The Intelligence Nexus and the Shadow of the Easter Sunday Bombings: A Critical Analysis of the Arrest of Major General Suresh Sallay and the Pursuit of the Alleged Masterminds

The apprehension of Major General Suresh Sallay on February 25, 2026, represents a seismic shift in the long-deferred quest for accountability regarding the 2019 Easter Sunday bombings. As the former Director of the State Intelligence Service (SIS), Sallay is the highest-ranking military intelligence official to be taken into custody in connection with the coordinated suicide attacks that devastated Sri Lanka’s social and political fabric.¹ While the arrest is being hailed by victims’ advocates and the Catholic Church as a “major breakthrough,” it simultaneously serves as an indictment of the deep-seated state structures that allegedly facilitated the tragedy.¹ The prevailing consensus among investigators and civil society is that Sallay’s arrest, though significant, is merely the tip of a vast iceberg.¹ Behind him lies a complex hierarchy of political masterminds, intelligence architects, and narrative engineers who remain either at large or shielded by the remnants of a powerful security state.¹

The legal proceedings initiated under the administration of President Anura Kumara Dissanayake suggest that the 2019 attacks were not merely a failure of intelligence sharing, as previously claimed by successive regimes, but rather an “intelligence operation” designed to achieve specific political outcomes.¹ The arrest of Sallay under the Prevention of Terrorism Act (PTA) underscores the gravity of the allegations, which link the upper echelons of the Sri Lankan security apparatus to the very extremists they were tasked with monitoring.³

The Enforcement Action of February 2026: The Fall of Suresh Sallay

Major General (Retired) Suresh Sallay was arrested at dawn on Wednesday, February 25, 2026, in a suburb of Colombo by a specialized team from the Criminal Investigation Department (CID).³ Police Spokesman F.U. Wootler confirmed that the arrest was based on “adequate evidence” linking the former spy chief to conspiracy and the aiding and abetting of the suicide bombers who struck churches and luxury hotels in 2019.¹ This development follows years of accusations, most notably the 2023 documentary by British broadcaster Channel 4, which featured whistleblower testimony alleging that Sallay had met with the bombers prior to the attacks to facilitate a “grand political plot”.³

Sallay’s career trajectory provides a lens through which the politicization of Sri Lanka’s intelligence services can be understood. Appointed to head the SIS in late 2019 by then-President Gotabaya Rajapaksa, Sallay was the first military officer to lead the country’s primary civilian intelligence agency.¹ His appointment was widely viewed as a reward for his perceived role in the security narrative that brought Rajapaksa to power.³ Following the 2024 presidential election, the new Dissanayake administration dismissed Sallay, signaling a pivot toward a more transparent investigation into state complicity.⁴

Summary of Legal Proceedings against Suresh Sallay (February 2026)

The CID’s assertion that Sallay remained in touch with individuals linked to the attacks “even recently” suggests that the network responsible for the 2019 bombings was not dismantled but rather absorbed into or protected by the state.³ This ongoing connection raises profound questions about the survival of deep-state elements after the collapse of the Rajapaksa regime in 2022 and the subsequent political transitions.¹

The Political Mastermind: Gotabaya Rajapaksa and the Security-First Narrative

The most prominent figure in the alleged conspiracy is Gotabaya Rajapaksa, the former President and ex-Defense Secretary. Whistleblower evidence and leaked intelligence files increasingly point to Rajapaksa as the principal architect of the environment that allowed the bombings to occur.¹ The central hypothesis of the current investigation is that Rajapaksa orchestrated or indirectly financed the attacks through loyal intermediaries to capitalize on a climate of fear and nationalism, which served as the bedrock of his 2019 presidential campaign.¹

Rajapaksa’s campaign was launched a mere two days after the bombings, capitalizing on public outrage over the perceived “intelligence failure” of the incumbent Sirisena-Wickremesinghe government.³ By positioning himself as the only strongman capable of crushing Islamist extremism—drawing on his reputation for ending the civil war in 2009—Rajapaksa achieved a landslide victory just seven months after the carnage.³

Investigators are now focusing on the “Mahzoom” funding trail, which allegedly links Rajapaksa’s close associates to the logistical financing of the National Thowheeth Jama’ath (NTJ).¹ The allegation that state-linked intelligence units were paying dozens of NTJ members prior to the attacks has been corroborated by former cabinet spokespersons and even retired navy officials.¹ This suggests a deliberate strategy of “controlled radicalization” that ultimately resulted in mass murder.¹

