On Tuesday, video emerged of the suspected ringleader of the attacks and seven followers, their faces obscured by scarves, swearing allegiance to the Islamic State and its leader, Abu Bakr al-Baghdadi. The Islamic State also issued a formal communique asserting responsibility for the attacks, which it said targeted Christians and “coalition countries.”
The statement embraced the suicide bombers as “brothers,” identifying them by their presumed aliases and naming the churches and hotels each of them struck.
Sri Lankan officials are attributing the attacks to National Thowheed Jamaath, a local Islamist organization, but the group has no history of significant terrorist attacks and was effectively unknown to U.S. intelligence agencies, current and former U.S. officials said.
Its most notable activity before Sunday was vandalizing Buddhist temples, said Rita Katz, co-founder of the SITE Intelligence Group, a terrorism analysis organization.
“However, ISIS generally has built its global network by recruiting from existing extremist groups around the world,” she said.
President Trump has, on different occasions, declared the caliphate defeated and destroyed. U.S.-backed forces took the last territory controlled by the Islamic State — the Syrian village of Baghouz — in March. But even as the militants eyed the impending doom of the caliphate, they regrouped in the form of an insurgency and have maintained an active presence on social media, which has long been the Islamic State’s most productive recruitment ground.
U.S. intelligence agencies have been tracking the group’s recruitment efforts and how they might encompass Sri Lanka, current and former officials said. Of particular concern are the Sri Lankan men, about 40, who left their country to fight with the Islamic State in Iraq and Syria, where they may have been exposed to the group’s methods for bombmaking and coordinating attacks.
A Sri Lankan official, who spoke on the condition of anonymity because he was not authorized to speak publicly, said that as early as 2017, the United States had warned Sri Lankan officials that the Islamic State was recruiting across Southeast Asia and that Sri Lanka could become a “hub” for the group’s activities.
There was no indication that the United States had advance warning about the Easter attacks, U.S. officials said, also speaking on the condition of anonymity to discuss an ongoing investigation. Had the United States obtained information about an imminent strike, it would have been immediately shared with the Sri Lankans, current and former officials said.
Speaking to CNN, the U.S. ambassador to Sri Lanka and Maldives, Alaina Teplitz, confirmed that the United States “had no prior knowledge of these attacks.”
The ambassador noted that “the Sri Lankan government has admitted lapses in their intelligence gathering and information sharing.”
Investigators are still trying to determine how the Sri Lankan attackers may have connected with the Islamic State and what role the group could have played.
When local groups pledge fealty to the Islamic State, it usually opens the door to an array of new resources and capabilities, Katz said. This would explain how individuals from a relatively amateur group like Thowheed Jamaath could contribute to an attack as devastating as that in Sri Lanka, she said.
Katz said that she believes the Islamic State was involved in planning the attack but that its exact role is unclear.
“The Sri Lanka blasts were both sophisticated and well coordinated, making it very likely that the attackers received some sort of training and assistance from ISIS — possibly from one of the group’s bases in the Philippines or elsewhere in the region,” she said.
“It is too early to tell the degree of involvement from ISIS — beyond inspiration and even embedding the jihadi DNA in local extremist groups,” said Juan Zarate, the chairman of Financial Integrity Network, a consulting firm, and a former deputy national security adviser for counterterrorism in the George W. Bush administration.
“That said, we should not be too dismissive of ISIS claims or capabilities,” he added. “I do think it is possible that ISIS has communicated directly or embedded with these local groups and found a way of helping plot, amplify and supercharge their capabilities and operational effectiveness on the ground. The ISIS diaspora and expertise is real, and ISIS has global designs — in South Asia and elsewhere.”
What the Islamic State lost in territory it did not lose in ideological influence. “I don’t think it’s too soon to say that defeat of the physical caliphate in Iraq and Syria was never going to be the end of the ISIS challenge,” said Nicholas Rasmussen, a former senior director for counterterrorism on the National Security Council who also ran the National Counterterrorism Center in the Obama and Trump administrations. “That is why many terrorism experts urged care and restraint on the administration in making claims about defeat of ISIS. The ideology underpinning the caliphate has reach far beyond Iraq and Syria.”
