Sri Lankan authorities were told by foreign security agencies more than four months ago that a network of violent Islamic extremists was active in the country and likely to commit terrorist attacks, regional and western officials have said.
The revelation that officials may have known last year about the threat posed by those responsible for the Easter Sunday bombings that killed more than 350 people will fuel outrage at what now appears to be multiple and systematic intelligence failings.
On Wednesday, President Maithripala Sirisena demanded the resignation of senior officials who failed to pass on three separate formal warnings sent by Indian agencies in the three weeks before the attack.
The sources said these formal warnings followed months of informal conversations between Indian investigators and their Sri Lankan counterparts in which details of the network, including the identities of its leader and members, were passed on.
Sirisena has already called for a massive security overhaul after the failure to prevent one of the most deadly terrorist attacks of recent years.
Sarath Fonseka, a Sri Lankan field marshall and politician, told parliament the attack appeared to have been “seven or eight months in the making” and exposed a “monumental lapse in intelligence gathering”.
“In any other country, the entire government would have had to resign for making a mess of things like this, but it won’t happen here,” he said. “Security has become a joke.”
The Indian information was gathered from a huge haul of data seized during raids on suspected Islamic State sympathisers in November, as well as their subsequent interrogation.
Large number of phones, discs and USB keys collected in the raids revealed links between detainees and Mohammed Zahran Hashim, the suspected leader of the Sri Lankan terrorist network responsible for the bombings, security officials told the Guardian.
A surveillance operation then revealed the radical cleric, who was already known to Sri Lankan security services, repeatedly contacted known Isis activists in Bangladesh. According to some reports, Hashim was also in touch with militants in eastern Afghanistan linked to Isis.
Isis has claimed responsibility for the bombings, believed to be the most lethal ever conducted by the group.
Indian officials increased their informal warnings to the Sri Lankans after explosives were found on a remote farm at a national park in north-west Sri Lanka. Hashimi’s network was linked to the cache. They were not aware at that time of any plot to target churches or hotels, the sources said.
It is not clear why Delhi waited until April to issue a formal communication about the threat.
On Wednesday, the death toll from the attacks on three churches and three luxury hotels in and around the capital, Colombo, rose to 359, with 500 injured.
Despite the scale of the ongoing security operation, Sri Lanka’s prime minister, Ranil Wickremesinghe, said several suspects armed with explosives had yet to be found.
He said there were more explosives and militants “out there”, and confirmed reports there had been a failed attack against a fourth major hotel, and that the Indian embassy was also a possible target.
One of the suspects was identified on Wednesday as Abdul Lathief Jameel Mohamed, after Sri Lanka’s defence minister said a suspect had studied in the UK and Australia. British counter-terrorism investigators said they believed Mohamed attended a university in south-east England from 2006-07, and they were searching for any associates or signs of extremist activity during his time in the UK.
Eighteen suspects were arrested overnight, bringing the total number detained to more than 60.
Up to nine people directly linked to the attack could still be at large, sources involved in the investigation said. Officials said authorities expected to make further arrests in the coming days.
The exact role of Isis in the attacks is yet to be established. It is possible the group’s involvement reorientated Hashim’s network away from bombs directed at destroying major Buddhist monuments and towards targets more closely associated with its global jihadist ideology.
Hashimi could be seen in a video released by Isis on Tuesday after it claimed responsibility. Dressed in a black tunic and headscarf and carrying a rifle, the cleric is seen leading a group of men, said to be Sunday’s attackers, in a pledge of allegiance to the leader of Isis, Abu Bakr al-Baghdadi.
Western and south Asian officials said Hashmi had started a group of extremists in a small village in eastern Sri Lanka, attracting disaffected young men. The middle-aged cleric travelled overseas about two years ago, possibly to the Maldives, which has become a hub of Islamist activism in recent years. Security agencies followed Hashim’s online extremist activism closely and were concerned he could develop links to either al-Qaida or Isis.
Islamic State’s Amaq news agency also published a statement saying its “fighters” were responsible and listed the names of the suicide bombers.
The funerals of those killed in the blasts continued in Negombo and Colombo on Wednesday, as a social media ban and state of emergency remained in place across the country.
