Colombo — More than seven years after eight suicide bombers tore through three churches and three hotels, killing more than 260 people, Sri Lanka is still arguing about what really happened on Easter Sunday.
The country’s search for answers has produced thousands of pages of testimony, evidence, and analysis spread across seven major investigations. Yet those inquiries did not always pursue the same questions, nor did they always reach the same conclusions.
The debate has now burst back into public view following former intelligence chief Suresh Sallay’s hunger strike in custody and his subsequent hospitalization. His case has once again turned national attention toward the Easter attacks, the investigations that followed, and the unresolved questions that continue to haunt them.
In the heat of competing claims, political accusations, and public outrage, it is easy to lose sight of what the various investigations actually found.
This series aims to return to the record.
Over the coming weeks, we will examine each major inquiry separately—what it was asked to investigate, the evidence it considered, the witnesses it heard, and the conclusions it ultimately reached. Some reports overlap. Others contradict one another. Together, however, they form the most comprehensive account available of one of the darkest days in Sri Lanka’s history.
There are, by any reasonable count, seven major reports.
The Malalgoda Committee, appointed the day after the bombings, established the basic chronology of events and triggered the first criminal referrals. The Parliamentary Select Committee apportioned responsibility in detail and placed the heaviest share of blame on the country’s intelligence leadership. The Presidential Commission of Inquiry, the most comprehensive investigation conducted in Sri Lanka, heard evidence from more than 440 witnesses and ultimately found fault with the former president and several senior officials.
The Supreme Court, in January 2023, transformed some of those findings into the only enforceable personal liability imposed on any individuals over the attacks. The Imam Committee examined — and found unproven — the allegations broadcast by Britain’s Channel 4.
The de Alwis Committee, the most recent and perhaps the most controversial inquiry, broke new ground by scrutinizing the conduct of the Criminal Investigation Department’s leadership in connection with a separate killing in the Eastern Province.
Taken together, the reports offer not a single narrative but a series of overlapping and at times conflicting explanations for one of the deadliest episodes in Sri Lanka’s modern history.
And then there is the seventh, which is unlike the others. It was not a Sri Lankan inquiry into how the state failed to stop the plot. It was an American criminal investigation into what the plot was — and into the men who built it. It is where this series begins.
A complaint sworn in Los Angeles
On 11 December 2020, in the Central District of California, an FBI special agent named Merrilee R. Goodwin swore out a criminal complaint before a United States magistrate judge, Charles Eick. The document it rested on — a 72-page filing — is the most granular public reconstruction of the Easter cell in any official file, Sri Lankan or foreign.
The complaint charges three men: Mohamed Naufar, Mohamed Anwar Mohamed Riskan, and Ahamed Milhan Hayathu Moahmed. The charges are American ones. All three are accused of conspiring to provide material support to a foreign terrorist organisation — ISIS — under Title 18, Section 2339B of the United States Code. Two of them, Naufar and Milhan, are additionally charged with aiding and abetting the receipt of military-type training from ISIS.
What gives an American court jurisdiction over a massacre in Colombo, Negombo, and Batticaloa is set out plainly in the affidavit: five of the dead were United States citizens. Three — identified in the document only by their initials, one of them an employee of the U.S. Department of Commerce working in Colombo in her official capacity — were killed at the Cinnamon Grand. Two more died at the Shangri-La. Within hours of the attacks, the affidavit records, Sri Lanka accepted Washington’s offer of help, and the FBI deployed personnel to the island to collect evidence, identify the attackers, and arrange the return of the American dead.
One sentence in the document carries more weight in Colombo than any other. As of the date of filing, late 2020, more than eighteen months after the attacks, the Sri Lankan government, the affidavit states, had charged no perpetrator of the Easter attacks, including the three men the United States was now moving to charge.
The finding that sets the FBI apart
On one key question, the American investigation reached a conclusion that several Sri Lankan inquiries had approached with far greater caution.
The Parliamentary Select Committee recorded that investigations to that point had shown no evidence that Zahran Hashim, the attacks’ mastermind, had direct links to ISIS. The Imam committee, examining the matter four years later, said it had found no acceptable evidence before it to connect ISIS to the bombings at all.
