On Security

What the Easter Attacks in Sri Lanka Tell Us About the Islamic State

Scott Stewart
VP of Tactical Analysis, Stratfor
9 MINS READApr 30, 2019 | 09:00 GMT
Candles in the shape of Sri Lanka on April 29 in Ahmedabad, India.

Candles in the shape of Sri Lanka on April 29 in Ahmedabad, India, to show solidarity with victims of the Easter 2019 attacks in Sri Lanka.


The April 21 attacks against three churches and four hotels in Sri Lanka rocked the island nation and have reverberated around the globe. While the location of this attack -- Sri Lanka -- was a surprise, that an attack happened was not. We had warned our Threat Lens clients that we anticipated attacks against houses of worship over the Passover and Easter holidays -- although we certainly were not specifically expecting one in Sri Lanka. Due to the high death toll in these attacks, they have generated much press coverage, some of which has presented these attacks as something unprecedented, or as an accurate gauge of the status of the Islamic State. But these attacks were neither....

The attacks against three churches and four hotels in Sri Lanka on April 21, Easter Sunday, rocked the island nation, reverberating around the globe. While the attack location — Sri Lanka — was a surprise, a holiday attack of some kind had been anticipated. In fact, Stratfor's Threat Lens team had warned clients of the elevated threat of attacks against houses of worship over Passover and Easter.

The high death toll in the Sri Lanka bombings generated much media attention, and some reports presented the attacks either as unprecedented, or as a gauge of the Islamic State's status. But neither of those assertions were accurate.

The Big Picture

The Easter attacks in Sri Lanka are a reminder of the persistent global threat posed by Islamic State-linked jihadists. In locations where they are given ample operational space — either because of an authority vacuum or an underestimation of the threat they pose — those jihadists will be able to plan and execute deadlier attacks than in places where they are under heavy pressure.

Global Insurgency

The Sunni jihadist movement has been a global phenomenon since 1988 with the creation of al Qaeda. Founded by Osama bin Laden, a Saudi, al Qaeda has always attracted members from around the world and had operations spanning the globe. Although its base of operations was in Afghanistan (except for the period from 1992-96 when it was in in Sudan before returning to Afghanistan), it plotted or conducted attacks against U.S. interests in a number of places, including, of course, the United States itself. It also sent professional cadres to fields of jihad such as Chechnya and Bosnia to bolster the capabilities of jihadist fighters there and to provide those forces with in-theater training.

Al Qaeda also offered advanced terrorist tradecraft training to militants who then took those skills back to their home countries, or traveled to third countries to launch attacks. In some cases, these trained terrorist cadres augmented or improved the capabilities of local militant groups such as the Egyptian Islamic Group or the Salafist Group for Preaching and Combat in Algeria. In other cases, these trained individuals helped organize and equip grassroots cells that were eager to conduct attacks but lacked the skills to do so.

Among them were Abdel Basit Mahmoud Abdel Karim (aka Ramzi Yousef), who organized and equipped a group of grassroots jihadists in New York that the FBI had assessed as incompetent, turning them into a cell capable of building a huge truck bomb and using it to attack the World Trade Center. Likewise, after al Qaeda training, Riduan Isamuddin "Hambali" and Noordin Top used their new advanced terrorist tradecraft to turn a ragtag bunch of jihadists in Indonesia into a force capable of conducting the Bali attack and executing a string of vehicular bombings against hotels and the Australian Embassy.

Jihadists returning home from war zones often used their battle-honed skills to launch attacks, as in 1992 with the first al Qaeda attacks against U.S. interests in Yemen, and in a host of attacks elsewhere. The flow of men and skills from training camps and war zones that fed the global jihadist insurgency is chronicled in Aiman Deen's autobiography, Nine Lives, co-authored by Paul Cruickshank, a work that provides a great historical description of the transnational nature of al Qaeda from an insider's perspective.

Jihadists returning home from war zones often used their battle-honed skills to launch attacks.

This flow of people and skills did not end, of course, after 9/11. The 2001 U.S. invasion of Afghanistan dispersed many of the jihadists sheltering there, and the 2003 invasion of Iraq served as a magnet for global jihadists who came to fight coalition forces and receive training and combat experience. The emergence of the Islamic State's self-declared caliphate in Iraq and Syria in 2014 in turn precipitated the largest migration of jihadists in modern history, with tens of thousands of fighters and their families responding to the group's call to emigrate.

When a U.S.-led coalition engaged the Islamic State, leading it to lose territory, a subsequent and substantial outflow of jihadists began. Some fighters traveled to neighboring countries such as Turkey to conduct attacks. Others, using the flow of refugees to camouflage their exfiltration, executed high-profile attacks in Paris and Brussels. Still more traveled to Libya where they helped strengthen an emerging wilayat in Sirte closely aligned with the core Islamic State. Returning fighters also influenced the leadership of existing militant groups, such as Ansar Beit al-Maqdis, which became the Wilayat Sinai, or the Islamic State's branch in the Sinai Peninsula.

