The Sri Lankan terrorist believed to have helped carry out the Easter bombings made a crucial error that may have prevented many more deaths.
Abdul Lathief Jameel Mohamed, 36, — who is believed to have been radicalised in Australia — originally targeted the five-star hotel Taj Samudra in the country's capital of Colombo, but his suicide vest failed to detonate, an intelligence source told The Times.
The luxury hotel is situated between the Shangri-La and the Cinnamon Grand, which were attacked by his co-conspirators on Sunday.
Mohamed returned to a safe house in the city's south to have his device repaired, and detonated it at a guesthouse near Colombo zoo, killing two people. Had he managed to set off the explosive at his first target, the casualties could have been far higher.
The Sri Lankan terrorist had spend time living in Melbourne and left an "angry and crazy" extremist who was investigated for links to Australian-born Islamic State operative Neil Prakash, it's been revealed.
Abdul Lathief Jameel Mohamed, 36, studied aerospace engineering at Kingston University in southwest London from 2006 to 2007 before travelling to Melbourne for a postgraduate degree.
Prime Minister Scott Morrison confirmed one of the Sri Lanka attackers spent time in Australia on a student and graduate skilled visa, departing in 2013.
The Australian reports that Mohamed was previously one of the subjects of a terrorism investigation by Australian security authorities after intelligence emerged linking him to Prakash, 27.
Prakash, who was born in Melbourne, gained infamy for his role in IS propaganda videos that urged young Muslims to fight the West. Speaking in English with an IS flag visible behind him, he encouraged attacks in Australia and praised a knife attack on two police officers by 18-year-old Numan Haider. His Australian citizenship was revoked in December and he remains in a Turkish prison awaiting trial for terrorism offences.
It's unknown how much contact the pair had but there was at the very least an "online" link between them, according to The Australian. There is no evidence Mohamed and Prakash knew each other while they were both in Melbourne.
Mohamed's sister Samsul Hidaya told Mail Online the suicide bomber returned to his home country "angry and totally crazy", berating relatives for trimming their beards. He had developed extreme religious views, she said, and became quiet and withdrawn.
"My brother became deeply, deeply religious while he was in Australia," she said. "He was normal when he went to study in Britain, and normal when he came back.
"But after he did his postgraduate in Australia, he came back to Sri Lanka a different man.
"He had a long beard and had lost his sense of humour. He became serious and withdrawn and would not even smile at anyone he didn't know, let alone laugh."
His sister's comments came as Sky News released chilling CCTV footage showing the bomber outside the Tropical Inn Hotel in Dehiwala before the explosion.
Ms Hidaya said her brother, one of six siblings, had always been religious, but was a music lover and a "funny boy". That all changed after his time in Australia, she said, and his new devout attitude "created tension" within the family.
"It makes me sad to think what happened to him," she said. "Before he died he would not let his children listen to music and he never said a friendly word to anyone."
Mohamed began working in property and married the landlord's daughter, Shifana, after he returned from the United Kingdom and before he headed to Australia. He had his first child in Australia before returning to live in an affluent Colombo suburb in the family's mansion, which was raided on Monday.
His younger sister married a Sri Lankan New Zealander and moved to Auckland with their mother.
#BREAKING: Sri Lanka police arrest 3 persons along with 21 hand grenade type, locally made low explosives & 6 swords during a search operation in Modera pic.twitter.com/fX5YyKJlY7
The bomber came from a well-off tea trading family in the city of Kandy, and studied at Gampola International School and the prestigious Royal Institute in Colombo.
His father died 10 years ago and his mother moved the family to a predominantly Muslim suburb in the capital. His grandfather reportedly left Mohamed an extensive property portfolio. and he had no need to work.
Ms Hidaya told Mail Online she had argued with her brother over his religious beliefs and they had stopped speaking. But she was left reeling at the news of his involvement in the devastating attacks.
