The terror attacks that killed over 250 people on Easter Sunday in Sri Lanka left the global community scrambling for answers: Who were the perpetrators? What motivated them to carry out such a devastating attack?

By April 22, a shocked Sri Lankan government had begun to sift through clues and earlier alerts. It concluded that a local group with the support of an international network had carried out the attacks.

Late that night a video surfaced, purportedly from an Islamic State platform, laying claim to the attack. Asia Times editors recall below how they put together a breaking story by collaborating across several regions spread over two continents while racing against time.

Saikat Datta, South Asia Editor:

In the period starting with Al Qaeda’s bombing of the USS Cole in 2000 the nature of terrorism has changed significantly, making it harder for reporters on the terrorism beat to sift through clues, trends and leaks from sources to piece together credible narratives.

Unlike the past, when nationalities and ideologies were key drivers of terrorism, Al Qaeda, as its name suggested, became the “base.” It was a semi-corporation with many franchisees, who would work across the globe as collaborators espousing an ideology that transcended international boundaries and ideologies.

Al Qaeda in Iraq would become the Islamic State of Iraq and, in April 2013, would be expanded to become the Islamic State of Iraq and Syria, or ISIS – subsuming a local franchise that the organization’s leadership had set up amid the chaos of the Syrian civil war. Finally, in June of the following year, ISIS pronounced itself a caliphate, to be known only as the Islamic State.

The declaration of a physical caliphate took Al-Qaeda’s operating model even farther. The new caliphate began declaring “provinces” as far afield as Egypt’s Sinai Peninsula and the historic Khorasan region on the Afghanistan-Pakistan border, while supporters were recruited over the Internet. Strikes could be carried out anywhere, as long as the foot soldiers were available and sufficiently motivated to die for the cause.

The video

A couple of hours before midnight on April 22, a friend in India’s vast security establishment sent a video to me in New Delhi via WhatsApp. The friend was not clear whether the video was genuine, but this was what he had chanced upon and he shared it hoping to find some answers. The video purported to be from the bombers and was released to claim responsibility for the Easter bombing attacks in Sri Lanka. After a few quick chats with other sources, at 2259 hours I passed the video to my colleague, the Middle East editor, Alison Tahmizian Meuse, who is based in Lebanon.

By this time I had also alerted our editor, Uwe Parpart, who was in the Philippines for the Easter holidays. The magic of global cellphone networks and data connectivity over WhatsApp proved to be a huge blessing. While Parpart immediately made the call to run the story, we also agreed to create a video with our comments, to exercise caution over its authenticity and to ensure that we did not become a vehicle for ISIS’s virulent propaganda and ideology. Our video editor, Ankur Tanwar, was awakened to start working on the video. Our night desk editor, Chris Scott in the US, was put on alert to expect the story.

Islamic State, we knew, had been increasing its presence in South Asia in recent years, managing to establish a foothold in the Nangarhar province of Afghanistan. Started in 2014, this franchise came to be known as the Islamic State-Khorasan Province or IS-KP. It was initially led by a Pakistani, Hafiz Saeed Khan, who had been with the Teherik-e-Taliban Pakistan (TTP) before becoming the “emir” of IS-KP.

Afghan troops stand behind alleged Islamic State fighters in Jalalabad on April 10, after their arrest. Officials said five IS fighters and three Taliban were caught with bombs and other items during an operation in eastern Nangarhar province. Photo: AFP / Noorullah Shirzada

Indian intelligence had been tracking the IS-KP and its linkages in South Asia. Some ISIS cadres from the southern Indian state of Kerala, who had returned to India in mid-2018, gave the first tipoffs about a possible attack in Sri Lanka. Information they revealed led Indian investigators to ISIS modules in Tamil Nadu in September and December of last year, which revealed links to Moulvi Zahran Hashim, believed to be the mastermind of the Easter bombings in Sri Lanka.

I messaged Alison that the initial parts of the video seemed to be in Tamil. This was a major clue because Tamil is spoken in India and Sri Lanka. The language indicated that this was clearly aimed at South Asian viewers. However, the Tamil spoken in India and Sri Lanka is vastly different, with the Lankan version considered more classical than what is spoken to the southern Indian state of Tamil Nadu.

Alison, who tracks ISIS regularly and also speaks Arabic, immediately started working to verify the authenticity of the video.

Alison Tahmizian Meuse, Middle East Editor:

My colleague Saikat contacted me late in the night, alerting me that he had received a video purportedly a claim of responsibility for the Sri Lanka attack. I quickly downloaded the video, cognizant that such content can be scrubbed from the Internet arbitrarily. I gave it a first viewing to get an overall impression. It was not in the polished ISIS style I’d been accustomed to seeing during the height of the group’s territorial control, when its propagandists were churning out Dabiq, a glossy online magazine, or high-quality videos of its brutal exploits.

