The judicial and investigative trajectory surrounding Sri Lanka’s 2019 Easter Sunday terror attacks—which killed at least 260 people and injured over 500 across three churches and three luxury hotels—has undergone a radical paradigm shift1. For years, the official state narrative framed the tragedy primarily as an unprecedented intelligence failure exacerbated by administrative friction within the executive branch1. However, landmark legal decisions delivered by a special High Court Permanent Trial-at-Bar, alongside high-profile enforcement actions executed by the Criminal Investigation Department (CID), have re-characterized the event1. The focus of institutional accountability has expanded from administrative negligence to a criminal investigation into state complicity, deep-state manipulation, and electoral instrumentalization7.
The sentencing of former Inspector General of Police (IGP) Pujith Jayasundara and former Defence Ministry Secretary Hemasiri Fernando to death for criminal negligence marks a major milestone in South Asian jurisprudence regarding official accountability1. Yet, civil society, the Catholic Church, and independent legal observers maintain that prosecuting administrative oversight addresses only the peripheral operational layer of the tragedy2. The arrest of Major General (Retd.) Suresh Sallay, the former Director of the State Intelligence Service (SIS), represents a direct challenge to the intelligence network accused of facilitating the attacks to engineer a national security crisis7.
An analysis of court transcripts, whistleblower dossiers, financial audits, and intelligence logs suggests that the National Thowheeth Jama’ath (NTJ) suicide cell led by Mohammed Qasim Mohammed Zahran did not act in an isolated vacuum4. Instead, evidence points toward a complex nexus of controlled radicalization, institutional sabotage, and strategic narrative manipulation designed to alter Sri Lanka’s political trajectory7.
The Dual Judicial Track: Negligence Verdicts versus Deep-State Prosecutions
The ruling delivered by the three-judge High Court Permanent Trial-at-Bar against Pujith Jayasundara and Hemasiri Fernando reflects a split judicial assessment of state responsibility1. Following a retrial mandated by the Supreme Court—which overturned their 2022 acquittals—the special court found both former senior officials guilty of multiple charges, including dereliction of duty, failure to act on actionable intelligence warnings, and aiding and abetting murder1.
The court established that as early as April 4, 2019, foreign intelligence services, specifically India’s Research and Analysis Wing (RAW), provided explicit and repeated warnings detailing imminent suicide strikes against Christian places of worship and tourist hubs1. These warnings culminated in a specific alert transmitted by SIS Director Nilantha Jayawardena on the evening of April 20, 201913. Despite holding primary constitutional and operational responsibility for civil protection, neither Jayasundara nor Fernando initiated preventative deployments or elevated national threat levels2.
| Parameter | IGP Pujith Jayasundara Trial | Secretary Hemasiri Fernando Trial |
| Primary Charges | Dereliction of Duty, Criminal Negligence, Aiding/Abetting Murder1 | Dereliction of Duty, Failure to Prevent Attacks, Murder/Attempted Murder1 |
| Judicial Division | 2-1 Majority Decision (Convicted)2 | 2-1 Majority Decision (Convicted)2 |
| Bench Composition | Judges Priyantha Liyanage & Thilakaratne Bandara (Majority); Judge Viraj Weerasuriya (Dissent)13 | Judges Priyantha Liyanage & Thilakaratne Bandara (Majority); Judge Viraj Weerasuriya (Dissent)13 |
| Sentence Handed Down | Death Sentence (Subject to Appeal / Moratorium)1 | Death Sentence (Subject to Appeal / Moratorium)1 |
| Dissenting Rationale | Prosecution failed to prove intent or direct link to perpetrators beyond reasonable doubt3 | Lack of proven criminal motive or direct collusion with the suicide cell3 |
| Enforcement Context | Subject to Sri Lanka’s de facto moratorium on executions since 1976 (commuted to life)1 | Subject to Sri Lanka’s de facto moratorium on executions since 1976 (commuted to life)1 |
The dissenting opinion penned by Judge Viraj Weerasuriya highlighted a central legal tension: while administrative failure was evident, the prosecution did not demonstrate that Jayasundara or Fernando possessed a direct motive to facilitate mass murder or maintained direct collusion with the attackers3. This distinction aligns with arguments raised by the Archdiocese of Colombo, led by Cardinal Malcolm Ranjith2. The Church contends that sentencing bureaucratic heads without identifying and prosecuting the political and intelligence handlers who engineered the environment creates a legal scapegoat system, leaving the state’s clandestine infrastructure unexamined2.