The FBI affidavit is categorical in the other direction. The attackers and their associates, it states, were members and supporters of ISIS who created a group, “ISIS in Sri Lanka”, that ISIS formally recognised as an affiliate operating on the island, with Zahran as its self-proclaimed leader.
The agent lays out a chain of evidence for that recognition: a video, recorded in a Sri Lankan forest in late 2017 or early 2018, in which Zahran and his lieutenants pledged allegiance while holding firearms; the dispatch of that video to associates living in ISIS-controlled Syria; and Zahran’s subsequent claim that ISIS leaders had approved his group and were communicating with him directly over Telegram, supplying him with a training syllabus.
On 23 April 2019, two days after the attacks, ISIS claimed responsibility through its Amaq news agency, declaring that its fighters had targeted citizens of “coalition states” and Christians in Sri Lanka. The same day, Amaq released a photograph and video of the attackers swearing allegiance to the ISIS leader, Abu Bakr al-Baghdadi — Zahran visible, unmasked, at the centre, in front of the group’s flag. Six days later, al-Baghdadi himself appeared on video praising the bombings as revenge for ISIS’s territorial defeat at Baghuz, in Syria, weeks earlier, and praising that among the dead were Americans and Europeans.
Where the Sri Lankan inquiries weighed whether the cell was operationally commanded from Syria and largely declined to say, the American case treats the affiliation itself as established — a recognised ISIS franchise, whatever the limits of any day-to-day command from abroad.
This is the FBI’s distinctive contribution to the record.
The morning, reconstructed from the cameras
The affidavit rebuilds the morning of 21 April 2019 minute by minute, from CCTV footage, blast-site evidence, and witness accounts. At 8:45 a.m., a bomber the FBI identifies as Ahamed Muaath Alawudeen detonated inside St Anthony’s Shrine in Colombo. Two minutes later, near-simultaneous blasts struck the Kingsbury hotel in Colombo and St Sebastian’s Church in Negombo. At 8:50, the Cinnamon Grand. At 8:54, two bombers, Zahran among them, struck the Shangri-La. At 9:05, a church in Batticaloa, Zion, on the east coast.
One device failed. A bomber the FBI calls Lateef tried and failed to detonate inside the Taj Samudra in Colombo that morning; the affidavit reproduces a still of him pressing the switch. He left, and at 1:20 that afternoon, detonated successfully inside a guesthouse in a Colombo suburb.
Later still, the pregnant wife of one of the Shangri-La bombers detonated a device at a house in Dematagoda as police arrived, killing herself, her three sons, and three officers. Five days after that, a raid on a house in Sainthamaruthu ended with cornered cell members detonating explosives, killing fifteen people inside — among them Zahran’s father and two brothers.
How the bombs were built — and what the lab confirmed
The affidavit’s most technical chapters describe what the cell built and how investigators proved it, and they matter because they tie the three charged men to the devices through physical evidence rather than just confessions.
The Easter bombs, the FBI concluded, were nitrate-based devices: a metal container of explosive concealed in a cloth backpack, with an electrical fuse and ball bearings packed in as shrapnel. The principal explosive was a commercially available “water gel” — an ammonium-nitrate-based explosive the cell could buy on the open market in Sri Lanka — supplemented, the evidence suggested, by urea nitrate the group manufactured itself from fertiliser and acid at a rural estate in Puttalam. Investigators put the explosive yield of the urea nitrate produced at that one safe house at roughly the equivalent of 163 pounds of TNT.
The forensic spine of the case is the FBI’s Terrorist Explosive Device Analytical Center. Its examiners detected nitrite ions, which, the affidavit notes, do not occur naturally in the environment — at several blast sites and safe houses, a chemical signature consistent with the detonation of exactly the kind of nitrate-based explosives the witnesses described. The same lab matched fingerprints lifted from the Panadura safe house to two of the men who had handled the devices.
