Easter Sunday Debacle: Not by Default, But by Design - The Damning 3-P Nexus

The hotels further amplified Vital and Destructible dimensions, striking at Sri Lanka’s fragile economic recovery and international image

The EVIL DONE framework, developed by criminologists Ronald V. Clarke and Graeme R. Newman (2006), lays bare how the attackers rationally exploited Sri Lanka’s vulnerabilities with devastating precision

Seven years after the horrific Easter Sunday attacks of 21 April 2019, which slaughtered over 270 innocent people and maimed hundreds more, Sri Lanka continues to be haunted by a tragedy that was as much a failure of governance as it was an act of terror. This was no mere “debacle” born of incompetence. The evidence points to a calculated convergence of a toxic 3-P Nexus of Politics, Planners, and Perpetrators that enabled the massacre.

Successive governments have shamelessly exploited this national wound for electoral gain while selectively wielding draconian laws like the Prevention of Terrorism Act (PTA) and Emergency Regulations when in power, only to cry foul when out of office. Enough is enough. It is time to call out this hypocrisy with unflinching honesty,  and demand accountability through independent, uncompromising action.

The EVIL DONE framework, developed by criminologists Ronald V. Clarke and Graeme R. Newman (2006), lays bare how the attackers rationally exploited Sri Lanka’s vulnerabilities with devastating precision. Local National Thowheed Jama’ath (NTJ) extremists, inspired and linked to ISIS, achieved near-perfect scores across the criteria. Churches on Easter Sunday scored maximum on Iconic and Legitimate framed as justifiable targets amid a climate of Islamophobia and communal tension deliberately or negligently stoked by political rhetoric. 

Occupied was ruthlessly optimised: peak services guaranteed maximum civilian slaughter and global headlines. Exposed and Easy were glaring failures open access, predictable routines, and woefully inadequate security at places of worship and luxury hotels turned them into soft targets. The hotels further amplified Vital and Destructible dimensions, striking at Sri Lanka’s fragile economic recovery and international image. Near was satisfied by local bases in the East and West. This was not random violence; it was a textbook rational choice operation enabled by systemic negligence.

These vulnerabilities demanded immediate application of Situational Crime Prevention (SCP) techniques, a proven, opportunity-reduction approach pioneered by Ronald V. Clarke. SCP organises 25 practical techniques into five categories that directly address EVIL DONE weaknesses. In the Sri Lankan context, the absence of these measures was criminal.

Increase the Effort: Target hardening and access control were virtually non-existent. Reinforced entrances at churches, vehicle barriers and baggage screening at hotels (as successfully implemented for CHOGM 2013 and cricket World Cups), and restrictions on facilitators like explosive precursors could have raised the bar significantly.

 Increase the Risks: Enhanced guardianship and surveillance were critically lacking. Integrated CCTV networks with real-time monitoring, community watch programmes at places of worship (leveraging interfaith networks like the Wakfs Board), and strengthened formal surveillance through better inter-agency coordination would have acted on the multiple prior warnings that were tragically ignored.

 Reduce the Rewards: Protocols to limit media amplification and deny terrorists the oxygen of publicity were absent, allowing maximum propaganda impact. Rapid, coordinated official communication strategies could have blunted this.

 Reduce Provocations: Sustained community engagement and counter-narratives against hate speech and Islamophobic rhetoric — areas where political inaction created fertile ground for recruitment — were neglected. Interfaith harmony initiatives could have neutralised peer pressure and emotional triggers.

 Remove Excuses: Clear public messaging, codes of conduct at religious sites, and robust deradicalisation efforts were insufficient, allowing jihadi justifications to flourish unchecked.

Had these SCP techniques been institutionalised alongside EVIL DONE risk registers, the high-scoring targets could have been prioritised and protected. Instead, political infighting between President Sirisena and Prime Minister Wickremesinghe paralysed intelligence, exposing the lethal cost of a politicised security apparatus.

The 3-P Nexus reveals the true horror. 

