Introduction
The Sri Lankan public, police, intelligence community, and the criminal justice system deserve praise for their swift response in protecting Sri Lanka and its communities. When a former member of the Islamic State and supporter of the Islamic State Sri Lanka Branch, Fasrool Rahman Mohamed Zahran, alias “Podi Zahran” or “Little Zahran, filmed the Husaini Masjid Complex—Dawoodi Bohra Mosque—the intelligence surveillance teams deployed on the ground immediately identified and alerted the authorities on June 27, 2025. The Bambalapitiya Police promptly arrested him. As long as the intelligence community and the Sri Lankan public remain cooperative, alert, and vigilant, no terrorist attack can take place on this soil.
As Bohras are Shi’ites, the Islamic State has a gruesome history of targeting Shi’ites worldwide with vengeance. On the eve of its international annual assembly, the Islamic State’s al-Naba—a weekly publication—called for attacks on Shi’ites. Although most Sri Lankan Muslims are not influenced by such propaganda, some do consider Shi’ites to be apostates. Almost all the preachings of Zahran, the leader of the Islamic State Sri Lanka Branch, were aimed at radicalising Muslims to hate Shi’ites and Sufis.
The arrest of Podi Zahran concerned many, as the Sri Lankan Bohras are a productive and peaceful community.
Who is Podi Zahran?
Podi Zahran’s real name is Fasrool Rahman Mohamed Zahran. Hailing from Warakamura, Matale, Podi Zahran was born in 1998. His father worked in a children’s shoe factory in Warakamura, while his mother was unemployed. His elder sister’s husband works in Qatar, and his younger sister was employed at a biscuit factory. His brother studied at a prominent school in Matale.
Podi Zahran studied at an international school in Gampola from Grade 1 to 9, and then continued his education at a school in Katugastota for Grades 10 and 11. He pursued his A/Ls in the Mathematics stream at a prominent school in Kandy, and thereafter studied Information Technology at BCAS Kandy from May to October 2018. This gave Podi Zahran skills in web and graphic design. After receiving his education and vocational training in computers in Kandy, he traveled to Qatar, where he was radicalised and subsequently joined the Islamic State.
He is no ordinary suspect. I have written extensively about him in my book ‘Sri Lanka’s Easter Sunday Massacre: Lessons for the International Community’ (Penguin) and its updated Sinhala edition, ‘Sri Lanka’s Easter Sunday Massacre - Lessons to be Learnt’ (Sarasavi).
Radicalisation Pathway
In December 2018, Podi Zahran traveled from Sri Lanka to Qatar to care for his elder sister’s son. However, he later found employment at a private firm. His brother-in-law, Inshaf Anwar—who had been living in Qatar since 2002—facilitated his access to online lectures on the Islamic State delivered by Zahran Hashim. Radicalized by these lectures, Podi Zahran began promoting the Islamic State’s narrative. However, since Zahran’s sermons were in Tamil—a language in which Podi Zahran was not very fluent—he shifted to consuming Islamic State propaganda in English.
The Islamic State began using the mobile app Telegram as its primary platform for distributing propaganda after its Twitter accounts were shut down starting in 2015. Telegram has since become one of the most preferred platforms for online Islamic State supporters, replacing mainstream social media applications on the surface web. This demographic has utilized Telegram for several purposes, including serving as an “information highway” for the dissemination of official Islamic State media releases, coordinating supporters’ activities on the surface web, and facilitating internal communication among members.
An avid consumer of Islamic State propaganda, Podi Zahran read hundreds of articles and watched videos. Highly indoctrinated, these streams of Islamic State propaganda, made Podi Zahran a mega propagandist.
Podi Zahran’s preferred Islamic State media sources included:
- Halummu – The official propaganda arm of ISIS, known for producing highly stylized recruitment and ideological content.
- Nashir News Agency – A media outlet that distributes the group’s official announcements, battlefield reports, and ideological material.
- Al-Furat Media Center (Furat Media Foundation) – A multilingual media production unit that released videos, audio messages, and written materials in Russian, Kazakh, Turkish, Kyrgyz, Tajik, and Indonesian, in addition to Arabic and English.
- Generation Like the Companions – A publication series designed to glorify young jihadists by comparing them to the Prophet Muhammad’s earliest followers (Sahaba), aiming to inspire teenage and child recruits.
