The hotel bombers checked into their rooms using their real names, people familiar with the investigation said.
Mohammad Azad, the one bomber who Sri Lankan authorities hadn’t picked up on before the attacks, traveled hours to near his home on the east coast, where he stopped in a mosque to pray and rest in the early hours of Easter morning. Then he headed to Zion Church as the Easter service was beginning.