But I was also aware that because the group’s leadership had gone underground in Iraq and Syria, avoiding electronic communications, this video may have been produced by an inexperienced South Asian franchise compelled to do propaganda on its own. The video purported to be from Al Ghuraba Media, a platform for ISIS supporters, not an official channel of the group.

A strong point for the video’s authenticity was that it showed stills of eight purported attackers, including one whose face was showing, standing before the black flag used by ISIS in footage that would have been taken before the attack. Time would tell who those people were but, in any case, at least one had purposefully allowed himself to be identified. We would later find out that they were radicalized Sri Lankan Muslims.

A small point that I found odd, however, was that the video identified each of the men as “assailant.” Any Islamist militant group, having collected such images for the purpose of posthumous publication, normally would have called the men “martyrs”. Not knowing the Arabic word for martyr, shaheed, would be like not knowing the word jihad. But I considered this a caveat, not a reason to write off the video.

Perhaps the most striking thing about the video was that it featured Arabic speech threatening more attacks layered over subtitles in an Asian language that neither Saikat nor I knew, and followed by audio in what I guessed to be that same Asian language. My immediate priority was to translate both, and to see if the subtitles matched the Arabic.

By now I had alerted my Cairo-based colleague Heba Afify, who runs our Asia Times Arabic page, about the existence of the video. I sent her my rough translation and she went to work doing an exact translation while I started to call up contacts in Asia to decipher the mystery language. Our Delhi bureau said it was possibly Sinhalese, the main language in Sri Lanka, or Tamil, the language of a large minority there.

I contacted a Sri Lankan friend, as well as an Australian friend who I knew was well traveled and might have appropriate contacts. My Sri Lankan friend informed me that the mystery language was not Sinhalese but Tamil, which she did not speak. The Australian friend came through for us, introducing a Sri Lankan contact fluent in Tamil who agreed to help on the video.

A screen shot from a video claim to the Sri Lanka attacks received by Asia Times, which shows the slain former IS spokesman Abu Mohammed al-Adnani and Tamil subtitles to Arabic audio of one of his speeches.

He confirmed that the Tamil audio matched the content of the Arabic, which I realized had been pulled from a speech by the slain Islamic State spokesman Abu Mohammed al-Adnani: “Our armies remain in every [mountain and valley]; exploding into the bastions of the infidels.”

The Tamil audio then mirrors the Arabic. “Our troops will be everywhere. We will bombard those government [castles], which have enforced only oppression and exclusion.”

The word used for castle in Tamil, the translator explained, could be translated to “the place where the rules are made,” denoting a government building.

While the video did not explicitly claim the Easter bombings, it flashed English text reading: “O Crusaders … This bloody day is our reward to you,” accompanied by the numbers “21/4” – the date of the attack.

Keep in mind that at this point, there had still been no claim by Islamic State or any of its supporters more than 24 hours after the attacks. Saikat and I conferred on the video and its contents, taking into consideration that there were other political actors at play in South Asia who might also have an interest in stirring ethnic or religious tensions. We agreed to publish, but with detailed caveats.

Breaking news

Over WhatsApp, Asia Times worked to put together a script for the video and simultaneously create a draft for the story as more translations began to stream in. A key Indian security official confirmed that the Sri Lanka attacks had been carried out by a local group, the National Thowheeth Jama’at (NTJ), who had acted as the “foot soldiers.” Crucially, the source also confirmed that the ISIS did seem to have a role in the planning and execution of the attack.

Once the copy and the video were ready, the story was handed over to Scott for final edits. Our social media bureau in the US was alerted to push out the story to readers in the West as they were waking up to the fresh developments in the attack.

As subsequent details of the investigation emerged, it was clear that the initial reporting in Asia Times had been proved correct, and that these attacks were indeed the handiwork of the ISIS.

Half a day after our report was published, the Islamic State media affiliate Amaq News Agency put out a statement claiming the attack and publishing a group photo of the same eight men who had been shown in the video we had received. Then, hours later, Islamic State put out an official statement detailing the attack and naming the individual attackers by their nicknames – the same as we had seen in the video.

Finally on Monday, just over one week after the attacks, came the ultimate claim. The self-proclaimed caliph, Abu Bakr al-Baghdadi, appeared in a video for the first time in five years to hail the Sri Lanka attacks, calling them revenge for territorial losses in Iraq and Syria, and part of the long war with the People of the Cross.

Sri Lankan Christian devotees light candles as they pray at a barricade near St. Anthony’s Shrine in Colombo on April 28, 2019, a week after a series of bomb blasts targeting churches and luxury hotels on Easter Sunday. Photo: AFP