The Ideology is the Mastermind: Beyond a single mahamolakaru – Lessons from Easter Sunday on How Followers Become Killers
Consider the chronology given below: count how many warnings, attacks, and radical activities directly linked to Zahran Hashim prior to Easter Sunday 2019? From the repeated intelligence reports, the public preachings, the recruitment of associates, the Sufi attacks, to the growing network of potential operatives — the pattern is unmistakable. If these incidents were visible to the highest offices of government and security, why was decisive action not taken to neutralize the threat? The failure to respond to repeated signals by those seated in top positions raises questions about prioritization, awareness, and accountability. There is no similar case scenario where so many warnings were repeatedly given while those who were sent the warnings were well aware of Zaharan’s extremism but did nothing. Were these non-actions part of a bigger action plan to introduce new anti-terrorist laws that do not necessarily answer to the problems but silence those raising valid concerns? Let us not forget, the 2015 government came after regime change orchestrated by US & India. It is in this backdrop the readers must critically analyze below chronology.
2016–2019: Intelligence Known Before the Attack
Intelligence reports on ISIS radicalization, including Zahran Hashim & network, ran from 20 April 2016 to 30 April 2019, with 97 reports to the IGP and lists in 2017/2019 containing suspects according to the Supreme Court determination.
2012 – Zaharan establishes his own mosque in Kattankudy
2014 — one future bomber investigated by Australian JCTT for ISIS travel links
Abdul Latheef had already come onto the radar of Australian counterterror authorities for links to ISIS operative Neil Prakash
2014–2017 — Sustained anti-Sufi hate campaign
Zahran and NTJ spent several years targeting Sufi Muslims in Kattankudy through speeches, pamphlets, monthly publications, and public meetings, repeatedly branding Sufis as non-Muslims and urging social and religious isolation. Sufi leaders later told the PSC that at least 11 police complaints were lodged in 2016–2017, with earlier complaints to the Army in 2015.
2016 – Zaharan Hashim started preaching violent extremism publicly, releasing online videos advocating jihad and violent actions
Zahran uploaded his sermons and extremist messages to Facebook and YouTube.
These videos included calls for violence against non‑believers and rejection of pluralism, and drew followers across Sri Lanka.
Social media was a primary medium for spreading his radical views beyond local mosque audiences.
His online media outlets (sometimes attributed to what was called “Al‑Ghuraba media”) helped him build a larger virtual network of supporters and transmit his views to people who never met him in person.
20 April 2016–April 2019 — Early Warnings & Intelligence on Zaharan Hashim
The State Intelligence Service (SIS) sent at least 97 intelligence reports to the Inspector General of Police (IGP) warning about ISIS‑inspired radicalisation and activities linked to National Thowheed Jama’ath (NTJ) and its leader Zahran Hashim — including lists of suspects — according to affidavits presented in court.
20 Jul 2016:
Sisira Mendis → Secretary Defence, concept paper on countering ISIS threat
12 Sep 2016 / 17 Feb 2017 / 2 Mar 2017
documented extremist speeches
At public meetings in Kattankudy, Zahran allegedly declared that all non-Muslims in Sri Lanka should be killed, while continuing anti-Sufi incitement.
These speeches were later submitted on CD to senior state offices as advance warnings
18 November 2016
Then Justice Minister Wijeyadasa Rajapakshe told Parliament that around 32 Sri Lankans from four wealthy families had joined ISIS in Syria, highlighting the presence of foreign fighter networks and suggesting radicalisation beyond local actors.
Muslim Parliamentary MPs, including AHM Azwer, objected in Parliament to Minister Wijeyadasa Rajapakshe’s claim that 32 Sri Lankans from four families had joined ISIS,. The Muslim Council of Sri Lanka (MCSL) issued a strong statement rejecting the claim as misplaced and urging that peaceful Muslims not be conflated with extremists, calling for factual investigation and action against any lawbreakers irrespective of religion.
10 March 2017
Armed attack on Sufi gathering, Kattankudy
Zahran’s followers attacked a Sufi religious event with swords, knives and metal rods, injuring participants. Several NTJ members including his father and brother were arrested, while Zahran went into hiding soon after. This incident is one of the clearest early transitions from hate speech to organised violence.