Javed Ali, a former senior director for counterterrorism at the National Security Council in the Trump administration, noted the absence of the word “caliphate” from the Islamic State’s assertion of responsibility in the Sri Lankan attacks. That suggests that “even they will accede to the notion that the physical caliphate, at least in Iraq and Syria, is gone,” said Ali, now a visiting professor at the University of Michigan. “But the notion of the Islamic State still exists. You don’t need a physical caliphate to be beholden to the group.”
Its influence has also spread to places where it hasn’t traditionally held sway. Last week, through its Amaq News Agency, the group asserted responsibility for an attack in Congo for the first time.
For decades, parts of eastern Congo have been submerged in conflict, and a number of armed groups seeking to undermine the government have taken advantage of the chaos, launching attacks on civilian and military targets.
In a statement, John D. Manley, a spokesman for U.S. Africa Command, said it now considers one of those groups, the Allied Democratic Forces (ADF), to have “meaningful ties to the Islamic State.” The group declared allegiance to the Islamic State in 2017, Manley said.
A U.S. official who works on the region said that the ties should be taken seriously, and that relationships between senior ADF leaders and foreign extremist groups go back decades.
“Not all of the ADF can be said to be part of ISIS, or even be jihadists,” said the official, who was not authorized to speak publicly about the matter and spoke on the condition of anonymity. But “some have had contact [with foreign extremists] dating back years that included training and fighting abroad.”
As Sri Lankans continued to mourn, government officials scrambled to determine how they had failed to detect cooperation between a local group, which was known to at least some Sri Lankan authorities, and outsiders.
Officials said 18 more arrests were made overnight Tuesday, taking the total to 58.
Sri Lanka’s president, Maithripala Sirisena, said in a televised address that police and security forces “would be restructured within a week” and that he expected to change the heads of all the security forces. The president acknowledged that the government had information about the local group since 2017 but said there was insufficient evidence to take legal action against its members.
India provided the Sri Lankans with specific warnings about threats, even naming the group and its ringleader, in the days before the attack, Sri Lankan officials said.
Mahinda Rajapaksa, an opposition leader and Sri Lanka’s former strongman president, ascribed the security failure to rivalries between the president and the prime minister.
“Don’t take this as a joke,” he said. “As long as the division between the president and the prime minister exists, you can’t solve this problem. My security division knew about the advance notice [of the attack]; I did not.”
While officials examined their own failures, some looked outside the country to help explain the bloody attacks.
State Minister of Defense Ruwan Wijewardene told Parliament that the bombings were carried out in retaliation for shootings that claimed 50 lives at two mosques in Christchurch, New Zealand, by an avowed white supremacist.
But others were skeptical of that connection.
“It is possible [that Sunday’s attacks] could have been because of the Christchurch attacks,” Prime Minister Ranil Wickremesinghe said at a news conference. “We cannot say yet.”
“There seems to have been foreign involvement,” he added. “Some may have traveled abroad and come back. . . . So far, it is only Sri Lankan citizens that have been taken in for questioning.”
Plots of such complexity take many months to organize, and the Christchurch shootings occurred less than six weeks ago, Rasmussen noted. “It’s also true that terrorist organizations are often opportunistic in the way that they claim justification or rationalization for their attacks, so it’s possible that the minister’s comments reflect something that is emerging in the investigation from talking to suspects linked to the perpetrators,” he said.
The office of New Zealand Prime Minister Jacinda Ardern released a statement Tuesday: “We understand the Sri Lankan investigation into the attack is in its early stages. New Zealand has not yet seen any intelligence upon which such an assessment might be based.”
Slater reported from Colombo, Sri Lanka. Amantha Perera, Rukshana Rizwie, Harshana Thushara Silva and Devana Senanayake, also in Colombo, and Shibani Mahtani in Hong Kong, Niha Masih in New Delhi and Siobhan O’Grady in Washington contributed to this report.