Still other foreign fighters eventually made their way to places like Bangladesh, the Philippines and Indonesia, where they helped establish cells to launch attacks that caught local officials off-guard: Dhaka saw a surprise attack in 2016, followed by one in Marawi in 2017, and in Surabaya in 2018. A few days ago, Sri Lanka joined that list in much the same manner.

The State of the Islamic State

The current status of the Islamic State cannot be gauged without an understanding that it is a global ideological movement, not a single organizational entity. While all elements of the Islamic State have sworn allegiance to its self-proclaimed caliph, Abu Bakr al-Baghdadi, they are operationally quite distinct. Stratfor analyzes the Islamic State by breaking it into three main components: the Islamic State core organization in Iraq and Syria, the various regional franchises from West Africa to Southeast Asia, and grassroots jihadists scattered throughout the world.

An attack such as the one in Sri Lanka (or Surabaya or Marawi for that matter) tells us quite a bit about the local jihadist franchise and about the durability of the global movement, but it tells us very little about the state of Islamic State core. Had the core conducted the Sri Lanka attacks directly in much the same way the al Qaeda core conducted the 9/11 attacks, that would be different. But for now, it appears a local cell in Sri Lanka that may have included personnel trained by the core — and that had some contact with the core — carried out the Easter attacks. They do not, however, appear to have been a compartmented operation launched by the core along the lines of 9/11.

This map shows ethnic majorities by district in Sri Lanka

The newly minted jihadist franchise in Sri Lanka made the island nation this year's Islamic State surprise breakout theater, and I expect it to follow a trajectory similar to those of its three predecessors. In the wake of the Dhaka attacks, Bangladeshi security forces clamped down hard on jihadists. It took them many months and the help of international allies to finally track down the key participants, but they have managed to keep the jihadist threat mostly in check since March 2017. And while jihadists have not been eradicated from the southern Philippines in the wake of the battle of Marawi, those remaining are still struggling to overcome the losses they suffered during the fight. And in Indonesia, hard work by D-88 and other security forces in the wake of the 2018 attacks there have kept a lid on Islamic State forces.

While much of the world was somewhat surprised by Sri Lanka bombings, local security officials had been given ample warning. Reports have emerged that India issued a warning to Sri Lankan officials about the cell months ago. The Sri Lankans also reportedly received a specific warning about the Easter plot some 10 days in advance, with another following immediately before they took place.

Hunting down the cell responsible for the attacks to prevent it from striking again must be Sri Lanka's primary task now, but once that threat is mitigated, there must be a serious accounting for how and why the warnings were not acted upon. Defense Secretary Hemasiri Fernando submitted his resignation April 25, and Inspector General of the Police Pujith Jayasundara was asked to resign, but the blame for the intelligence failure obviously extends beyond them.

With the government now acutely aware of the threat and the Muslim community having expressed a great deal of outrage over the Easter attacks, I suspect that Sri Lanka will follow a similar path to those seen after the spectacular attacks in Bangladesh and Indonesia: in those places, after the jihadists responsible were hunted down, they have been relegated to more of a low-level persistent threat. As details of Sri Lankan terrorist operation have emerged from the investigation, it has become clear the attack could have resulted in far more casualties. The attackers had placed a large bomb in a van parked outside St. Anthony Shrine in Colombo, one of the churches hit by a suicide bomber. But it didn't detonate as intended. Had it gone off among the crowd of first responders and survivors of the suicide bomb, the carnage could have been devastating. Two large bombs planted near the airport also failed to detonate.

It has also emerged that one of the suicide bombers had attempted to attack the Easter buffet at the upscale Taj Samudra hotel, but his backpack device failed. He reportedly returned to the group's safe-house, where the device was repaired. He then diverted to a secondary target, the New Tropical Inn, a small hotel by the Dehiwala Zoo in Dehiwala-Mount Lavinia just outside the capital of Colombo, where he killed two other people. Had his device detonated at the Taj Samudra, the toll from this bomb would undoubtedly have been higher.

Obviously, the threat of attacks in Sri Lanka will persist as long as those responsible for the operational planning, logistics and bombmaking for the Easter attack remain at large. That type of professional terrorist tradecraft is dangerous. But once the organization responsible for these attacks is rooted out and killed or arrested, I doubt that jihadism will remain a large-scale problem on the island. As long as Sri Lankan Muslims are drawn to jihadism, it will remain a low-level persistent threat, but now that it has been identified as a dire threat, it will not be ignored again — and future attackers will face a far less permissive environment.

Article Search

Copyright © Stratfor Enterprises, LLC. All rights reserved.

Stratfor Worldview


To empower members to confidently understand and navigate a continuously changing and complex global environment.