March 2017:
1st arrest warrant was reportedly issued against Zaharan Hashim based on earlier police intelligence.
SIS maintained detailed lists of radicalised individuals, including 94 names by October 2017 and 129 names by January 2019, continuously tracking Zahran Hashim and his associates.
Sufi leaders sent CDs and written complaints to the President’s Office, Prime Minister’s Office, Justice Ministry, Law & Order Ministry, State Defence Ministry, IGP, AG’s Department and TID, warning that a disaster would follow if Zahran was not stopped.
7 June 2017: (TID/AGs Dept)
TID opens file on Zaharan and sends it to AG’s dept for necessary legal advice/actions.
Azard Navavi (Deputy Solicitor General) testified before the PCoI that the TID file on Zahran Hashim was received by him on 7 June 2017 and that he assigned it to State Counsel Malik Aziz to handle because video clips were in Tamil.
Navavi admits the file was ignored until 3 weeks AFTER the attacks when TID reminded them about the file.
Malik Aziz testified that the file was sent in 2017 & updated in 2018 but it did not include 2 arrest warrants or statements from Zaharans family until March 2019. He claims the file did not have a strong legal case.
NOTE: TID file to AG’s Dept ignored until after attacks with exact delay (Azard Navavi → Malik Aziz, file received 7 Jun 2017, acted only 3 weeks after 21 Apr 2019)
Jayantha Jayasuriya was AG till 29 April (during Easter attacks) Dappula de Livera was AG from 29 April to May 2021.
9 September 2017:
Shani Abeysekara was appointed Director of the Criminal Investigation Department (CID) — Sri Lanka’s main investigative arm — and held that post through to 21 November 2019.
31 Oct 2017:
SIS sends list of 94 radicalised individuals to IGP (includes Zahran, Rilwan, Milhan, Jameel)
Nov 2017:
Further ISIS threat report Sisira → IGP
Early April 2019 — Panadura operational meeting
Zahran reportedly met more than a dozen operatives in Panadura where the final attack plan was discussed and targets confirmed.
Noteworthy is that the Channel 4 star witness Asad Maulana was also living in Panadura while after marriage he lived in Ebenezer Place, Dehiwela where Jameel the Taj/Tropical Inn suicide bomber came to a mosque before blowing off his suicide vest.
By 2017–2019, Zahran had expanded his influence beyond a single mosque in Kattankudy:
He lectured in locations across eastern and western Sri Lanka even in Nuwara Eliya to attract young people to his views.
Community reporting notes he spoke at NTJ‑affiliated gatherings and mosque rallies — including a mosque set up in a private house used by local NTJ coordinators (e.g., in Kuliyapitiya and Hettipola).
2 July 2018
TID files B report at Colombo Magistrates Court against Zaharan Hashim
August 2018
arrest issued against Zaharan Hashim.
September 2018
TID investigation disrupted when TID Head Nalaka de Silva removed.
1 Nov 2018 → 25 Apr 2019:
Around 11 reports sent to Hemasiri Fernando (Secretary Defence) via SIS/intelligence chain
December 2018
Buddha Statues vandalized in Mawanella by Zaharan’s gang (2 brothers)
Early 2019 — Zahran Hashim actively associated with and recruited the Ibrahim brothers (Ilham & Inshaf), convincing them across months via personal contact and private online forums to join his extremist network.
14 January 2019
1st NSC meeting chaired by President Sirisena
18 January 2019
100 kg explosives in Wanathawilluwa near Wilpattu
31 Jan 2019:
Second SIS list of 129 radicalised persons
19 February 2019
2nd NSC meeting chaired by President Sirisena.
19 Mar 2019:
Weekly ICM agenda explicitly mentions Zahran, NTJ
4 April 2019:
Indian intelligence shared specific warnings about planned attacks targeting churches and hotels with Sri Lankan authorities.
Parliamentary Select Committee (PSC) later found that this intelligence was not shared promptly with operational units, delaying preventive action despite the clear threat.