The Core Allegations against Gotabaya Rajapaksa

The Intelligence Architect: Lt. General Kapila Hendavitharana

While Sallay is described as an intermediary, Lt. General Kapila Hendavitharana, the former Director of Military Intelligence (DMI), is identified as the operational handler and architect of the intelligence maneuvers surrounding the bombings.¹ Hendavitharana is alleged to have coordinated the movements of intelligence assets involved in the operation and provided strategic oversight to the covert wings of military intelligence that supported the NTJ.¹

One of the most unsettling details of Hendavitharana’s role is his position as the head of security at the Shangri-La Hotel—the primary target of the suicide bombers—at the time of the attack.¹ Leaked audio recordings suggest that Hendavitharana was also in contact with Chinese intelligence operatives.¹ In these recordings, he reportedly discussed the political fallout of the bombings and urged Chinese intervention to prevent Sri Lanka from deepening security ties with the United States.¹

This geopolitical dimension suggests that the Easter bombings were not only about domestic power but also about realigning Sri Lanka’s strategic posture.¹ By creating a national security crisis that necessitated a “strongman” response, the architects sought to move the country away from Western human rights scrutiny and toward the orbit of powers like China, which were seen as more supportive of the Rajapaksa regime’s internal methods.¹

The Narrative Engineer: Professor Rohan Gunaratna and Strategic Deception

The success of any covert operation of this scale depends on the construction of a plausible and diverting narrative. Professor Rohan Gunaratna, a well-known counterterrorism analyst with close ties to the military establishment, is accused of acting as the “narrative engineer” for the conspiracy.¹ Gunaratna was instrumental in framing the Easter bombings solely as the work of ISIS-linked Islamist radicals, a narrative that effectively diverted public and international scrutiny away from the role of the Sri Lankan state.¹

Critics argue that Gunaratna’s role was one of “strategic deception”.¹ By crafting intelligence dossiers and conducting countless media interviews that reinforced the ISIS theory, he provided an academic veneer to a pre-determined narrative.¹ This framing was crucial in the immediate aftermath of the attacks, as it allowed the security establishment to justify a massive expansion of powers under the guise of fighting a global terror threat, while simultaneously silencing those who questioned the specific failures of local intelligence.¹

The Logistics Facilitator: Sivanesathurai Chandrakanthan alias “Pillayan”

In the Eastern Province, where the NTJ was born, the logistics of the operation were reportedly facilitated by Sivanesathurai Chandrakanthan, the former paramilitary leader and Chief Minister known as Pillayan.¹ Pillayan was arrested on April 8, 2025, by the CID.¹¹ While his initial detention was linked to a 2006 abduction case, the current Public Security Minister, Ananda Wijepala, has informed Parliament that new information has surfaced linking Pillayan directly to the 2019 Easter attacks.¹³

Pillayan is alleged to have used his paramilitary network and his deep connections with military intelligence handlers to facilitate the recruitment of attackers and provide ground-level support.¹ His role illustrates the “double-game” played by the security state: utilizing former insurgents and paramilitaries to execute deniable operations.¹ Despite his emotional denials in custody, the CID has obtained a 90-day detention order to interrogate him further regarding the “hidden hands” behind the bombings.¹³

The Money Trail: “Mahzoom” and the Sugar Scam

The financial backbone of the terror plot has been traced through leaked dossiers to a businessman nicknamed “Mahzoom,” a prominent figure in the plantation industry and a close associate of Gotabaya Rajapaksa.¹ Investigators allege that Mahzoom funneled LKR 65 million to the NTJ to cover the costs of explosives, safe houses, and travel for the suicide bombers.¹

The origin of these funds is a critical point of the investigation. Mahzoom reportedly profited significantly from a sugar-import scam during the Rajapaksa administration, suggesting that the proceeds of state-level corruption were directly diverted to fund the 2019 bombings.¹ This link between white-collar crime and domestic terrorism suggests a high level of coordination between the political leadership, the business elite, and the intelligence services.¹

Financial Data Cluster: The “Mahzoom” Dossier

The Systematic Sabotage of Investigations (2019–2022)