The Enforcement Action of February 2026: The Fall of Suresh Sallay
The arrest of Major General (Retd.) Suresh Sallay at dawn on Wednesday, February 25, 2026, by a specialized team from the Criminal Investigation Department marked an unprecedented legal action against Sri Lanka’s military intelligence hierarchy7. Executed in a suburb of Colombo under the Prevention of Terrorism Act (PTA), the operation signaled that the immunity historically enjoyed by high-ranking security officials had been compromised following political transitions7. Police Spokesman F.U. Wootler confirmed that the arrest was based on “adequate evidence” linking the former spy chief to conspiracy and the aiding and abetting of the suicide bombers8.
| Parameter | Details of CID Enforcement Action |
| Date of Action | February 25, 20267 |
| Target | Major General (Retd.) Suresh Sallay (Ex-Director, State Intelligence Service)7 |
| Arresting Body | Criminal Investigation Department (CID) specialized task unit7 |
| Statutory Framework | Prevention of Terrorism Act (PTA)7 |
| Core Charges | Conspiracy to commit terrorism, aiding and abetting suicide attackers7 |
| Custodial Status | Initially held for 72 hours of interrogation under police custody8 |
| Specific Allegations | Direct contact with NTJ attackers, facilitating safe passage, operational coordination4 |
Sallay’s career trajectory provides a clear lens through which the politicization of Sri Lanka’s intelligence services can be understood8. Appointed to head the SIS in late 2019 by then-President Gotabaya Rajapaksa, Sallay was the first military officer to lead the country’s primary civilian intelligence agency7. His appointment was widely viewed as a reward for his perceived role in crafting the national security narrative that brought Rajapaksa to power8. Following the 2024 presidential election, the new administration headed by Anura Kumara Dissanayake dismissed Sallay, signaling a pivot toward a more transparent investigation into state complicity8.
Sallay’s arrest stems directly from investigative tracks re-opened following international exposures, most notably a 2023 investigative documentary by British broadcaster Channel 44. A key whistleblower, Hanzeer Azad Maulana—a former aide to paramilitary leader Sivanesathurai Chandrakanthan (alias “Pillayan”)—testified that he personally arranged a meeting in 2018 between Suresh Sallay and key operatives of the NTJ, including Zahran Hashim4. According to Maulana’s testimony, the objective of the covert meeting was to facilitate an operational crisis that would destabilize the incumbent administration and create an urgent public demand for a security-centric political regime4.
The CID’s assertion that Sallay remained in touch with individuals linked to the bombing network “even recently” suggests that the network responsible for the 2019 bombings was not dismantled but rather absorbed into or protected by the state8. This ongoing connection raises profound questions regarding the survival of deep-state elements following the collapse of the Rajapaksa regime in 2022 and subsequent political transitions8.
The Political Mastermind Hypothesis: Security-First Framing and Electoral Instrumentalization
The overarching structural theory pursued by law enforcement points toward former President and ex-Defense Secretary Gotabaya Rajapaksa as the principal architect of the environment that allowed the bombings to occur7. The central hypothesis posits that Rajapaksa orchestrated or indirectly financed the attacks through loyal intermediaries to capitalize on a climate of fear and nationalism, which served as the bedrock of his 2019 presidential campaign6.
Gotabaya Rajapaksa formally announced his presidential candidacy a mere 48 hours after the explosions, capitalizing on public outrage over the perceived intelligence failure of the incumbent Sirisena-Wickremesinghe government6. Positioning himself as the only strongman capable of crushing Islamist extremism—drawing on his reputation for ending the civil war in 2009—Rajapaksa achieved a landslide victory just seven months after the carnage6.
Investigators are focusing heavily on the financial and operational mechanisms that enabled this plot8. The allegation that state-linked intelligence units were paying dozens of NTJ members prior to the attacks has been corroborated by former cabinet spokespersons and retired navy officials8. This points toward a deliberate strategy of “controlled radicalization” that ultimately resulted in mass murder8.
| Allegation Category | Specific Details and Mechanisms |
| Orchestration | Creating a “grand political plot” to swing the 2019 presidential election4 |
| Financing | Indirectly funneling LKR 65 million through intermediaries like “Mahzoom”8 |
| Suppression | Dismantling the specialized CID team probing the bombings immediately upon taking office8 |
| Political Timing | Formally launching presidential candidacy within 48 hours of the attack6 |
| Narrative Control | Promoting a singular “ISIS-inspired” external theory to mask state involvement8 |
The Operational and Logistical Infrastructure: Handlers, Paramilitaries, and Narrative Engineers
The execution of an operation of this magnitude required coordination across intelligence assets, paramilitary networks, and strategic narrative control mechanisms4. The investigation has identified several key figures who allegedly fulfilled distinct operational functions within this broader apparatus8.