- Guidance of the Stars – An Islamic State media product that presented the lives of slain IS fighters as exemplary and heroic, offering so-called "spiritual guidance" to followers through their stories.
- Al-Bayan Radio – The Islamic State’s official radio station based in Iraq, which broadcasted on FM 92.5. The station followed a news-talk format and aired programs in Arabic, Kurdish, English, French, and Russian.
In addition to his command of the English language, Podi Zahran’s mastery of communication made him a prime candidate for recruitment by the Islamic State. Operating under the name Abu Hudzaifah, he actively worked to advance the vision and mission of the Islamic State.
As Zahran Hashim advocated Hijrah—a religiously framed migration to lands considered suitable for jihad—he urged his followers in January 2019 to migrate to Kashmir, portraying it as a new frontline for Islamic militancy.
In line with this call, Podi Zahran initially planned to travel to Kashmir with his brother-in-law. They communicated on telegram, with Islamic State operators Abu Zubai and Abdullah. As there was a bomb attack and the heightened security of Kashmir was not conducive for travel, they explored other options including Syria. In February 2029, they planned to visit to Nangahar in Afghanistan where they believed “pure Islam” is being practiced. However, due to difficulties of traveling to a conflict zone to perform Jihad and become a martyr, Podi Zahran decided to return to Sri Lanka.
Operation “Sonic – Sonic”
While in Qatar, Podi Zahran came to the adverse notice of foreign intelligence agencies. In accordance with standard protocol, a foreign intelligence service alerted its Sri Lankan counterpart. In February 2019, a Sri Lankan State Intelligence Service (SIS) operative—using the code name "Sonic Sonic"—established contact with an extremist social media account on Telegram, details of which had been provided by the foreign agency.
During the operation, it was revealed that the account belonged to Podi Zahran. The SIS officer, operating under the alias “Sonic Sonic,” maintained consistent interaction with him. To assess the suspect’s intentions and ideological leanings, the officer posed as a supporter of the Islamic State. As per SIS operational guidelines, distinct code names were used to protect the identities of operatives and the integrity of the mission.
During the operation, it was revealed that the suspected account holder was scheduled to arrive in Sri Lanka from Qatar on 15th April 2019. Tracked by U.S. intelligence and engaged by Sri Lanka’s State Intelligence Service through the avatar “Sonic Sonic,” Podi Zahran attempted to meet Zahran Hashim. However, as Zahran Hashim was highly cautious about his security, the meeting never took place.
Immediately following the Easter attacks on April 19, 2019, the officer known by the code name "Sonic Sonic" asked Podi Zahran in a close conversation, "who was in action before him?"
Podi Zahran then contacted an Indonesian Islamic State cell to inquire about the Easter attack. The cell explained that the Islamic State had not claimed responsibility because they had not received any video of Zahran Hashim or his network swearing allegiance to Abu Bakr al-Baghdadi. In response, Podi Zahran provided Zahran Hashim’s pledge video to Islamic State Indonesia. Shortly afterward, Amaq, the Islamic State’s official media outlet, publicised Zahran’s farewell video.
On April 24, 2019, the State Intelligence Service (SIS) reported the conversations between “Sonic-Sonic” and Podi Zahran to the Senior Deputy Inspector General (SDIG) of the Criminal Investigation Department (CID). Furthermore, when Podi Zahran disclosed information regarding a second attack, it was reported directly to the Inspector General of Police (IGP).
At the initiative of the SIS, Podi Zahran was detained by the police in Matale, with support from SIS officers. During their meetings, the SIS repeatedly urged the CID to investigate the suspect. Without Operation “Sonic-Sonic,” neither the CID nor any other investigative team would have uncovered how the Islamic State obtained Zahran Hashim’s pledge video.
Those who promote conspiracy theories for narrow political gain have falsely claimed that the swearing video was sent to Syria at the request of “Sonic-Sonic.” There is no evidence to support this fabricated narrative, which appears intended to discredit intelligence officers and a national institution, while also undermining the country’s national security.
