The bomb damage inside St. Sebastian's Church in Negombo, north of Colombo, Sri Lanka.
The bomb damage inside St. Sebastian's Church in Negombo, north of Colombo, Sri Lanka.
Days after a series of explosions that appeared to target Christians and foreigners at churches and hotels in Sri Lanka and left more than 300 people dead, some details of who was behind the attacks and their motives are beginning to emerge.
The Islamic State claimed responsibility for the attacks on Tuesday, while Sri Lankan authorities said Islamist extremists had carried out the attacks in retaliation for attacks on two mosques in Christchurch, New Zealand, on March 15, that left 50 Muslims dead.
But big, unanswered questions remain about how the attacks were possible and what links exist between the Islamic State and local extremists, if any. Here, we try to break these questions down.
Why did the Islamic State claim of responsibility take so long?
In the immediate aftermath of Sunday's attacks, no group claimed responsibility. Local authorities pointed toward local groups - National Thowheed Jamaath and the Jammiyathul Millathu Ibrahim - but hinted at outside help.
On Tuesday, the Islamic State's Amaq News Agency claimed responsibility, putting out a statement that Christians and "coalition countries" were targeted by fighters from its organisation. Amaq cited a "security source" as having provided the information.
A later Islamic State communique offered more details, including that seven fighters took part in the attacks, according to a translation by the SITE Intelligence Group. However, a photo published by Amaq of what it said was the attack group showed eight people.
The Islamic State has used Amaq to claim responsibility for attacks before. However, analysts note that it often claims attacks that it not only played a role in organising but also those that were simply "inspired by it."
Rita Katz, director of the SITE Intelligence Group, wrote on Twitter that the initial message was not confirmation that the Islamic State was involved in the attack.
"The language in this statement is also typical of ISIS-inspired attacks as well," tweeted, using an acronym to refer to the Islamic State.
The delay may be significant. In past cases where attackers had tenuous links to the Islamic State, the group has waited hours or even days until it has some kind of confirmation that an attack was inspired by its rhetoric.
"We should also keep in mind that the ISIS media machine has taken a real hit over the last few months," said Amarnath Amarasingam, a Toronto-based expert on extremism and terrorism and a senior research fellow at the Institute for Strategic Dialogue, referring to the collapse of the Islamic State's caliphate in Syria and Iraq.
What are the links between local groups and the Islamic State?
State Minister of Defense Ruwan Wijewardene told Parliament on Tuesday that two local groups had been tied to the attack: the National Thowheed Jamaath and the Jammiyathul Millathu Ibrahim.
Neither group is well known. National Thowheed Jamaath is a splinter group from a better-known group, the Sri Lanka Thowheed Jamaath. The group had been linked to the defacement of Buddhist statues last year. The Jammiyathul Millathu Ibrahim group is less known.
A US official told The Washington Post that the Thowheed group has links to the Islamic State, but their significance is unclear. A small number of Sri Lankan citizens are believed to have joined the group at its self-proclaimed caliphate in Syria and Iraq. Experts say the number of foreign fighters who returned to Sri Lanka is likely to be low.
"The number of returning fighters is not available, but it is not going to be more than a handful," said Kabir Teneja, a fellow with the Strategic Studies program at the Observer Research Foundation in New Delhi who has studied the Islamic State's links to South Asia.
The bomb damage inside St. Sebastian's Church in Negombo, north of Colombo, Sri Lanka.
Sri Lanka's Prime Minister Ranil Wickremesinghe said at a news conference Tuesday that all people taken in for questioning after Sunday's attacks were Sri Lankan citizens and that some may have traveled abroad, but he did not say where.
Amarasingam said that if it was confirmed that the attack was perpetrated by foreign fighters who had returned to Sri Lanka, "it would be the largest attack carried out by ISIS returnees anywhere."
What motivated the attacks?
About 7 per cent of Sri Lanka's population is Christian, and that demographic has not been targeted by large-scale terrorist attacks like this before.
The civil war that raged throughout the country from 1983 to 2009 was fought on ethnic rather than religious lines, and there are Catholic communities in both Sri Lanka's Sinhalese majority and its Tamil minority.
Sri Lankan officials say Sunday's attacks were in retaliation for the Christchurch attacks March 15. However, at the news conference Tuesday, Wickremesinghe said this was only a possibility. "We cannot say yet," the prime minister said.
The man accused in the Christchurch mosque attacks was not known to have any links to Sri Lanka. Before the attacks, he published a 74-page manifesto that contained references to Christian groups, and he made repeated reference to white supremacist beliefs.
Experts say tensions between Sri Lanka's Muslim minority and the country's larger Buddhist and Hindu populations have increased in recent years, with anti-Muslim riots occurring a number of times in recent years. It is unclear why a local group would target Christians specifically unless there was a broader motivation.
"Mosques have been being attacked in Sri Lanka itself for some time, and we saw very little violent reaction," Amarasingam said.
Why wasn't the Sri Lankan government prepared?
After Sunday's attacks, Sri Lankan officials have complained that warnings about the attacks had not been acted upon. In particular, there was a warning in an intelligence report that circulated within the Sri Lankan government days earlier that the National Thowheed Jamaath group was preparing to attack churches.
Opposition leaders have said a divide between Wickremesinghe and the Sri Lankan president, Maithripala Sirisena, could have added a layer of dysfunction.
"Don't take this as a joke," said Mahinda Rajapaksa, an opposition leader and Sri Lanka's former president.
"As long as the division between the president and the prime minister exists, you can't solve this problem. My security division knew about the advance notice (of the attack); I did not."
Sri Lankan Muslim groups say they also made warnings about growing extremism of National Thowheed Jamaath after its leader, known as Mohammed Zahran or Zahran Hashmi, gained attention for incendiary speeches.
"Some of the intelligence people saw his picture, but they didn't take action," N.M. Ameen, the president of the Muslim Council of Sri Lanka, told The Associated Press.
Sri Lanka's security services had been known as fairly robust, Taneja said. That reputation, built during the lengthy civil war, is now undermined.
"The fact that reports suggest the Sri Lankan government was alerted of such attacks and still did not do enough to counter this raises serious questions on both political and police credibility," he said.