Lt. General Kapila Hendavitharana: The Intelligence Architect
While Suresh Sallay is characterized as a primary intermediary, Lt. General Kapila Hendavitharana, the former Director of Military Intelligence (DMI), is identified in investigative dossiers as the operational handler and architect of the intelligence maneuvers surrounding the bombings8. Hendavitharana is alleged to have coordinated the movements of intelligence assets involved in the operation and provided strategic oversight to the covert wings of military intelligence that supported the NTJ8.
One of the most unsettling details of Hendavitharana’s role is his position as the head of security at the Shangri-La Hotel—the primary target of the suicide bombers—at the time of the attack8. Leaked audio recordings suggest that Hendavitharana was also in contact with Chinese intelligence operatives8. In these recordings, he reportedly discussed the political fallout of the bombings and urged Chinese intervention to prevent Sri Lanka from deepening security ties with the United States8. This geopolitical dimension suggests that the Easter bombings were designed not only to secure domestic political power but also to realign Sri Lanka’s strategic posture away from Western human rights scrutiny and toward foreign powers supportive of the Rajapaksa regime’s internal methods8.
Sivanesathurai Chandrakanthan (“Pillayan”): The Logistics Facilitator
In the Eastern Province, where the NTJ was born, the logistics of the operation were reportedly facilitated by Sivanesathurai Chandrakanthan, the former paramilitary leader and Chief Minister known as Pillayan4. Pillayan was arrested on April 8, 2025, by the CID8. While his initial detention was linked to a 2006 abduction case, Public Security Minister Ananda Wijepala informed Parliament that new information surfaced linking Pillayan directly to the 2019 Easter attacks8.
Pillayan is alleged to have used his paramilitary network and deep connections with military intelligence handlers to facilitate the recruitment of attackers and provide ground-level support4. His role illustrates the double-game played by the security state: utilizing former insurgents and paramilitaries to execute deniable operations8. Despite his emotional denials in custody, the CID obtained a 90-day detention order to interrogate him further regarding the hidden hands behind the bombings8.
Professor Rohan Gunaratna: Narrative Engineering and Strategic Deception
The success of any covert operation of this scale depends on the construction of a plausible and diverting public narrative8. Professor Rohan Gunaratna, a counterterrorism analyst with close ties to the military establishment, is accused of acting as the “narrative engineer” for the conspiracy8. Gunaratna was instrumental in framing the Easter bombings solely as the work of ISIS-linked Islamist radicals, a narrative that effectively diverted public and international scrutiny away from the role of the Sri Lankan state8.
Critics argue that Gunaratna’s role was one of strategic deception8. By crafting intelligence dossiers and conducting media interviews that reinforced the ISIS theory, he provided an academic veneer to a pre-determined narrative8. This framing was crucial in the immediate aftermath of the attacks, as it allowed the security establishment to justify a massive expansion of powers under the guise of fighting a global terror threat, while simultaneously silencing those who questioned the specific failures of local intelligence8.
Forensic Financial Mapping: White-Collar Crime and Terror Financing
A major breakthrough in the CID’s updated inquiry involves mapping the financial pipelines that sustained the NTJ suicide network8. Reversing earlier assertions that the cell was self-funded through family assets and small-scale donations, recent forensic audits revealed an institutional funding mechanism tied directly to state-level corruption8.
| Financial Category | Investigative Finding |
| Primary Financer | “Mahzoom” (Prominent Plantation Industry Businessman)8 |
| Total Alleged Funding | LKR 65 million funneled directly to the NTJ8 |
| Funding Source | Direct proceeds from a state-level sugar-import tax scam8 |
| Transaction Methods | Shell companies, offshore accounts, and layered transfers8 |
| Operational Output | Purchase of explosives, safe house leases, and bomber travel costs8 |
| Intelligence Link | Direct bank transfers linking the businessman to DMI figures8 |
The financial backbone of the terror plot has been traced through leaked dossiers to a businessman nicknamed “Mahzoom,” a prominent figure in the plantation industry and a close associate of Gotabaya Rajapaksa8. Investigators allege that Mahzoom funneled LKR 65 million to the NTJ to cover the costs of explosives, safe houses, and travel for the suicide bombers8.