Perpetrators -Zahran Hashim and his NTJ suicide bombers were radicalised through imported ISIS ideology spread via social media. Recruitment thrived in a fertile ground of post-war Muslim grievances, amplified by an Islamophobic environment that planners and politicians either created or cynically exploited. Many attackers were volunteers steeped in jihadi “kill and die” indoctrination, though questions of manipulation, family involvement (notably the wealthy Ibrahim family), and training persist. Their targets blended religious hatred against the Catholic community with economic sabotage at hotels,  a dual strike designed for maximum division and propaganda value. ISIS claimed responsibility, confirming the international ideological link.

Planners operated with chilling effectiveness. Zahran was the operational mastermind, but deeper facilitation allegations including the 2026 arrest of retired Major General Suresh Sallay under the PTA  point to possible domestic enablers with access to intelligence and resources. Expert guidance likely came through online channels and foreign contacts. The operation relied on disguise, diversion, and exploitation of known intelligence silos rather than complete surprise. The nexus between planners and perpetrators involved ideological brainwashing, logistical support, and operational coordination. Why such commitment? Capabilities honed through local knowledge and external inspiration made success tragically feasible.

Politics bears the heaviest responsibility. Political rivalries deliberately or recklessly paralysed intelligence coordination. The primary beneficiaries were opposition forces who rode the wave of public anger to electoral victory in 2019. The victims were the slaughtered innocents, the broader Muslim community subjected to backlash and scapegoating, national unity, and institutional credibility. Post-attack, contradictory political narratives and selective law enforcement have turned justice into a partisan football. While the Catholic clergy, led by Cardinal Malcolm Ranjith, has spoken with consistent moral clarity demanding truth and independent investigation, political parties continue their shameless games. The recruitment process exposes the cynicism. ISIS ideology was imported and localised through social media and local preachers. The ground situation marginalisation, real and manufactured Islamophobia was ripe for exploitation. Whether created by politicians, planners, or both, this environment provided the perfect cover for radicalisation. The “why hotels and Catholic celebrations?” The question has a damning answer: to maximise human suffering, economic damage, and communal division. It was never purely one or the other; it was a calculated hybrid strike.

Seven years on, many dots remain unconnected. Support networks, training attendees, and potential higher-level facilitators are yet to be fully exposed. Ongoing investigations into figures like Sallay have triggered predictable “hue and cry,” raising legitimate questions about CID leadership and politicisation. This cannot continue. Sri Lanka’s national security demands depoliticised, professional institutions that apply EVIL DONE and SCP rigorously in risk registers for soft targets, major event security, cyber defence, narcotics-terror nexuses, and community resilience programmes.

The Easter Sunday attacks changed governments and opened eyes internationally, yet domestic justice remains elusive. Perpetrators are mostly dead, but the planners and political enablers who allowed this to happen must face scrutiny. It is the solemn, non-negotiable duty of the state, whoever holds power,   to establish a fully independent, time-bound special investigation mechanism with credible international oversight if necessary. Half-measures and performative arrests only deepen cynicism.

Sri Lanka defeated the LTTE through determination and intelligence-led strategy. We cannot allow Easter Sunday to become a permanent scar of politicised failure. The time for excuses is over. Policymakers must institutionalise EVIL DONE and SCP across the security architecture, depoliticise intelligence, and embrace whole-of-society prevention rooted in interfaith harmony and ICCPR-compliant practices. Anything less is a betrayal of the victims and an open invitation to future atrocities. The victims, their families, and the nation demand more than rhetoric. They demand justice, reform, and leadership with backbone. Sri Lanka must choose brains over power, principle over populism, and proactive resilience over perpetual exploitation. Only then can we declare with conviction Never Again not as a slogan, but as unyielding national doctrine.

This column reflects personal views drawn from decades of public service. It is a firm call for mature, inclusive, and decisive nation-building.

Mahil Dole, SSP (Retired), is the former Head of the Counter-Terrorism Division of the State Intelligence Service of Sri Lanka, and has served as Head of the Sri Lankan Delegation at three BIMSTEC Security Conferences. With over 40 years of experience in policing and intelligence, he writes on regional security, interfaith relations, and geopolitical strategy.