Sri Lanka Struggles to Solve the Islamic State-Local Network Puzzle

Publication: Terrorism Monitor Volume: 17 Issue: 17


On August 23, the Sri Lankan government ended a four-month-long state of emergency that was declared after multiple suicide bombings inspired by the Islamic State (IS) rocked the South Asian nation (Colombo Page, August 23).  Over 250 people died and scores were injured when on April 21, Easter Sunday, suicide bombers targeted popular hotels and churches in the capital city of Colombo, Dehiwala, Negombo (on the East Coast), and Batticoloa (on the West Coast). As investigations proceeded, evidence emerged of the involvement of local Islamist groups and individuals inspired and affiliated with IS. The government moved on May 13 to ban three local Salafi-jihadist groups—National Thowheed Jamath (NTJ), Jammiyathul Millathu Ibrahim (JMI), and Willayath-As-Seylani (WAS), under the regulations of the Prevention of Terrorism Act (PTA). [1] These three organizations have been banned “for the purpose of ensuring the continuance of peace within the country and in the interest of national security, public order, and the rule of law” (Colombo Page, May 14).

The NTJ and JMI had earlier claimed responsibility through IS’ Amaq news agency on April 23. The Amaq agency video subsequently released showcased the Easter day bombers and the NTJ’s renegade leader Muhammad Zahran Hashim and his associates pledging allegiance to IS leader, Abu Bakr al-Baghdadi. The government investigators now believe that before his death, Zahran Hashim and his fellow militants from NTJ and JMI formed the hybrid Willayath-As-Seylani (WAS). WAS is supposedly a new province of IS, with the goal of raising the group’s banner in Sri Lanka. However, information about WAS is currently sparse, as the government has been hesitant to confirm any physical manifestation, or even virtual inroads, of IS on Sri Lankan soil.

Persisting Ambiguity

Sri Lanka’s President Maithripala Sirisena said in mid-May that “99 percent” of the remaining suspects in the Easter Sunday attacks have been arrested and their explosive materials seized. His reassuring comments were aimed at tourists, urging them to return to the Indian Ocean island nation. On July 30, Army Commander Lt. Gen. Mahesh Senanayake made a contradictory statement before the Parliamentary Select Committee in charge of the probe of the attacks. He conveyed strongly that Islamist terrorists are still operating at various places in the country and the threats they posed were far from over. Alarmingly, he pointed out that the security agencies are not in a position to say that whether the on-going jihadist problem will be over “within six months or six years” (, August 1). With the lifting of the state of emergency, the security agencies in charge of investigations insisted that the ban would remain on these three groups and the suspects arrested following the deadly bombings will not be set free (Colombo Gazette, August 24).

Even though these contradicting statements from political and military leaders paint a bleak picture, the security agencies—with the help of foreign intelligence support—have succeeded in partially exposing the covert jihadist networks. The latest estimate suggests that the Sri Lankan police have arrested 293 radicalized individuals in connection with the bombings. The police also stated that over 100 bank accounts belonging to at least 41 of the arrested militants had already been frozen. Sri Lankan police are also working to freeze approximately $33.1 million (or 6 billion Sri Lankan rupees) worth of assets belonging to the militant suspects (Newsfirst Sri Lanka/You Tube, September 5;  Colombo Page, September 5).

Understanding the Jihadist Network

Information provided by a senior NTJ operative Mohammad Ahmed Milhan—recently extradited from Jeddah, Saudi Arabia—led Sri Lanka’s Criminal Investigation Department (CID) to unearth a significant arms stockpile in Ollikkulam in Kattankudy on June 27. The stockpile was comprised of detonators, gelignite sticks, liters of liquid gelignite, T-56 ammunition, and several swords (Colombo Page, June 16; Sunday Times, June 27). Milhan was involved in the November 30, 2018 attacks on security forces at Vavnativu, Batticaloa that killed at least two police personnel (The Island, June 14; News First, November 30, 2018). In August, the Terrorism Investigation Division (TID) uncovered another huge cache of arms and explosives from Karandiaya area in Pallai (Jaffna, Western Province). The TID recovered one AK-47 assault rifle, magazines, ammunition, hand grenades, and ten kilograms of plastic explosives from Pallai (Colombo Page, August 26).