Historical Context and Radicalization
'Podi Zahran' is a figure with a known history of radicalization and links to the Easter Sunday attacks. Although he did not directly participate in planning or executing the attack, he was a staunch admirer of Zahran Hashim, the mastermind behind it. Podi Zahran is widely recognized as the individual who released the bay'ah (oath of allegiance) video of the Easter attackers to official Islamic State platforms. He amplified the global impact of the attacks by sharing Zahran Hashim’s farewell video with an Islamic State media outlet, which eventually reached Amaq News. The release of this video prompted ISIS leader Abu Bakr al-Baghdadi to reappear publicly in 2019 after five years in hiding—creating an opportunity for the international intelligence community to track and ultimately target him.
Concerns Regarding Release and Rehabilitation
Following his arrest and interrogation in 2019, Podi Zahran was released. The decision to release a highly radicalized individual without prosecution or a structured rehabilitation program has become a matter of public concern. Given his past inclinations and open admiration for a terrorist leader, his release raises serious questions about national security. There are also broader concerns, as individuals with similar extremist mindsets have, in the past, relapsed into violence. Releasing Podi Zahran without subjecting him to a comprehensive deradicalization process highlights a critical oversight. Meanwhile, several Muslim organizations have filed Fundamental Rights petitions challenging the proposed rehabilitation program.
Fast forward to 2025: Podi Zahran was found videotaping the Bohra community's Ashara Mubaraka event in Bambalapitiya. His specific intentions behind this activity remain unclear and require thorough investigation to determine the truth. It is hoped that the footage was taken out of curiosity, and not as part of surveillance for a potential future attack. Sri Lankan authorities are expected to handle this matter with seriousness and impartiality to prevent any further threats.
The continued freedom of over 1,225 unrehabilitated but radicalized individuals—arrested in connection with the Easter attacks—poses an ongoing and immeasurable risk. Their current mindsets and potential future actions remain uncertain and cannot be guaranteed. This situation raises the possibility that similar concerning activities may occur in the future.
Counter-Terrorism Framework and Recommendations
From a counter-terrorism studies perspective, a terrorist attack typically involves a series of steps: target selection, surveillance, planning, deployment, execution, and exploitation. Given current geopolitical tensions, the Shiite-aligned Bohra community is a potential target for Sunni terrorist groups. In this context, Podi Zahran’s videotaping activity, though its precise intent is unconfirmed, aligns with the "surveillance" phase of a potential attack and highlights a tangible risk. This underscores the real and lasting threat emanating from the aftermath of the Easter attacks, particularly due to the presence of un-rehabilitated extremists whose ideologies remain unneutralized or reversed.
It is crucial for the government, law enforcement agencies including TID and CID, public leaders, and citizens to move beyond unproven conspiracy theories and immediately grasp the genuine threats and risks. Appropriate and decisive actions are imperative.
Key recommendations include:
- The organizations that filed Fundamental Rights (FR) cases should consider withdrawing them to allow the rehabilitation process for radicalized and violent individuals to proceed.
- The Chief of National Intelligence (CNI) should be empowered with appropriate legal authority, and the intelligence community should be strengthened through the immediate approval of the proposed Intelligence Bill.
- The Prevention of Terrorism Act (PTA) should not be repealed outright but replaced by the Counter-Terrorism Bill (CTB). While the PTA is outdated, the CTB includes provisions for rehabilitation. The PTA should only be withdrawn after a more robust legal framework for counter-terrorism is proposed and enacted. This new framework must address both physical and cyber-related threats and empower authorities to act against local and foreign-linked terrorism and violent extremism.
- The current classification and oversight mechanisms for known violent extremists, terrorists, and radicalized individuals should be re-evaluated. Surveillance and monitoring systems must be significantly strengthened.
- Most importantly, it is imperative that leaders and citizens move away from baseless and unproven conspiracy theories. To protect Sri Lanka, both the government and the public must focus on understanding and addressing the real, tangible threats highlighted by this incident. This collective shift in perspective is essential for ensuring national security.
Sri Lanka’s Future; Evidence not Fake New
Developing a bipartisan approach to national security is essential. The Easter Sunday attack has been reduced to a political football. To protect and advance national interests, politicians must rise above cheap politics.
Unfortunately, many of today’s politicians and officials struggle to read and comprehend the seven fact-finding reports, as well as the evidence-based investigations conducted by INTERPOL, the Australian Federal Police, and the U.S. Federal Bureau of Investigation. As a result, their statements are often rooted in rumour, conjecture, and political or personal agendas.
