The Sri Lankan government admitted that it failed to act on multiple warnings before a coordinated series of attacks ripped through churches and hotels on Easter Sunday, adding that an international terror group might be to blame.
A government spokesman, Rajitha Senaratne, revealed that warnings were received in the days before the attacks, which killed 290 people and injured at least 500 more, including from foreign intelligence services.
He said one of the warnings referred to National Tawheed Jamath, or NTJ, a little-known local Islamist group that has previously defaced Buddhist statues. But Senaratne, who is also health minister, said he did not believe a local group could have acted alone. "There must be a wider international network behind it," he said.
A US official directly familiar with the initial US intelligence assessment said the group responsible for the attacks was likely inspired by ISIS. No group has yet claimed responsibility.
The security situation remained fluid on Monday.
Police found 87 detonators in a private terminal of the main bus station in Sri Lanka's capital, Colombo, and a controlled explosion was carried out on a van near St. Anthony's church, one of three churches targeted in the attack. On Sunday evening, an improvised explosive device was defused near the capital's Bandaranaike International Airport.
A dusk-'til-dawn curfew was imposed for the second night in a row. Sri Lankan authorities declared a state of emergency from midnight Monday, and said Tuesday would be a national day of mourning.
Intelligence failures would be investigated, Senaratne said.
"We saw the warnings and we saw the details given," he told reporters. "We are very, very sorry, as a government we have to say -- we have to apologize to the families and the institutions about this incident." Families would be compensated and churches rebuilt, he said.
Police have arrested 24 people in connection with Sunday's attacks, the worst violence the South Asian island has seen since its bloody civil war ended 10 years ago. Six suicide bombers were involved, Sri Lanka military spokesman Sumith Atapattu said. Nine of the 24 suspects have been remanded until May 6 by a Colombo magistrate, state media reported.
Most of the dead and injured were Sri Lankan. At least 31 tourists were killed in the attacks, according to a statement released on Monday evening from Sri Lanka's Ministry of Foreign Affairs, which revised down the Sri Lankan tourism minister's previous estimate of 39 people.
Of the foreign nationals who died, eight were British, two of whom held dual US-UK nationality; as well as one Bangladeshi, two Chinese cousins, eight Indians, one person from France, one person from Japan, one from the Netherlands, one from Portugal, two Saudi Arabian nationals, one Spaniard and two Turkish nationals. Two Australian-Sri Lankan dual nationals were also killed in the attack. One nationality has yet to be determined, the statement said.
The blasts appears to have targeted tourism hotspots, as well as churches, in an effort to gain maximum global attention.
The attacks occurred in a period of political instability in Sri Lanka. In October, the Sri Lankan President attempted to depose the prime minister and replace him with a favored successor. That move backfired and Prime Minister Ranil Wickremesinghe was reinstated in December.
President Maithripala Sirisena was out of the country at the time of Sunday's attacks.
Wickremesinghe said warnings about a potential attack had not been shared with him or other government ministers. Sajith Premadasa, minister of housing construction and cultural affairs, said security officers were guilty of "negligence and incompetence."
Speaking to CNN's Christiane Amanpour on Monday, Sri Lankan Minister of Economic Reforms and Public Distribution Harsha de Silva said US and Indian intelligence agencies had warned the Sri Lankan government of imminent attacks.
De Silva said the Sri Lankan government "did receive information from overseas that something terrible was to happen" but "the prime minister was unaware" and "was kept in the dark."
The minister -- an ally of Wickremesinghe -- argued that "it wasn't a failure of the intelligence apparatus" but "a failure of implementing" an appropriate response.
It is unclear whether the details contained in the warning matched the atrocity that eventually took place on Sunday.
How it unfolded
The first wave of attacks struck during packed Easter Sunday services between 8:45 a.m. and 9:30 a.m. Suicide bombers struck three churches around the country: St. Antony's, a popular shrine in the capital, Colombo; St. Sebastian's in Negombo, north of the capital, where 102 people died; and the Zion Church, in the eastern port city of Batticaloa.
About the same time, more blasts ripped through three luxury hotels in Colombo: The Shangri-La, the Cinnamon Grand and the Kingsbury, all popular with foreign tourists and the country's business community. At the Shangri-La, the bomb was detonated just after 9 a.m at the Table One cafe as holidaymakers and guests were eating breakfast.
Later in the day, a blast rocked a hotel in front of the Dehiwala Zoo in Dehiwala-Mount Lavinia. The final blast struck a private house in Mahawila Gardens, in Dematagoda, during a raid in connection with the earlier attacks, officials said. Three police officers were killed.
It is not clear why Christians were targeted: Christianity is a minority religion in Sri Lanka, accounting for 7.4% of the total population of 21.4 million. According to census data, 70.2% of Sri Lankans identify as Buddhist, 12% Hindu and 9.7% Muslim.
In recent years, Sri Lanka has boomed as a holiday destination, welcoming 2.2 million visitors in 2017 compared to just over 1 million in 2012, providing tourists with an affordable alternative to tropical destinations such as the Maldives.
On Monday morning, however, the city's beachfront hotel district, where several of the bombs struck, was heavily guarded by soldiers carrying AK-47s and bomb-sniffing dogs were at closed hotel gates where guests were being checked in.
Rise of ISIS in Asia
Premadasa, the Sri Lankann health minister, called Sunday's attacks a "brand-new type of terrorism" that had rocked the nation. "We have not had any separatist movements in the past 10 years and this came as a shock to all of us," he said.
The civil war between the separatist Tamil Tigers and the Sri Lankan government ended in 2009, after claiming between 70,000 and 80,000 lives. Handling that conflict, Premadasa said, had prepared the government to deal with terrorism.
"During the 30-year terrorist war there were indiscriminate attacks on all institutions, they (the Tamil Tigers) did not spare any in their path towards a separatist state, but we were victorious in defeating terrorism," he added.
The targets of the attacks -- churches and hotels catering to foreigners -- have figured in previous bombings in Asia and beyond in recent years.
In January 2019, ISIS claimed responsibility for an attack that killed at least 20 in a church in the Philippines. The attack also took place on a Sunday, when worshippers were gathered for mass.
In May 2018, ISIS claimed responsibility for attacks at three churches in Indonesia, which killed at least 12 people and injured dozens more. On Palm Sunday in 2017, ISIS killed at least 49 people gathered for Mass at two churches in Egypt.
After the collapse of the ISIS caliphate in Iraq and Syria, as many as 5,600 foreign fighters have returned to their home countries since October 2017.