Based on interrogation reports, police arrested several pro-Islamic State NTJ and JMI militants in July and August who had pledged to carry out a second wave of attacks following the April bombings. At least 18 of these arrestees have attended NTJ/JMI-run training camps in Hambantota, Nuwara Eliya, and Mullikulam under the leadership of Mohamed Zahran (a.k.a. Abu Ubeida) and his deputy Naufar Maulvi (Ceylon Today, August 28). On August 3, Police arrested JMI’s Eastern province military wing leader, Nauzad Umar, and Anuradhapura district leader, Mohammad Ismail Mohammad Salman (Colombo Page, August 4). Between August 5 and 7, at least six members of JMI with strong ties to NTJ were arrested in Ampara. Police   identified the individuals as Mohammed Mansur Saifullah (Abu Zahid), Musthak Ali Amher (Abu Hind), Thahir Hidayatullah (Abu Thurab), Mohideen Bawa Ram (Abu Akran), Mohammed Riyal (Abu Salman), and Mohammed Ramsin Rushdi (Abu Alwakar) (Colombo Page, August 5; Colombo Page, August 7). Similarly, on August 16, Mohamed Naufer Abdulla, a NTJ operative, was arrested in Ampara based on information provided by the State Intelligence Unit. Naufer Abdulla is the son of NTJ’s second in command, Naufer Moulavi, a close associate of Zahran, who took over leadership of the terror group after the latter’s death in the attacks (News First, August 17). Besides Ampara, most of these arrests were made from the Mawanella, Kurunegala, Colombo, and Kalmunai areas of Sri Lanka (News First, August 27).

Although IS claimed responsibility for the Easter Sunday attacks, Sri Lankan authorities have largely blamed local extremist groups led by Zahran Hashim. The government agencies may have possibly overlooked IS’ burgeoning covert network inside the country since 2015, virtually linked or inspired by Sharfaz Nilam, who died in Syria (Abu Shurayh al-Silani) and Thauqeer Thajudeen, another Sri Lankan who was fighting alongside IS (Terrorism Monitor, December 2, 2015). Both are pioneer Sri Lankan operatives for IS and likely inspired hundreds of individuals toward IS ideals.

Sri Lankan agencies may have discovered another clue relating to Abdul Lathief Jameel Mohamed, one of the suicide bombers responsible for the Easter Sunday attack in Dehiwala, and his ties with IS  operative Abu Khaled al-Cambodi (Neil Prakash) (Colombo Page, April 26). Also, the local connections of the about 50 Sri Lankan citizens who traveled to Syria to join the jihadist group remains unsolved, and the government remains tight-lipped about sympathizers and several IS returnees. There is no publicly available information about the fate of several doctors and health care providers who were working with IS in Syria and Iraq.

Expectedly, Sri Lankan authorities have yet to establish any direct links between the local jihadists groups and IS, or any other transnational jihadist organizations. They do not know if Zahran or somebody who is still active is the missing link connecting IS to NTJ and other local affiliates. The question remains how IS’ Amaq news agency released the audio-visuals sent from Katankudy or Colombo claiming responsibility for the mayhem. Aside from the post-bombing releases from Amaq, IS’ news outlet released an infographic on July 24 claiming to have carried out over 1,800 attacks in the first six months of 2019, and Sri Lanka was under IS’ “major events” category. The investigations and interrogations clearly lead to the conclusion that the banned groups and the members responsible for the suicide bombings were inspired by IS ideology, despite official statements from some Sri Lankan leaders.


[1] “The Gazette of the Democratic Socialist Republic of Sri Lanka

Government Notifications: The Public Security Ordinance, May 13, 2019,