The argument that the bombings were an “intelligence failure” is fundamentally challenged by the documented history of investigative sabotage. Prior to April 2019, the CID, led by Shani Abeysekara, was actively tracking Zahran Hashim and his network.¹ Abeysekara has since testified that state intelligence agents—loyal to the Rajapaksa camp—actively hindered his work, fabricated false leads, and eventually succeeded in having the investigative team dismantled once Gotabaya Rajapaksa assumed the presidency.¹

Lead investigator Ravi Seneviratne similarly stated that by late 2019, his team had uncovered direct communications between military intelligence officers and the suicide bombers.¹ This inquiry was abruptly shut down under political pressure, and Seneviratne himself was sidelined.¹ The reinstatement of Major Prabath Bulathwatte—a military intelligence officer previously arrested for abducting journalists—to “investigate” the Easter bombings was widely seen as a mechanism for covering up the state’s tracks.¹

International Dimensions: The RAW Warnings and Geopolitical Games

The failure to act on intelligence from India’s Research and Analysis Wing (RAW) remains one of the most damning pieces of evidence for the “intentionality” of the failure. RAW provided specific, repeated warnings starting April 4, 2019, even naming the lead bomber, Zahran Hashim.¹ The Sri Lankan state’s refusal to act on these precise tips, combined with the “Reichstag Fire” theory, suggests that the failure was a calculated decision to allow the attacks to proceed to secure an electoral victory.¹

The geopolitical fallout of the attacks also saw a shift in Sri Lanka’s international relations. In the aftermath, the Rajapaksa government used the threat of ISIS to justify the retraction of civil rights and to resist UNHRC investigations into war crimes committed during the civil war.¹ By claiming that the country was under a new, transnational threat, the state sought to preserve the “immunity” of its military leaders from international justice.¹

The Pursuit of Justice under the Dissanayake Administration

The 2024 election of Anura Kumara Dissanayake has revitalized the quest for truth. Dissanayake’s “Clean Sri Lanka” project and his pledge to prosecute those behind the 2019 attacks have led to the current wave of arrests.¹⁶ The appointment of Ravi Seneviratne as Secretary to the Ministry of Public Security marks a symbolic and operational reversal of the Rajapaksa-era suppressions.⁹

However, the path to full accountability remains fraught with obstacles. The Catholic Church, under Cardinal Malcolm Ranjith, continues to demand an independent inquiry with international oversight, fearing that even a sympathetic domestic government may be limited by the remaining power of the military intelligence apparatus.¹ The 2026 arrest of Suresh Sallay is a massive step, but for the victims, justice will only be served when the political and financial masterminds who funded and engineered the tragedy are also brought to trial.¹

Final Assessment: The Mechanics of State Complicity

The evidence gathered through 2025 and 2026 indicates that the 2019 Easter Sunday bombings were the result of a convergence of interests between a homegrown extremist cell and a shadow state seeking to reclaim political power.¹ The arrest of Major General Suresh Sallay confirms that the intelligence services were not merely passive observers but active intermediaries.¹

The “iceberg” of this conspiracy includes the political ambition of Gotabaya Rajapaksa, the operational ruthlessness of Kapila Hendavitharana, the narrative deception of Rohan Gunaratna, and the logistical facilitation of Pillayan.¹ As the CID continues its interrogation of Sallay and the data from the “Mahzoom” files, the full extent of the “grand political plot” is likely to emerge, potentially rewriting the history of Sri Lanka’s darkest Easter and the nature of its modern governance. The 2019 tragedy was not an accident of history; it appears increasingly to have been a calculated act of statecraft, the costs of which are still being borne by the families of the 279 victims.¹

Author’s Note:

This article was co-authored by Kagusthan Ariaratnam and Google Gemini and Google DeepMind incorporating investigative data and whistleblower testimonies to examine the arrest of Major General Suresh Sallay and the broader conspiracy surrounding the 2019 Easter Sunday bombings. We acknowledge the dedicated efforts of legal advocates and investigative journalists whose pursuit of transparency has been vital in uncovering the complexities of state complicity in these events.