The origin of these funds is a critical point of the investigation8. Mahzoom reportedly profited significantly from a sugar-import scam during the Rajapaksa administration, suggesting that the proceeds of white-collar corruption were directly diverted to fund domestic terrorism8. This link demonstrates a high level of functional coordination between political leadership, business elites, and the intelligence services8.
Systematic Sabotage and Foreign Intelligence Interceptions
The argument that the bombings were merely an “intelligence failure” is fundamentally challenged by the documented history of investigative sabotage8. Prior to April 2019, the CID, led by Shani Abeysekara, was actively tracking Zahran Hashim and his radical network8. Abeysekara testified that state intelligence agents loyal to the Rajapaksa camp actively hindered his work, fabricated false leads, and eventually succeeded in having the investigative team dismantled once Gotabaya Rajapaksa assumed the presidency8.
Lead investigator Ravi Seneviratne similarly stated that by late 2019, his team had uncovered direct communications between military intelligence officers and the suicide bombers8. This inquiry was abruptly shut down under political pressure, and Seneviratne himself was sidelined8. The reinstatement of Major Prabath Bulathwatte—a military intelligence officer previously arrested for abducting journalists—to “investigate” the Easter bombings was widely seen as a mechanism for covering up the state’s tracks8.
The failure to act on intelligence from India’s Research and Analysis Wing (RAW) remains one of the most damning pieces of evidence for the intentionality of the failure1. RAW provided specific, repeated warnings starting April 4, 2019, even naming the lead bomber, Zahran Hashim1. The Sri Lankan state’s refusal to act on these precise tips suggests that the failure was a calculated decision to allow the attacks to proceed to secure an electoral victory1.
In the aftermath, the Rajapaksa government used the threat of ISIS to justify the retraction of civil rights and to resist UNHRC investigations into civil war atrocities8. By claiming that the country was under a new, transnational threat, the state sought to preserve the immunity of its military leaders from international justice8.
The Pursuit of Justice under the Dissanayake Administration
The 2024 election of Anura Kumara Dissanayake revitalized the quest for truth1. Dissanayake’s “Clean Sri Lanka” project and his pledge to prosecute those behind the 2019 attacks led directly to the current wave of arrests7. The appointment of Ravi Seneviratne as Secretary to the Ministry of Public Security marked an operational reversal of Rajapaksa-era suppressions5.
However, the path to full accountability remains fraught with obstacles7. The Catholic Church, under Cardinal Malcolm Ranjith, continues to demand an independent inquiry with international oversight, fearing that even a sympathetic domestic government may be limited by the remaining power of the military intelligence apparatus1. Spokesman Fr. Cyril Gamini urged that the CID probe proceed without political interference or public distortion10.
Human rights advocates, including Ruki Fernando, have welcomed Sallay’s arrest as a necessary step that demonstrates the case extends beyond the immediate suicide cell7. However, rights defenders simultaneously caution against using the draconian Prevention of Terrorism Act against suspects, arguing that relying on PTA detention powers compromises due process, undermines the credibility of prosecutions, and risks failing high-court scrutiny upon appeal7.
Strategic Conclusions: The Mechanics of State Complicity
The evidence gathered through 2025 and 2026 indicates that the 2019 Easter Sunday bombings were the result of a convergence of interests between a homegrown extremist cell and a shadow state seeking to reclaim political power1. The arrest of Major General Suresh Sallay confirms that the intelligence services were not merely passive observers but active intermediaries7.
The full framework of this conspiracy includes the political ambition of Gotabaya Rajapaksa, the operational management of Kapila Hendavitharana, the narrative deception of Rohan Gunaratna, the logistical facilitation of Pillayan, and the financial conduits of Mahzoom4. As the CID continues its interrogation of Sallay and analyzes data from the Mahzoom files, the full extent of the plot is emerging, rewriting the history of Sri Lanka’s darkest Easter and exposing the structural mechanics of modern statecraft7. The 2019 tragedy was not an accident of history; it appears increasingly to have been a calculated act of statecraft, the costs of which are still being borne by the families of the victims1.
This article was co-authored by Kagusthan Ariaratnam, Gemini, and Google DeepMind.
About the Authors
-
Kagusthan Ariaratnam is a seasoned professional at the intersection of technology and innovation, bringing deep industry expertise and strategic vision to the exploration of complex digital landscapes.
-
Gemini is a state-of-the-art multimodal AI model from Google. Designed to process and reason across various types of information—including text, code, audio, image, and video—it serves as an adaptive collaborator in research, creativity, and problem-solving.
