Islamic State has claimed responsibility for the Sri Lanka terror attack. Here's what that means

In the wake of any tragedy, it should be enough to grieve and stand in solidarity with those who mourn. With a massive toll – at least 359 dead and around 500 injured – it feels disrespectful to the people of Sri Lanka to be dissecting what went wrong even as the dead are being buried.

But the reality is that most, if not all, of these lives need not have been taken. We owe it to them and their loved ones to make sense of what happened and work towards doing all that can be done to ensure it does not happen again.

The Easter attacks represent one of the most lethal and serious terrorist operations since the September 11 attacks in the US, outside of attacks within active conflict zones. And this in a now peaceful country, which for all its history of civil war and ethno-nationalist terrorism in decades past has never had a problem with jihadi radical Islamist terrorism.

A return to deadlier, more coordinated strikes

The long-anticipated claim of responsibility for the attacks was made by the Islamic State (IS) on Tuesday night. This could help explain how one local cell based around a single extended family circle of hateful extremists not previously known for terrorism could execute such a massive attack. It was larger even than IS’s previous truck-bomb attacks in Syria, Iraq and Afghanistan.

The attacks follow a familiar, if now rarely seen, IS operandi of coordinated suicide bombings. The targeting of Catholic churches, which made little sense initially in the context of the domestic social issues at the heart of the country’s recent civil war, fit an all-too-familiar pattern of IS attacks on Christians, along with fellow Muslims.

Read more: Who are Sri Lanka's Christians?

The fact that 40 or more Sri Lankans travelled to Syria to fight with IS could help explain how the terror network was able to build vital personal links in the very small community of Sri Lankan Islamist extremists so it could subcontract its attack plans to them. At this point, the precise involvement of returnees from Syria and foreign IS supporters in the bombings remains under investigation.

The Easter weekend attacks more resemble the al-Qaeda attacks of the 2000s than they do recent attacks of IS. Like the 2000 attack of the USS Cole in Yemen, the September attacks in New York and Washington, the 2002 bombings in Bali, the 2003 truck bombs in Istanbul, the 2004 train bombings in Madrid, the 2005 tube and bus bombings in London, the Sri Lanka bombings involved multiple attackers acting in concert. With the exception of September 11, all of these also involved improvised explosive devices (IEDs).

The Sri Lanka bombings exceeded all but the September 11 attacks in sophistication and deadliness, despite the fact the perpetrators were previously known only for acts of hateful vandalism.

Over the past decade, al-Qaeda has been unable to carry out significant attacks outside of conflict zones. It has also become increasingly focused on “reputation management” and has tended to avoid indiscriminate mass killings, all the whilst growing its global network of affiliates.

Read more: Out of the ashes of Afghanistan and Iraq: the rise and rise of Islamic State

The emergence of IS saw the tempo and scale of terrorist attacks transformed. Most attacks took place in conflict zones (Syria, Iraq, Libya, Yemen, Afghanistan, Pakistan, southern Philippines).

A number of significant attacks were conducted well beyond the battlefield. There were at least four such attacks in 2014, 16 in 2015, 22 in 2016, 18 in 2017, and 10 in 2018. The vast majority of these attacks were conducted by lone actors.

Why was it that, outside of conflict zones, not just al-Qaeda but even IS at the height of its powers focused largely on lone-actor attacks?

It is probably not for want of trying. The reason is that most larger, more ambitious plots were tripped-up by intelligence intercepts. This is especially the case in stable democracies, including our neighbours Indonesia and Malaysia.

Why Sri Lanka?

The other big question is how one of the deadliest terrorist attacks ever was able to be executed in Sri Lanka?

Sri Lanka was a soft target. Having successfully defeated the Tamil Tiger rebel group a decade ago through military might, Sri Lanka has become complacent. It has not seen a pressing need to develop police and non-military intelligence capacity to counter terrorism.

Read more: War is over, but not Sri Lanka's climate of violence and threats

At the same time, it has struggled with good governance and political stability. Just six months ago, it faced a major constitutional crisis when President Maithripala Sirisena sacked his deputy, Prime Minister Ranil Wickremesinghe, and attempted to replace him with the former prime minister and president Mahinda Rajapaksa.

The attempt failed, but in the stand-off that ensued, Wickremesinghe, and ministers loyal to him, were excluded from intelligence briefings. In particular, they say that they were left unaware of the multiple warnings issued by the Indian intelligence service, RAW, to the authorities in Colombo about the extremist figures who played a key role in the Easter attacks.

Thus, despite several discoveries earlier this year of large amounts of explosives stored in remote rural locations on the island, and multiple warnings from the Indians, including final alerts just hours before Sunday’s attacks, the government and security community were left distracted and caught off-guard.

Between “fighting the last war” and fighting each other, they deluded themselves that there was no imminent terrorist threat.

What other countries are vulnerable?

If the massive attacks in Sri Lanka over Easter serve to remind us that IS is very far from being a spent force, the question is where this energetic and well-resourced network will strike next.

For all that it achieved in Sri Lanka, IS is unlikely to be able to build an enduring presence there. So long as the Sri Lankan government and people emerge from this trauma with renewed commitment to unity – and with elections at the end of the year, this is far from certain – the “perfect storm” conditions exploited by IS are unlikely to be repeated.

So where else is IS likely to find opportunity? India and Bangladesh continue to present opportunities, as does much of Central Asia. In our region, it is Malaysia, Thailand and the Philippines that we should be most worried about.

Malaysia has emerged stronger and more stable from its swing-back to democracy but continues to be worryingly in denial about the extent to which it is vulnerable to terrorist attacks, downplaying the very good work done over many years by the Special Branch of the Royal National Malaysian Police.

Read more: Defeated in Syria and Iraq, the Islamic State is rebuilding in countries like Indonesia

Thailand and the Philippines remain less politically stable, and rather more brittle than they care too acknowledge. And both tend to delude themselves into thinking that the problems of their southern extremes will never manifest in a terror attack in Bangkok or Manila, respectively.

The people of Sri Lanka have paid far too high price for the lessons of the Easter weekend attacks to be ignored or forgotten.