A security officer stands guard outside St. Anthony's Shrine in Colombo, Sri Lanka, on April 23, two days after the church was hit in a series of bomb blasts targeting churches and luxury hotels in Sri Lanka. (Mohd Rasfan/AFP/Getty Images)

Days after a series of explosions at churches and hotels in Sri Lanka that appeared to target Christians and foreigners and left more than 300 people dead, some details of who was behind the attacks and their motives are beginning to come out.

In particular, the Islamic State claimed responsibility for the attacks Tuesday, while Sri Lankan authorities said that Islamist extremists had carried out the attacks in retaliation for a white supremacist’s attacks on two mosques in Christchurch, New Zealand, on March 15, that left 50 Muslims dead.

But big, unanswered questions remain about how the attacks were possible and what links exist between the Islamic State and local extremists, if any. Here, we try to break these questions down.

Why did the Islamic State claim of responsibility take so long?

In the immediate aftermath of Sunday’s attacks, no group claimed responsibility. Local authorities pointed toward local groups — National Thowheed Jamath and the Jammiyathul Millathu Ibrahim — but hinted at outside help.

On Tuesday, the Islamic State’s Amaq News Agency claimed responsibility, putting out a statement that Christians and “coalition countries” were targeted by fighters from its organization. Amaq cited a “security source” as having provided the information.

A later Islamic State communique offered more details, including that seven fighters took part in the attacks, according to a translation by the SITE Intelligence Group. However, a photo published by Amaq of what it said was the attack group showed eight people.

The Islamic State has used Amaq to claim responsibility for attacks before. However, analysts note that it often claims attacks that it not only played a role in organizing, but also those that were simply “inspired by it.”

Rita Katz, director of the SITE Intelligence Group, wrote on Twitter that the initial message was not confirmation that the Islamic State was involved in the attack.

“The language in this statement is also typical of ISIS-inspired attacks as well,” Katz wrote on Twitter, using an acronym to refer to the Islamic State.

The delay may be significant. In past cases where attackers had tenuous links to the Islamic State, the group has waited hours or even days until it has some kind of confirmation that an attack was inspired by their theology.

“We should also keep in mind that the ISIS media machine has taken a real hit over the last few months,” said Amarnath Amarasingam, a Toronto-based expert on extremism and terrorism and a senior research fellow at the Institute for Strategic Dialogue, referring to the collapse of the Islamic State’s caliphate in Syria and Iraq.

What are the links between local groups and the Islamic State?

State Minister of Defense Ruwan Wijewardene told parliament Tuesday that two local groups had been tied to the attack: the National Thowheed Jamath and the Jammiyathul Millathu Ibrahim.

Neither group is well known. National Thowheed Jamath is a splinter group from a better-known group, the Sri Lanka Thowheed Jamath. The group had been linked to the defacement of Buddhist statues last year. The Jammiyathul Millathu Ibrahim group is less known.

A U.S. official told The Washington Post that the Thowheed group has links to the Islamic State, but their significance is unclear. A small number of Sri Lankan citizens are believed to have joined the group at its self-proclaimed caliphate in Syria and Iraq. Experts say the number of foreign fighters who returned to Sri Lanka is likely to be very low.

“The number of returning fighters is not available but it is not going to be more than a handful,” said Kabir Teneja, a fellow with the Strategic Studies program at the Observer Research Foundation in New Delhi who has studied the Islamic State’s links to South Asia.

Sri Lanka’s Prime Minister Ranil Wickremesinghe said at a news conference Tuesday that all people taken in for questioning after Sunday’s attacks were Sri Lankan citizens and that some may have traveled abroad, but he did not say where.

Amarasingam said that if it was confirmed that the attack was perpetrated by foreign fighters who had returned to Sri Lanka, “it would be the largest attack carried out by ISIS returnees anywhere.”

What motivated the attacks?

Sri Lanka has a small Christian population that makes up about 7 percent of the population. Sri Lankan Christians have not been targeted by large-scale terrorist attacks like this before.

The civil war that raged throughout the country from 1983 to 2009 was fought on ethnic rather than religious lines, and there are Catholic communities in both Sri Lanka’s Sinhalese majority and its Tamil minority.

Sri Lankan officials say that Sunday’s attacks were in retaliation for the Christchurch attacks March 15. However, at the news conference Tuesday, Wickremesinghe said this was only a possibility. “We cannot say yet,” the prime minister said.

The man accused in the Christchurch attacks, Australian citizen Brenton Tarrant, was not known to have any links to Sri Lanka. Before the attacks, Tarrant published a 74-page manifesto that contained references to Christian groups, but also made repeated reference to white supremacist beliefs.

Experts say that tensions between Sri Lanka’s Muslim minority and the country’s larger Buddhist and Hindu populations have increased in recent years, with anti-Muslim riots occurring a number of times in recent years. However, it is unclear why a local group would target Christians specifically unless there was a broader motivation.

“Mosques have been being attacked in Sri Lanka itself for some time, and we saw very little violent reaction,” Amarasingam said.

Why wasn’t the Sri Lankan government prepared?

After Sunday’s attacks, Sri Lankan officials have complained that warnings about the attacks had not been acted upon. In particular, there was a specific warning in an intelligence report that circulated within the Sri Lankan government just days earlier that the National Thowheed Jamath group was preparing to attack churches.

Opposition leaders have said that a divide between Wickremesinghe and the Sri Lankan president, Maithripala Sirisena, could have added a layer of dysfunction.

“Don’t take this as a joke,” said Mahinda Rajapaksa, an opposition leader and Sri Lanka’s former strongman president. “As long as the division between the president and the prime minister exists, you can’t solve this problem. My security division knew about the advance notice [of the attack]; I did not.”

Sri Lankan Muslim groups say that they also made warnings about growing extremism of National Thowheed Jamath after its leader, known alternately as Mohammed Zahran or Zahran Hashmi, became known for incendiary speeches. “Some of the intelligence people saw his picture but they didn’t take action,” N.M. Ameen, the president of the Muslim Council of Sri Lanka, told the Associated Press.

Sri Lanka’s security services were previously known as being fairly robust, Taneja said. That reputation, built during the lengthy civil war, is now undermined.

“The fact that reports suggest the Sri Lankan government was alerted of such attacks and still did not do enough to counter this raises serious questions on both political and police credibility,” he said.

Read more:

How terror detonated with precision across Sri Lanka

Coordinated bombings in Sri Lanka rank high on list of deadly recent attacks

Why some Sri Lankans welcomed the social media ban after bombings