5 Apr 2019:
Confirmed in writing twice (09:00 and 12:15)
6 Apr 2019: Initial briefing; further verification sought by Nilantha J
7 Apr 2019: Escalation by Nilantha J to Sisira Mendis (CNI) → 3-day delay
8 Apr 2019:
Sisira Mendis forwards foreign warning to Hemasiri Fernando and IGP (formal awareness established)
9 Apr 2019:
ICM – Chaired by Hemasiri Fernando, attended by SIS, CNI, IGP, tri-forces, intelligence heads
(perfect opportunity to discuss threat but Hemasiri: “did not take any initiative to open discussion” / Sisira: failed in coordinating intelligence.
16 April 2019:
A motorcycle carrying explosives detonated accidentally in Kattankudy — a clear signal of imminent violence.
SIS submitted additional detailed intelligence reports on 18, 19, and 20 April 2019 regarding Zahran Hashim and his network; these reports were inadequately acted upon prior to the attacks.
No ICM or NSC convened.
20 April 2019–SIS informs→ SDIG/CID Ravi Seneviratne, copy to IGP (no action taken)
20 Apr 2019:
SIS → Hemasiri Fernando
16:53 → attack imminent, 8 targets
18:23 → Hemasiri “well received”
21:10 → “Discussed with IGP”
21 April 2019 — Easter Sunday Attacks
Coordinated suicide bombings occurred across Sri Lanka — killing nearly 270 people and injuring hundreds.
The nine suicide bombers were part of a coordinated NTJ/JMI operational cell led by Zahran Hashim. Identified members included Ilham and Inshaf Ibrahim (hotel attacks), Naufer Maulana (St. Sebastian’s, Katuwapitiya), Mohamed Nasser Asad, Mohamed Azzam Mubarak Mohamed, Abdul Latheef, and other associates, linking them directly to the extremist operational network surrounding Zahran.
Dematagoda housing complex suicide blast
When police entered the home of the 2 suicide bomber brothers one of the wife blew off her suicide vest killing herself, 2 children and the baby in womb alongside 3 policemen.
21 Apr 2019: IGP appended endorsements of previously received warnings only on 21 Apr; called for report by 5 May
Supreme Court called this action by the IGP “nothing is more lackadaisical than this approach”
22 April 2019 — President Sirisena appointed the Malalgoda Committee to investigate the Easter attacks; final report submitted on 10 June 2019.
23 April 2019 – ISIS‑linked media released footage of Zahran and other attackers pledging allegiance to ISIS, illustrating ideological and operational alignment beyond Sri Lanka’s borders.
26 April 2019 — Sainthamaruthu Safe House Raid
Sri Lankan security forces raided an NTJ hideout in Sainthamaruthu (Ampara District) . During the raid, three detonated suicide devices, killing themselves along with multiple family members including women and children (15 DEAD)
Rilwan Hashim Suicide Detonation – brother of Zahran Hashim, detonated a suicide device at the Sainthamaruthu safe house, killing several family members.
Sarah Jasmine (Pulasthini Mahendran) wife of Easter Sunday bomber Atchchi Muhammadu Hasthun (St. Sebastian’s Katuwapitiya), died in the Sainthamaruthu safe house explosion.
Zahran’s father (Mohamed Hashim), his two brothers (Rilwan and Zainee Hashim), his mother (Abdul Sakar Siththi Umma), his eldest son (Mohamed Zahran Wasim), and his pregnant sister (Mohamed Cassim Hidiya).
Zahran’s wife (Abdul Qader Fathima Hadiya) and daughter (Mohamed Zahran Rusaina) survived with injuries.
This shows that Zahran’s immediate and extended family were directly part of the Easter Sunday attacks — reinforcing that he was more than an ideologue, but a leader whose network included close family members involved in the same militant activities and sheltering together when confronted by security forces (note they moved from Kattankudy to Sainamaruthu after discovering their photos appearing on tv)
26 April 2019
Sammanthurai logistics cache discovered
Security forces recovered over 150 gelignite sticks, ISIS flags, uniforms, a drone, detonator materials, and a laptop from another linked property
27 April 2019
Government formally bans NTJ, JMI and related extremist entities
May 2019 — AG directs CID to investigate former Defence Secretary Hemasiri Fernando and IGP Pujith Jayasundara for failures to act on intelligence.