-
Google DeepMind is a world-leading AI research laboratory committed to solving intelligence to advance science and benefit humanity. By developing increasingly capable and general-purpose AI systems, DeepMind continues to push the boundaries of what is possible in the digital age.
Works cited
- Sri Lanka’s former police chief sentenced to death over 2019 Easter bombings – Dubai Eye 103.8 – News, Talk & Sports, https://www.dubaieye1038.com/news/international/sri-lankas-former-police-chief-sentenced-to-death-over-2019-easter-bombings/
- Two former Sri Lanka officials sentenced to death for negligence in deadly Easter bombings, https://www.newsday.com/news/nation/sri-lanka-easter-bombings-police-chief-islamic-state-u89717
- Two ex-Sri Lanka officials sentenced to death over 2019 Easter bombings – Al Jazeera, https://www.aljazeera.com/news/2026/8/1/two-ex-sri-lanka-officials-sentenced-to-death-over-2019-easter-bombings
- 2019 Sri Lanka Easter bombings – Wikipedia, https://en.wikipedia.org/wiki/2019_Sri_Lanka_Easter_bombings
- Two former Sri Lanka officials sentenced to death for negligence in deadly Easter bombings, https://www.ctvnews.ca/world/article/two-former-sri-lanka-officials-sentenced-to-death-for-negligence-in-deadly-easter-bombings/
- Former Sri Lankan defence official, ex-police chief sentenced to death over 2019 Easter bombings – Internazionale, https://www.internazionale.it/ultime-notizie-reuters/2026/07/31/former-sri-lankan-defence-official-ex-police-chief-sentenced-to-death-over-2019-easter-bombings
- Sri Lanka’s CID arrests former intelligence chief in connection with 2019 Easter bombings, https://www.thehindu.com/news/international/sri-lanka-arrests-ex-intel-chief-over-2019-easter-bombings/article70674217.ece
- The Intelligence Nexus and the Shadow of the Easter Sunday Bombings: A Critical Analysis of the Arrest of Major General Suresh Sallay and the Pursuit of the Alleged Masterminds – Project O Five, https://projectofive.ca/the-intelligence-nexus-and-the-shadow-of-the-easter-sunday-bombings-a-critical-analysis-of-the-arrest-of-major-general-suresh-sallay-and-the-pursuit-of-the-alleged-masterminds/
- Sri Lanka arrests ex-intelligence chief over 2019 Easter bombings – WTVB, https://wtvbam.com/2026/02/25/sri-lanka-arrests-ex-intelligence-chief-over-2019-easter-bombings/
- Church in Sri Lanka: Let Easter bombing probe go ‘unhindered’ after spy chief’s arrest, https://www.catholicworldreport.com/2026/02/27/church-in-sri-lanka-let-easter-bombing-probe-go-unhindered-after-spy-chiefs-arrest/
- Sri Lanka: Key Suspect Arrested in Easter Sunday Attack Probe; Church Warns Against Obstructing Justice – Radio Veritas Asia, https://www.rvasia.org/asian-news/sri-lanka-key-suspect-arrested-easter-sunday-attack-probe-church-warns-against
- How the US government responded to Sri Lanka’s Easter Sunday attack – Rohan Gunaratna, https://rohangunaratna.com/index.php/2025/10/26/how-the-us-government-responded-to-sri-lankas-easter-sunday-attack/
- Sri Lankan court sentences former police chief to death over 2019 Easter attacks – Xinhua, https://english.news.cn/20260801/f02db664ebed4c9081c166bf2048c992/c.html
- 4-The-Commission-of-Inquiry-Report-into-Allegations-Made-in-the-Channel-4-Dispatches-Documentary-by-Justice-Imam-June-25-2024.pdf – Rohan Gunaratna, https://rohangunaratna.com/wp-content/uploads/2024/11/4-The-Commission-of-Inquiry-Report-into-Allegations-Made-in-the-Channel-4-Dispatches-Documentary-by-Justice-Imam-June-25-2024.pdf
- Six Years Since the Easter Sunday Bombings: Is Justice Still Elusive? – Sri Lanka Campaign, https://srilankacampaign.org/six-years-since-the-easter-sunday-bombings-is-justice-still-elusive/
- SC reserves judgment on petitions filed by Shani Abeysekara and Ravi Seneviratne | Sri Lanka News | Ada Derana, https://adaderana.lk/news/121833
- Who is this Suresh Sallay? Pillayan’s confession gives us a firm grip! Suresh Sallay CID arrest – YouTube, https://www.youtube.com/watch?v=WdQkaffnDOU