Please be advised
- At least 310 people have been killed and hundreds injured in multiple suicide bombings that occurred in Colombo, Negombo, and Batticaloa on April 21, Easter Sunday.
- Authorities indicated that the attacks involved seven suicide bombers. The targets comprised three churches, including the St. Anthony’s Shrine in Kochchikade, Katuwapitiya Church in Negombo, the Zion Church in Batticaloa, as well as the Shangri-La, Cinnamon Grand, and The Kingsbury hotels in Colombo. Two more explosions took place at a guesthouse near the Dehiwala Zoo and a suspected militant hideout in Dematagoda. At least 39 foreigners are believed to have been killed in the attack.
- On April 23, the Islamic State (IS)-linked Amaq News Agency reported on the incident, but the group has not released an official claim, as of publication.
- According to reports from April 23, security forces have arrested at least 40 individuals in connection with the blasts, including a Syrian national. According to sources, at least nine of the suspects were remanded until May 6. The country’s defense minister stated on April 23 that the attacks were in retaliation for the killing of Muslims in the attack in Christchurch, New Zealand in March.
- One individual was reportedly arrested in the Kandana area in north Colombo along with communication devices, per April 22 reports. No specific information on the nature of the devices has been released. Four others were reportedly arrested from Gampola and Katugastota, located in Kandy District.
- During the evening hours (local time) on April 22, two suspects were arrested during a security operation at a house located in the vicinity of a church on Enderamulla road in the Wattala area of north Colombo. Security forces closed off Colombo Main Road in Welisara area of Wattala following the reported discovery of a suspicious vehicle parked near Nawaloka ground during that time as well. However, no explosives were found on the site. Meanwhile, the police spokesperson announced that a total of 87 detonators were found at a private bus stand in Pettah within the Fort area of Colombo on April 22.
- During the afternoon hours on April 22, an explosive device was detonated in the vicinity of St. Anthony’s Church in the Kochchikade North area of Colombo 13. Police reportedly attempted to conduct a controlled detonation of the device, which was placed inside a vehicle, with various reports stating the device exploded before they could do so. No casualties were reported as a result of the operation.
- Alleged IS supporters posted images of three militants allegedly involved in the explosions on April 21. The images were shared through the pro-IS al-Ghuraba media channel. One of the pictures appears to feature Zahran Hashim, the alleged leader of the National Thowheeth Jama’ath (NTJ).
- On April 21, police also reportedly discovered an alleged safe house in the Panadura area of south Colombo, in which suspected militants are said to have lived for almost three months prior to the explosions. The police of Wellawatta area, located in south Colombo, also seized a vehicle, along with its driver, on suspicion of transporting some suspects related to the explosions.
Assessments and Forecast
Perpetrators suspected to be local, but likely linked to IS or group’s affiliates
- While investigations are currently ongoing, based on the target selection, the attack was perpetrated by an organized group of individuals either inspired by jihadist ideology or with links to transnational jihadist groups such as Islamic State (IS) or al Qaeda (AQ) or their affiliates. Based on the modus operandi used, targets, and ideological spheres of influence, it is more likely to be IS-inspired or led than AQ, as further suggested by the Amaq media report. The travel of 32 Sri Lankan nationals to Syria and Iraq to join the IS in 2016 is indicative of this trend in local Islamist radicalization. Given the absence of previous major jihadist attacks in Sri Lanka, as well as the broad scope of the Easter bombings, we assess that the involvement of an external militant actor in helping sympathetic locals scale up their tactics is highly probable. While the government has attributed the attack to the NTJ, an organization with no confirmed external links, it is important to note that the group has splintered in recent years, based on sources of funding for factions. The Easter attack is likely to have been conducted by one of these factions that may have drawn on IS-inspired tactics and target selection.
- At the time of writing, it is unclear what level of cooperation, if any, this may have involved. That said, the orientation of the plot towards Christian targets, despite the predominance of inter-community conflicts between hardline Sinhala Buddhists and Muslim minorities, may indicate the influence of global jihadist ideology in target selection. It also represents a prioritization of symbolism in their target choice, given that attacking Christians and hotels frequented by Western nationals and affluent classes were more likely to draw global media attention. The staging of the attack in the capital was also intended to undermine the Sri Lankan government and stir up inter-religious hostilities with the Sinhala Buddhist majority. The choice of attacks on hotels, in addition to churches, may have been intended to maximize casualties at Easter social events known to take place during the morning-afternoon hours. As regards the defense minister’s assertion that the attack was in response to the Christchurch attacks, since the scale of the operations required greater advance planning, his theory appears to be debatable. However, the incident in New Zealand may have reaffirmed the militants’ commitment to the plots and the targeting of Christians.
