Colombo, Sri Lanka - Rioters were already on the streets when authorities in Sri Lanka blocked access to the internet.

The mob - angered by the death of a Sinhala Buddhist man who was beaten by a group of Muslim men - swept through neighbourhoods in the South Asian nation's central Kandy district for a third day on March 7, setting fire to and vandalising mosques and scores of Muslim homes and businesses.

President Maithiripala Sirisena, in an interview with Sinhala weekly Divaina on Sunday, blamed social media for the riots, the third major attack against Muslims in Sri Lanka since November.

"Extremist groups were using social media in the most heinous manner," he said. "That is why we had to limit it."

Calm has returned to the central hills now, but a state of emergency declared to stem the violence remains in place. At least two people were killed in the riots and 232 homes were destroyed.

More than 280 suspects have been arrested, and access to the internet has been restored. But, Facebook, which has more than 5.5 million users in Sri Lanka, remained blocked, along with social messaging application WhatsApp.

Calls to lift the ban were growing on Wednesday, with critics claiming the move had been ineffective in quelling violence against Sri Lanka's Muslim minority, who make up nine percent of the country's 21 million population.

'Vicious, brutal, venomous'

Sanjana Hattotuwa, an analyst at the Centre for Policy Alternatives (CPA) in Sri Lanka's capital, Colombo, said the anti-Muslim sentiment online was "quite vicious, brutal and venomous", but that it was "not new".

Sinhala Buddhist nationalist individuals and groups were "technologically savvy", he said, and have used social media for years, posting memes, photos, videos and live broadcasts to spread and amplify their messages on a variety of platforms including Facebook, YouTube and Twitter.

These groups accuse Muslims of high birth rates and forcing people to convert to Islam in order to reduce Sri Lanka's Sinhala Buddhist majority.

Hattotuwa said their followers are in the tens of thousands and their pages were "extremely well-curated and updated frequently".

That includes the Facebook pages belonging to Amith Weeransighe, one of the most prominent figures arrested over the latest bout of violence, and groups such as Bodu Bala Sena (BBS) and Sinhala Ravaya.

Weerasinghe, in a video posted to Facebook and YouTube shortly before the riots, had urged his followers to converge on Digana in the Kandy district, saying: "This town has come to belong only to the Muslims. We should have started to address this a long time ago."

That video gained more than 50,000 views on YouTube in a week.

Similar posts, blaming Muslims for inciting the violence in Kandy, and videos in which men in saffron and maroon robes called for support from viewers, were shared widely prior to and during the riots.

In one such video, a man in a maroon robe labelled Muslims as a "threat to the Sinhalese" and told his supporters: "Enough of being patient. The knife you have at home is not just to cut the jackfruit. Now take your knife and go."

Many of these posts have since been taken down by Facebook.

Amith Weerasinghe's profile, and pages run by Weerasinghe's Mahason Balakaya group and the BBS have also been blocked, and it was not clear how many supporters they had online. However, the online followings of other similar figures and groups provide a window into their reach.

Ampitye Sumanarathana Thero, a hard line monk, who was reportedly seen in Kandy before the riots has nearly 40,000 followers. In a post on March 6, he warned the government against what he said was discriminatory treatment of the Sinhalese "majority race". Another key figure, Dan Priyasad, who was held last November for attacking a safe house where Rohingya Muslim refugees who fled violence in Myanmar had taken refuge, has more than 70,000 followers.

On February 24, a week before the Kandy riots, he had urged his followers to "protect your own race".

Meanwhile, a Facebook group called Sinhala Buddhist, with nearly 800,000 followers, posted updates after the block, one of which claimed the rioters were paid by the government.

The CPA flagged some of these groups in a report in 2014, including the Sinhala Buddhist group, after anti Muslim rioting in southern Aluthgama left four dead and 80 others injured. At the time, the group had 200,000 followers. In less than four years, it has added 600,000 new followers.

"The danger of glossing over impact of online hate speech is that a process of radicalisation, particularly targeted at and occurring amongst the youth, risks undermining Sri Lanka's already post-war democratic fabric," the report's authors warned at the time.

Sinhala censors

In an emailed statement, Facebook said it was responding to the situation in Sri Lanka and "are in contact with the government and non-governmental organisations to support efforts to identify and remove such content".

The social media giant, which has drawn criticism for failing to tackle hate speech that has spawned violence in countries such as Myanmar and South Sudan, said it is investing in technology and human expertise to remove content that violated its policies.

A spokeswoman for Facebook said the company has 14,000 censors who review reports in more than 40 languages, including Sinhala.

The company plans to double its global security team to 20,000 people this year, she added.

But, Duminda Jayasena, a Sri Lankan Facebook user, publicised on Tuesday a response from Facebook to a post he flagged over incitement to violence last week. The post in Sinhala said: "Kill all Muslim infants, don't let even one remain".

But Facebook found that it did not violate the company's hate speech standards.

Harin Fernando, Sri Lanka's telecommunications minister, said Facebook "does not have adequate resources to monitor posts in Sinhalese".

The company has removed more than 400 posts since the riots began, he said, adding that his ministry will be working with Facebook "to make sure this kind of content does not go up".

Officials from Facebook were set to visit Sri Lanka's capital Colombo on Thursday, Fernando said, adding the block on the social network may be lifted then.

Harsha De Silva, deputy economy minister, urged on Monday President Sirisena to lift the block in a Twitter post, citing "negative impact" on Sri Lanka's economy, while Sagala Ratnayaka, minister for youth affairs said the ban will hamper tourism, as well as the information technology and e-commerce sectors.

Blocking Facebook and messaging apps long term is not an option. Social Media must start functioning so that the economy doesn’t suffer. Therefore access to Social Media must be unblocked ASAP and the Government must set in place a system to curtail hate speech and fake news — Sagala Ratnayaka (@SagalaRatnayaka) March 13, 2018

The rot in Sri Lankan society

Frustrated by the block, many Facebook users, including Sinhala Buddhist nationalists, have been turning to Virtual Private Network or VPN technology to circumvent the block.

"Even my hairdresser at the saloon had it on," said Shalini Peiris, a young mother from Colombo, referring to the use of VPN. The ban had made organising her children's activities at school difficult, she said, adding: "Only a mother like me would know the value of parents' groups on Facebook and WhatsApp."

Journalists also said the block hampered them from gathering witness testimony from violence-hit areas, and prevented victims from telling their stories.

Meanwhile, Hattotuwa, the social media researcher, said Sri Lanka's government should also consider the use of WhatsApp by Sinhala Buddhist nationalist groups, as much of their organising was now being done via closed groups on the platform.

"These groups are impossible to monitor unless you are part of them," he said.

"Clearly, it's not social media that is to blame for this violence ... There's a rot within our society, and authorities need to address the root causes."

Screenshots of a conversation in one such WhatsApp group, provided by the CPA, showed a participant calling for an attack on Mosques on March 6. In that group, called Protect the Sinhalese, the participant had also posted a picture of machete and sticks, and called for an attack on mosques.

In another group called Sinhala devils, participants appeared to be discussing the Kandy attacks.

On March 7, the day the Internet was shutdown, one participant said, "When we went to attack, there was no one, they had left."

"Someone had given them the news," another said.

"We made the plan three days go," a third added.

Amantha Perera reported from Colombo. Zaheena Rasheed reported and wrote from Doha.