The cell’s tradecraft is documented in the same detail. Members trained across roughly eight multi-day courses held in rented houses, fifteen to twenty-five students at a time, learning to handle a Type-56 rifle and to make explosives. They were told not to bring phones, not to use real names, to swap SIM cards every few months, and to communicate only over the encrypted apps Telegram and Threema. Much of the curriculum, the FBI found, came straight from ISIS: a terabyte of the organisation’s publications and training material recovered from a hard drive belonging to one of the Shangri-La bombers, including copies of the ISIS magazines Dabiq and Rumiyah and a manual urging attacks on churches and gatherings to maximise casualties.
The three men, and what each is said to have done
The affidavit’s portraits of the three defendants are drawn largely from their own recorded interviews at CID headquarters in Colombo, conducted by FBI agents after the men were read their rights and signed waivers, with translators present.
Mohamed Naufar is described as the group’s “second emir” — second only to Zahran — and its media and propaganda chief, a man who organised the training courses and lectured in them. His trajectory is one of the document’s strangest details: archived pages of his own blog show that as far back as 2014 he was writing Tamil-language criticism of ISIS, before, on his account, embracing it in 2017. Naufar told the FBI he had broken with Zahran a month before the attacks and had no advance knowledge of them, that he would have tried to stop Zahran had he known, and described the bombings, tellingly, as a “strategic mistake” that should have been a campaign of smaller attacks the group could survive. He admitted he was warned to flee on the morning of the attacks and did.
Mohamed Anwar Mohamed Riskan is the logistician of the affidavit. He procured safe houses, received and moved money at Zahran’s direction, transported the chemicals and fertiliser used to make the explosives, helped pack the finished devices with ball bearings, and, by his own account and the corroborating word of a hired truck driver who thought he was hauling goldsmithing supplies, drove bomb materials across the country to evade police searches. Zahran asked him to take part in the attacks themselves, framing them as revenge for the Christchurch mosque shootings; Riskan said he refused, and his fingerprints were later found at the safe house where the bombs were assembled.
Ahamed Milhan Hayathu Mohamed is the most violent figure in the file. Described as the group’s firearms instructor, he is accused of shooting a Sri Lankan police officer in the back of the head during a raid to steal weapons and of shooting a man whom the cell suspected of being an informant.
Investigators also say he conducted reconnaissance of potential targets, including a parade route at Galle Face and the Kandy Esala Perahera. He left Sri Lanka for Saudi Arabia four days before the Easter attacks. Saudi authorities later detained him and deported him to Sri Lanka in June 2019.
A finding that reaches into the next file
The affidavit does more than tell the story of how the attacks were planned and carried out. It also touches on one of the most contentious debates in the Easter Sunday saga, a question we will examine in depth later in this series.
In November 2018, five months before Easter, two police officers were murdered at a checkpoint near Vavunathivu, in the east. For roughly four months, Sri Lankan investigators treated that killing as the work of LTTE remnants. The de Alwis committee, reporting in 2024, would later fault the CID’s leadership, naming senior officers Ravi Seneviratne and Shani Abeysekara, for that misattribution, a recommendation the Catholic Church and the government have rejected, and the officers have moved to contest in court.
The FBI affidavit, written years earlier, places the Vavunathivu murders with Zahran’s group. Read together, its account of Milhan’s killing of a police officer and its separate description of the checkpoint murders describe the same event: one officer shot in the head with a Type-56 rifle, the other stabbed as he slept, the officers’ revolvers stolen — one of which was later recovered from the group’s Puttalam safe house. The American file, in other words, independently places the November killing with the same network that struck on Easter.
What this chapter establishes
Read on its own, the FBI affidavit answers a question the Sri Lankan inquiries mostly did not set out to answer. It is the most evidentially grounded account of the cell’s structure, financing, training, and bomb-making in any official record, and it is the one body that states without hedging that the attackers were a recognised ISIS affiliate.
It is also worth pausing on an unusual fact. This was a criminal case assembled by a foreign government about crimes committed in Sri Lanka, naming Sri Lankan suspects whom Sri Lankan courts had not charged. An American magistrate in Los Angeles approved arrest warrants connected to an atrocity in Colombo, yet years later, Sri Lanka itself had brought no comparable case. That gap between the two systems is the first of several unresolved questions this series will examine.
In the next installment: the Malalgoda committee, the inquiry that arrived first, named the failures earliest, and was kept from the public the longest.
To Be Continued…