2 May 2019 —
Mathaniya Mohammed Hashim, a sister of NTJ leader Zahran Hashim, was *arrested by police with Rs 20 lakhs seized from her residence in New Kathankudy,
22 May 2019 — Parliamentary Select Committee appointed to probe intelligence/security lapses related to Easter attacks.
22 September 2019 — Presidential Commission of Inquiry (Janak de Silva) appointed to probe the attacks.
23 October 2019 — PSC presented its final report to Parliament.
21 November 2019:
Shani was transferred out of the CID and reassigned as Personal Assistant to the Deputy IGP (Galle Range)
27 November 2019
AG recommends disciplinary action against Azard Navavi and Malik Aziz to the Public Service Commission for failure to provide formal legal advice to TID on Zaharan. PCoI did not permit publication of the PSCs decision. There is no public record they were punished or dismissed
11 December 2020 — FBI affidavit formally identifies Zahran Hashim as the mastermind of the 2019 Easter Sunday attacks, based on extensive investigation including forensic evidence, communications, and witness accounts
December 2019 / 7 January 2020:
Shani Abeysekera interdicted (suspended) from the police service by the National Police Commission citing leaked phone conversation with former Minister Ranjan Ramanayake as the reason.
Subsequent Parliamentary and Supreme Court scrutiny documented intelligence lapses, delayed responses, and failures to act on prior SIS reports, highlighting gaps in the handling of Zahran Hashim’s threat network.
Shani Abeysekera files 4 FRs
- 20 Dec 2019 – challenging removal/transfer from position as Director CID
- 15 July 2020 – challenging National Police Commission interdiction & seeking reinstatement (this petition was withdrawn by him on 30 July 2020)
- 21 February 2022 – file to prevent arrest/detention based on B report filed in Kuliyapitiya Magistrates court (B report No 1411/2022) sought immediate release and compensation if detained.
- 8 October 2025 – SC grants leave to proceed alongside petitions by Sudath Mendia & H D M Premathilaka (former CID officers) challenging their arrest by CCD in 2020 claiming arrests were politically motivated.
8 January 2021 — U.S. Department of Justice publicly announces terrorism charges against three Sri Lankans for conspiring to provide material support to ISIS linked to the Easter Sunday attacks; the underlying criminal complaint was filed on 11 December 2020.
1 February 2021 — Final report of the Presidential Commission submitted to the President.
24 April 2021 –
Rishad Bathiudeen and brother arrested by CID under the PTA over alleged links to the Easter Sunday attackers.
Muslim MPs resign following arrest.
12 January 2023:
Supreme Court FR determination on Easter Sunday attacks by multiple petitioners. The Court found the following guilty of lapses and ordered to pay compensation – former President Sirisena, former IGP Pujith Jayasundera, former CNI Sisira Mendis, former Defense Secretary Hemasiri Fernando and former SIS Head Nilantha Jayawardena.
Whether the earlier sectarian attacks were carried out by others or by Zahran personally is secondary. The continued pattern across the world is what needs to be analyzed. It is the same violent themes, same targets and same extremist ideology that begins with hate speech, includes sectarian intimidation and then elevates to organized terror attacks which includes suicide terrorism as martyrdom
The chronology therefore shows that the principal driver was not a single individual alone, but an evolving extremist doctrine capable of being preached by one actor, adopted by another, and operationalized by future recruits into mass-casualty violence.
This shows that the real “mastermind” is the ideology and indoctrination system itself: the path from hate to violence and suicide attacks will repeat unless stopped early. If individuals can be indoctrinated to kill, the source that indoctrinates them must be stopped first.
If not, multiple individuals may emerge as successive operational masterminds following the same ideological cause. Unless the root of the ecosystem network is identified there will be more masterminds.
The persistent public fixation on identifying a single mastermind, obscures and obstructs the more important security reality: identifying extremist ecosystems capable of repeatedly generating new leaders, planners, facilitators, and attackers.
Focusing solely on a single ‘mahamolakaru’ actually obscures the real danger and obstructs efforts to identify and disrupt the underlying extremist ecosystem that breeds potential killers.
Shenali D Waduge