Works cited

1. Special Report_ Sri Lanka’s Easter Sunday Bombings – An Intelligence Failure_ Or an Intelligence Operation_ – NAOC https://natoassociation.ca/special-report-sri-lankas-easter-sunday-bombings-an-intelligence-failure-or-an-intelligence-operation
2. Sri Lanka arrests ex-intel chief over 2019 Easter bombings – The …, accessed on February 25, 2026, https://www.thehindu.com/news/international/sri-lanka-arrests-ex-intel-chief-over-2019-easter-bombings/article70674217.ece
3. Sri Lanka arrests ex-spy chief over 2019 Easter bombings – IndoPremier, accessed on February 25, 2026, https://www.indopremier.com/ipotnews/newsDetail.php?jdl=Sri_Lanka_arrests_ex_spy_chief_over_2019_Easter_bombings&news_id=1721876&group_news=ALLNEWS&taging_subtype=SRILANKA&name=&search=y_general&q=SRI%20LANKA,%20&halaman=1
4. Six Years Since the Easter Sunday Bombings: Is Justice Still Elusive …, accessed on February 25, 2026, https://srilankacampaign.org/six-years-since-the-easter-sunday-bombings-is-justice-still-elusive/
5. Sri Lanka arrests former intelligence chief in Easter Sunday attack …, accessed on February 25, 2026, https://english.news.cn/20260225/a5076cc48a4d472b85358656ef9083ea/c.html
6. Sri Lanka’s former intelligence chief arrested over 2019 Easter …, accessed on February 25, 2026, https://www.aninews.in/news/world/asia/sri-lankas-former-intelligence-chief-arrested-over-2019-easter-sunday-attacks20260225144335
7. Sri Lanka ex-president Sirisena ordered to compensate 2019 Easter bombing victims, accessed on February 25, 2026, https://www.theguardian.com/world/2023/jan/12/sri-lanka-ex-president-sirisena-compensate-2019-easter-bombing
8. Sri Lanka arrests ex-spy chief over 2019 Easter bombings – Indo Premier Sekuritas, accessed on February 25, 2026, https://www.indopremier.com/ipotnews/newsDetail.php?jdl=Sri_Lanka_arrests_ex_spy_chief_over_2019_Easter_bombings&news_id=1721864&group_news=ALLNEWS&taging_subtype=SRILANKA&name=&search=y_general&q=SRI%20LANKA,%20&halaman=1
9. Anura Kumara Dissanayake – Wikipedia, accessed on February 25, 2026, https://en.wikipedia.org/wiki/Anura_Kumara_Dissanayake
10. After Sri Lanka’s Easter Bombings: Reducing Risks of Future Violence, accessed on February 25, 2026, https://www.crisisgroup.org/rpt/asia-pacific/sri-lanka/302-after-sri-lankas-easter-bombings-reducing-risks-future-violence
11. 2025 in Sri Lanka – Wikipedia, accessed on February 25, 2026, https://en.wikipedia.org/wiki/2025_in_Sri_Lanka
12. Pillayan arrested over ‘abduction and disappearance’ says Sri Lankan police, accessed on February 25, 2026, https://www.tamilguardian.com/content/pillayan-arrested-abduction-and-disappearance-says-sri-lankan-police
13. Pillayan to Be Detained and Interrogated For 90 Days – Newsfirst.lk, accessed on February 25, 2026, https://newsfirst.lk/2025/04/12/pillayan-to-be-detained-and-interrogated-for-90-days
14. Sri Lanka’s Christian community awaits President Dissanayake’s disclosure on 2019 Easter attacks – The Week, accessed on February 25, 2026, https://www.theweek.in/wire-updates/international/2025/04/19/fgn68-lanka-easter-attacks-catholics.html
15. Ranil’s attempt to reach detained Pillayan blocked, as paramilitary leader cries in jail, accessed on February 25, 2026, https://www.tamilguardian.com/content/ranils-attempt-reach-detained-pillayan-blocked-paramilitary-leader-cries-jail
16. A/HRC/60/21 Advance unedited version – ohchr, accessed on February 25, 2026, https://www.ohchr.org/sites/default/files/documents/hrbodies/hrcouncil/sessions-regular/session60/advance-version/a-hrc-60-21-auv.pdf
17. A/HRC/60/21 Advance edited version – ohchr, accessed on February 25, 2026, https://www.ohchr.org/sites/default/files/documents/hrbodies/hrcouncil/sessions-regular/session60/advance-version/a-hrc-60-21-aev.pdf