Emerging reports from investigations indicate close coordination and planning, as well as extensive network of militant cells
- There is little confirmed information regarding the explosives material used, or the profiles of the suspects apprehended. However, the recovery of explosives material and detonators from a suspected militant cell in Puttalam in January appears to have been an early warning sign of growing radicalization. The materials seized in January, such as ammonium nitrate and nitric acid, are characteristic of relatively less sophisticated household-manufactured explosives. Should similar materials have been used in the attack, it may explain the relatively inconsistent death tolls and damage caused, which varied from each individual attack. However, casualties appear to have been maximized by the strategic planning, coordination of multiple plots, logistics, and deployment of operatives to successfully stage the attacks. Some of the attacks also indicate the usage of shrapnel, such as ball bearings or nails placed in the backpack of the suicide bomber who was dispatched to the Kochchikade church, in order to increase secondary casualties. The suspects are also likely to have had bases in the capital, as explained by their familiarity with the targets and access to them.
- While it remains to be confirmed that all suspects arrested during security operations were linked to the explosions, the large number of detainees underscores the potential for an extensive network involved in the attacks, ranging across more than one province. The arrests of four suspected operatives in Kandy District are also significant given that the area has witnessed substantial inter-religious tensions between the Muslim minority and hardline Sinhalese Buddhists, which escalated into communal violence in March 2018. The arrests in Kandy may lead police to probe the potential involvement of individuals radicalized following the aforementioned Kandy violence.
Recovery of undetonated explosives, anti-militant raids elevates security risks in the capital in the immediate term
- The discovery of an IED inside a vehicle on April 22 near St. Anthony’s Church is also notable given its proximity to the site of the first blast on the day prior. While it is currently unclear at what time the vehicle was parked in the area, its location suggests that it may have been intended as a secondary attack targeting rescue operations attending to the initial blast. The discovery of a large number of detonators, along with the pipe bomb found near the international airport, also indicates that additional attacks may have been planned in a similar fashion. It appears likely that more explosive devices may be discovered during ongoing security operations, increasing the need for situational awareness and heightened vigilance if traveling in Colombo.
- FORECAST: There is an elevated potential for additional security incidents in the capital over the coming hours. Security forces are expected to continue to conduct raids, arrests, and security operations across Colombo and in the Central Province over the coming hours, while an enhanced deployment of law enforcement will remain in place in the capital city for the foreseeable future. There is also a potential for ad-hoc road closures and evacuations due to heightened public sensitivities at present, evidenced by the security operation in Wattala. Raids also bear the latent risk of collateral damage to those in the vicinity, as raided safehouses may contain explosives, or suspects may use these devices or gunfire in an armed confrontation. This was indicated in the Dematagoda raid. Further, as security forces are on greater alert, evacuations of public spaces may occur with increased frequency over the coming days, based on the identification of suspicious objects. Intermittent curfews are liable to be enforced, based on concerns of further attacks or the potential for inter-religious clashes between Muslims and hardline Sinhala Buddhist groups. As witnessed since the attack, security will remain heightened in neighboring countries that are at risk of copycat attacks, such as the Maldives and India.
Recommendations
- Those operating or residing in Colombo on April 23 and in the coming days are advised to avoid nonessential outdoor travel within the capital and avoid any large gatherings.
- Avoid the immediate vicinity of all churches, mosques, or Buddhist temples in the country over the coming hours due to the risk of retaliatory attacks/further detonations.
- Given the targeting of religious sites, we advise to avoid the display of religious imagery and avoid overt or critical statements of any religious institutions both in public spaces and online, including social media.
- If traveling in the city, use only secure methods of transportation with vetted drivers.
- We advise allotting for disruptions to travel across Colombo over the coming hours, due to the heightened security measures and the likely establishment of vehicular checks and road blockades following the blasts.
- Given the reported heightened security measures implemented at the Bandaranaike International Airport (CMB), we advise allotting for extra-time to travel by air and reconfirm flight itineraries.
- Ensure when traveling that you have sufficient means of identification and can evidence if required, exactly where you are going.
- Allot for disruptions to communication due to the impact of curfew measures on social media access and messaging platforms.
- Remain cognizant of your surroundings, including any suspicious behavior of individuals, which may include a person wearing winter clothing during warm weather and/or seemingly wandering around, as well as items that look out of place, such as bags or containers.
- Immediately alert authorities of any suspicious behavior or items. Ensure that places of stay are properly secured, alter travel routes, and avoid disclosing sensitive itinerary information to unknown individuals.
- Foreigners, particularly Westerners, should maintain a low profile, and exercise heightened vigilance in the vicinity of locales frequented by foreign, particularly Western nationals, including US and Western diplomatic missions and interests, due to the increased potential for militant attacks.
- If scheduled to visit the country, delay travel or reconsider nonessential stay until the situation stabilizes.
- For contingency plans and on-ground operational support, contact us at [email protected] or +44 20-3540-0434.