They have compromised national security by fostering a generation ignorant of facts—one that increasingly believes in fake news.
The psychological assessment of Podi Zahran
Having advised and assisted the Sri Lankan government to develop its program to rehabilitate the LTTE rank and file, immediately after the Easter Sunday massacre on April 21, 2019, the then President and the then Secretary Defence asked me what steps government should take. I requested the Ministry of Defence, Sri Lanka to develop a deradicalisation program to rehabilitate those radicalised and a community engagement program to prevent radicalisation. In addition to nominating Major General Dharshana Hettiarachchi as the Commissioner General of Rehabilitation, I arranged a team of psychologists to interview the detainees to ascertain their degree of exclusivism and extremism. The CID and CTID officers treated the detainees humanely and were supportive of developing a rehabilitation program. After I met with the then Senior DIG CID Ravi Seneviratne, he gave the rehabilitation team access to all the detainees including Podi Zahran. The psychological assessment of Podi Zahran conducted in 2019 is highly revealing. Although he was recommended for rehabilitation, he was never placed in a rehabilitation program. Sri Lanka’s deradicalization efforts were disrupted by organizations that filed Fundamental Rights (FR) cases opposing the rehabilitation of detainees. Meanwhile, successive governments have failed to effectively counter the conspiracy theories and false narratives surrounding the Easter Sunday attacks. As a result, both community-based and custodial radicalization continue to pose a serious threat to Sri Lanka’s future.
Perpetrator Profile:
Basic Info
* Male
* English-medium educated at a prominent school in Kandy, Sri Lanka.
* From a locality with limited access to religious teachers/preachers in English
* No previous criminal record (except current terrorism-related case)
*Uploaded Easter bombing video to Al Amaq (Islamic State media arm)
Detained for affiliation with Islamic State
Radicalisation Journey
* Started with genuine interest in religion
* Local gap in English-language religious teaching led him online (Initial spiritual curiosity – Wanted deeper religious knowledge in English; local vacuum of credible teachers created “demand‑side” vulnerability)
* Exposed to overseas Salafi-Wahhabi content (primarily video sermons) -Online ecosystems routinely evade content moderation and target anglophone teens.
* Adopted purist ideology, began rejecting local scholars and peers (Ideological shift & social isolation – Adopted exclusivist doctrines (takfir, al‑wala’ wal‑bara’). Began rejecting local clerics and non‑religious peers, a hallmark “break with former community” phase)
* Joined extremist chatrooms to “learn more” – led to direct recruitment by ISIS operatives
* Eventually pledged allegiance (bay’ah) and carried out tasks (digital, propaganda, etc.)
Mindset & Risk Indicators
* High ideological commitment
* Believes in the “one true version” of Islam
* Social isolation from mainstream peers
* Seeks validation and belonging through extremist channels
* Comfortable using encrypted apps and digital platforms
* May not have weapon access but is digitally capable and well-networked
Psychological Factors
* Searching for identity, belonging, purpose
* Literal and black-and-white thinker
* Likely feels frustration toward mainstream religious void
* No confirmed trauma history, but screening recommended
* Motivated, self-driven learner – but in the wrong direction
Risk Assessment (Simplified)
* Belief System: High Risk
* Social Environment: Medium-High Risk
* Capability: Medium Risk
* Commitment: High
* Protective Factors: Low to Moderate
Digital Activity
* Heavy YouTube/TikTok usage for preacher content
* Active in Telegram/Matrix-style chatrooms
* Possibly used gaming platforms (Discord etc.) to connect
* Familiar with encryption, privacy tools
Protective Factors
* Possibly cooperative family
* No overseas travel for combat
* Can speak English fluently – easier to reach through intervention
* Some education and tech skills that can be redirected positively
Recommended Next Steps
* Monitor online activity and device usage
* Assign local mentor or community leader fluent in English and religion
* Psychological assessment for identity or trauma issues
* Enrol in a deradicalisation program with clear milestones
* Offer structured education or job path linked to compliance
* Involve family in regular progress updates
* Delay or restrict international travel or online anonymity
Red Flags to Watch
* Contact with banned groups or individuals
* Attempts to travel without approval
* Sudden extremist content or martyrdom language online
* Acquiring materials or weapons
* Withdrawing from all social contact again