"When the police came to tell us it was him, I almost collapsed," she said. "I just didn't think he would take it this far. I am still in disbelief. Something happened to him in Australia that changed his personality. He became silent and aloof."
Mohamed's wife has been taken into custody and their children, aged six, four, two and six months, are being cared for by their grandmother in the home where the attacks were reportedly planned.
The Australian government this morning issued a warning to citizens in Sri Lanka.
"Terrorists are likely to carry out further attacks in Sri Lanka," the statement read.
"Attacks could be indiscriminate, including in places visited by foreigners. Security has been stepped up across the island. A State of Emergency and night-time curfew remain in place."
Tensions are building in Sri Lanka, with Muslims reporting harassment and disappearances, the army increasing the number of troops on the streets to 6300 and churches closing on the advice of security forces.
The president's office announced the resignation of the Defence Secretary, after government leaders acknowledged that some intelligence units were aware of possible terror attacks against churches or other targets weeks before the bombings.
Police on Thursday arrested three people and seized 21 locally made grenades and six swords during a raid in Colombo, according to a spokesman. He did not give further details or suggest the arrests were linked to the terror attacks.
Officers brought in 16 additional people for questioning overnight, including an Egyptian and several Pakistanis, taking the number detained since Sunday to at least 76.
Earlier on Thursday, Sri Lankan authorities scrambled to lock down the central bank and briefly shut the road leading to Colombo airport. Two bank officials told Reuters the street outside the building was blocked before the security alert was lifted.
Authorities also shut the entry road to the airport after a suspicious vehicle was identified at a nearby car park, which proved a false alarm. A police spokesman said there was an unexplained explosion in a town east of the capital, but no casualties.
Sri Lankan Defence Minister Ruwan Wijewardene told a media briefing authorities believed the attacks were carried out by nine suicide bombers — including one woman — most of them university educated and from well-heeled families, a factor he described as "worrying".
"This group of suicide bombers, most of them are well-educated and come from middle or upper-middle class, so they are financially quite independent and their families are quite stable financially," he said on Wednesday.
"That is a worrying factor in this. Some of them have I think studied in various other countries, they hold degrees, LLMs (law degrees), they're quite well-educated people."
Two of the bombers were brothers, sons of a wealthy spice trader and pillar of the business community, a source close to the family told Reuters.
Inshaf Ibrahim, a 33-year-old copper factory owner, detonated his device at the breakfast buffet of the luxury Shangri-La hotel, the source said. When police went later that day to raid the family home, his younger brother Ilham Ibrahim detonated a bomb that killed him, his wife and the couple's three children, the source told Reuters.
However, there appeared to be confusion over Ilham Ibrahim's role, with other reports naming him as the bomber of the Cinnamon Grand Hotel and identifying his pregnant wife as the female bomber who detonated the explosives when police arrived at the family home.
Sri Lankan authorities have not released the identities of any of the bombers, and police did not respond to a request for comment.
On Tuesday, Islamic State claimed credit for the attacks and released video of eight people. Only one had their face uncovered — Zahran Hashim, leader of local Islamist group National Thowheeth Jama'ath (NTJ).
Officials said it was still unclear whether Hashim was among the suicide attackers or had escaped. Authorities have said they cannot rule out further attacks while suspects are at large.
Mr Wijewardene told parliament two Sri Lankan Islamist groups, NTJ and Jammiyathul Millathu Ibrahim, were responsible for the attacks. He has said preliminary investigations indicated the bombings were carried out as revenge for last month's mosque shootings in New Zealand.
However, many are sceptical of a Christchurch connection, pointing out the co-ordinated bombings were likely to have required months of planning.
Mr Wijewardene said the country remained on high alert. "We are asking the people to be vigilant," he said. "I'm not saying the country is 100 per cent at the moment. Within the next few days, we will have the situation totally under control."
Sri Lanka declared a state of emergency from midnight on Monday, giving police and military expanded power to detain suspects.
A curfew, that requires Sri Lankans to be in their homes by 10pm, was imposed again last night.