Publications

On April 21, 2019, a local terror group in Sri Lanka linked to the Islamic State launched a multi-site suicide attack that killed over 250 people and wounded several hundred others. The targets included three hotels in the capital Colombo and three churches - in Colombo, Negombo, and Batticaloa. During attempts in the following days to arrest suspects in Colombo, two more suicide attacks took place, at a hostel and an apartment building. In one attack the wife of one of the attackers blew herself up and killed two of her children and three police officers. In a second incident, during a police raid on a site where terrorists were filmed taking responsibility for the attack - which turned out to have also served as the factory where the group’s suicide belts were made - three terrorists blew themselves up, killing women and children who were in the building, along with police participating in the raid.

The common assumption that the attack was revenge for the attack on a mosque in New Zealand by an extreme rightwing Islamophobe, which killed 49 people, is questionable, since the preparations for the Sri Lanka attack began several months previously. However, it is certainly possible that the New Zealand attack advanced the date of the Sri Lanka attack.

The Islamic State took responsibility for the Sri Lanka attack in a video published by its news agency Amaq, showing eight perpetrators – all from Sri Lanka. Most of the suicide attackers were educated, middle class, and fairly well off; they had studied overseas, and included at least one who had spent time on the battlefield in Syria. The leader of the group, Hashim Zahran, who was also one of the suicide bombers, was known for some time before the attacks as an imam with radical views that he openly propounded. The security forces in Sri Lanka were given prior information about plans for attacks on churches and hotels, but due to the lack of any updates or cooperation on intelligence and operations, the information was not used to foil the attack. The island is currently still on high alert, since some of the group’s activists are still at large and armed, and there are fears they could try to launch further attacks.

The information available so far paints a bleak picture of severe intelligence and security failures, where information submitted to the Sri Lanka authorities about planned attacks was ignored. This failure had horrific consequences, in spite of the fact that the country has experience in fighting terror and just a decade ago suffered a harsh civil war, including fatal terror attacks, arising from ethnic hostility between the Sinhalese majority and the Tamil minority. The Tamil Tigers, among the world’s most prominent perpetrators of suicide attacks, were based on a secular, ethnic-nationalist ideology rather than on a distorted interpretation of Islam. Until this latest wave of terror, the Muslim minority in Sri Lanka had avoided such attacks, and limited its activity last year to destruction of statues of Buddha.

The current attack is clearly the result of the radicalization involving two local groups, National Thowheeth Janawath (NTJ) and Jammiyathul Millathu Ibrahim (JMI), from whom the attackers broke away. Some of them had links to support groups from the Islamic State in Bangladesh and India. It was apparently these links that led to the decision to carry out suicide attacks, which are the trademark of the Salafi jihadist ideology embodied by the Islamic State, al-Qaeda, and their affiliates. The fact that the terrorists came from well established families, and some had even studied in universities overseas, once again indicates that recruits for suicide missions are not drawn only from the “uneducated and ignorant, with economic and mental problems.”

An initial analysis of the attacks shows that:

a. The group’s aims were to terrorize Sri Lankan citizens, drive a wedge between them and the government, foment discord between the various ethnic groups, and encourage Muslims to withdraw from the general society in view of the expected persecution following the attacks. Indeed, it already appears that frustrated citizens have attacked Muslim individuals.

b. The attacks targeted the symbols of Christianity and Western tourists and businesspeople in Sri Lanka, identified with the local authorities. The Islamic State spokesman, Abu al-Hassan al-Muhajer, declared recently that the Islamic State, its affiliates, and its loyalists will continue to carry out attacks against the heretics who are fighting it all over the world, and that all Muslims should join its ranks.

c. Once again it became clear that the lack of effective cooperation and intelligence sharing between the intelligence, security, and enforcement agencies is a central factor in the success of terror groups to carry out their plans. Indeed, the Sri Lankan President, who is engaged in political hostilities with the Prime Minister, has already announced the dismissal of the Defense Minister and the Chief of Colombo Police, for a series of failures that facilitated the attacks. The intelligence failure is likely to have further political impact.

d. The military defeat of the Islamic State does not herald its destruction or the end of its activity - quite the opposite. Today, in spite of losing its territorial hold and rule, dozens of terror and guerilla attacks in the name of the Islamic State are still taking place in towns, districts, and desert areas of Iraq and Syria, where it established the center of its caliphate, and elsewhere in the Middle East and beyond, such as Africa and Asia. The Islamic State affiliates who are continuing their attacks show that the organization has not abandoned the fight to achieve its objectives – even without the physical control of territory.

e. The potential of a pool of thousands of Islamic State fighters held by the Iraqi authorities and Kurdish forces in Syria is significant. These authorities are hard pressed to detain these operatives and investigate them in order to determine which of them are responsible for violent actions. This pool could breed ties and cooperation between the prisoners and create the foundation of future terror. This is what happened at the Camp Bucca facility in Iraq, from where the leaders of the Islamic State in Iraq emerged and established ISIS.

f. The war between the army of the former Soviet Union and the local mujahidin in Afghanistan, reinforced by thousands of Muslim volunteers from all over the world, produced the first and second generation “Afghan alumni” who carried out terror attacks worldwide, particularly in the West, after several years had passed. There has been an absence of intensive terror activity in Western cities until now. The relative quiet enjoyed in this initial stage following the military defeat of the Islamic State and its expulsion from territories it controlled in Syria and Iraq is no guarantee that terror from “Syrian alumni” will not return to the West.

g. The Salafi jihadist ideology and the modus operandi represented by the Islamic State, al-Qaeda, and their affiliates continue to inspire terrorists, whether they are directly or indirectly linked to them, or see them as a model for imitation. The attack in Sri Lanka, a country from where only a few dozen individuals went to fight in Syria, sparks the fear that such incidents could and probably will occur almost anywhere in the world, even if only a “minority” of their citizens went to fight. A small group of experienced activists, together with local partners, are able to carry out the most murderous attacks, such as the one in Sri Lanka.

h.Notwithstanding the decline in global suicide terror bombings, the majority of which in recent years were the work of Salafi jihadist organizations, above all the Islamic State and al-Qaeda, it remains the most lethal type of operation. Thus in the first quarter of 2019 there were about 45 suicide bombings in 17 countries, killing about 478 people and wounding around 851 others. This represents a decline of about 50 percent relative to the same period last year. Over the years 2016-2018, there has been a steady drop in the number of suicide bombings: in 2016 there were about 470 bombings, in 2017 about 349, and in 2018 there were about 293 bombings (read the full report).

i. It is vital to strengthen operational cooperation and intelligence sharing between and within countries. The publicly announced assistance currently provided by the secret services of the United States, Britain, India, Australia, and Morocco is almost certainly supported by assistance from other countries.

The outcomes of the local investigation in Sri Lanka and the international cooperation will reveal further details about the methods used by the group behind the attacks and their ties with the Islamic State and its supporters. These details and the lessons of this incident, if properly learned, will help prevent or obstruct future terror plans of the Islamic State and its supporters – plans that are expected to challenge many countries in the years to come.

Thanks to Dana Kanarik, intern in the INSS Terrorism and Low Intensity Conflict Research Program, with responsible for the Asian sector, and to Aviad Mendelboim, research assistant in the program, for their help in preparing this paper.