From Hijaaz to Sallay: Easter Sunday, National Security & Investigative Consistency
Posted on May 23rd, 2026
Shenali D Waduge
Easter Sunday would not have occurred if national security had received consistent attention and if intelligence monitoring of known radical networks had not been disrupted. After the 2015 regime change, intelligence coordination was weakened, with focus shifting heavily toward corruption” and good governance”. This created operational gaps, delayed responses, and breakdowns in inter-agency information sharing.
ISIS threat known but neglected
As a result, radical elements were able to operate, recruit, and mobilise freely despite existing intelligence awareness and warrants. Even intelligence files forwarded to the Attorney General’s Department regarding Zaharan Hashim did not result in foreseeing the scope of the threat beyond the pages attached.
Thus, a locally organised extremist network led by Zaharan aligned to ISIS ideology-expanded its secret network during this period. Intelligence agencies were already aware of the global ISIS-risks and likely threats to Sri Lanka and had compiled numerous reports. The SIS also brought to the notice of the then governement reports of 32-38 Sri Lankan Muslims travelling to Syria to join ISIS, later acknowledged in Parliament. Zaharan himself had already attacked Sufi Muslims in Kattankudy and was subject to an arrest warrant in 2017.
Politicizing intelligence & investigations
When intelligence and investigative functions become influenced by shifting political priorities, threat response is weakened.
Multiple official inquiries-including the Presidential Commission, Parliamentary Select Committee, and Supreme Court confirmed a critical point: across all findings. Intel was provided, warnings existed, but information sharing, discussing the threat, coordinating preventive action and the will do so did not follow in time.
Thus, Easter Sunday did not happen due to absence of intelligence, but due to failure of timely action on intelligence and warnings at hand.
Institutional Responsibility, Legal Accountability despite Political influence
Governments come and go.
But, public officers are bound by constitutional and statutory duties.
Sri Lankan law provides mechanisms for accountability where public functions are exercised negligently, arbitrarily, or in breach of duty, including judicial review, fundamental rights jurisdiction, and Penal Code provisions on misconduct in public office.
Politicians may escape legal scrutiny but public officials will eventually face the consequences of compromising their mandated duties.
Investigative and prosecutorial discretion cannot be shifted for political advantage. Any perception of political influence over investigations undermines institutional independence and raises questions of legality, abuse of authority, and procedural compliance with dire future consequences.
Confidentiality of Intelligence & Operational Risk
While accountability is essential, intelligence operations cannot be evaluated on the same benchmarks and depend on confidentiality and protection of sensitive methods and identities. International practice recognises that disclosure of operational details can endanger personnel and compromise national security.
Sri Lanka has previously seen the consequences of exposure of sensitive intelligence operations, including the 2002 Millennium City debacle, which severely impacted Sri Lanka’s national security after LTTE killed over 50 intel personnel following the disclosure of their names & identities.
Therefore, accountability must be balanced carefully with protection of operational integrity.
Investigations must not evolve into processes that weaken future intelligence operations or personnel.
Warnings, ISIS Claim, and Operational Reality
Sri Lanka endured 30 years of LTTE terrorism, where suicide attacks were not preceded by warnings. In contrast, alongside the locally compiled reports on Zaharan Hashim & his radical network, multiple foreign intelligence agencies issued repeated warnings prior to Easter Sunday, including reports as late as the morning of the attacks, identifying names and locations.
The discovery of arms caches and established links to Zaharan-including financial networks involving the Ibrahim family, 3 members of whom were among the suicide bombers-should have triggered urgent coordinated action and arrests.
ISIS itself claimed responsibility for the attacks and released visual confirmation of Zaharan’s group.
International intelligence agencies who conducted their own investigations did not indicate any internal state-directed operational control over the attackers.
The Hijaaz Case: State’s Investigative Model
Following Easter Sunday, the State through the AG’s department made arrests and pursued multiple cases, including that of Hejaaz Hizbullah under the PTA in 2020.
The case included:
- witness statements (including minors)
- speech-related allegations
- CID investigative material
- ideological and contextual claims
- alleged financial links involving around 115 statements
https://www.facebook.com/watch/?v=2536173680009993
The State’s position demonstrated an internal multi-layered investigative model: ideology, networks, communication, and funding-investigation first, charges after.
However, after six years, the case against Hijaz remains unresolved without conviction or acquittal. He remains on bail.
This is not about guilt or innocence, but about procedural completion and justice through timely adjudication.
The importance of this case lies in the ability to prove the evidence being provided, which sets a reference and model framework for how radicalisation and network-based investigations are constructed & conducted.
Transition from Hijaaz to Sallay: Consistency under Question
Despite the prolonged and unresolved nature of the Hijaaz case, a new investigative narrative has emerged involving the sudden arrest of Maj. Gen. Suresh Sallay.
Unlike earlier investigations grounded in multi-source internal material, the present allegations appear heavily reliant on claims originating from a single source, published through a foreign documentary and based on one complaint referencing this single source.
This raises key questions:
- If the prosecution previously presented Hijaaz Hizbullah as the ideological theoretician” behind radicalisation, and now seeks to portray Maj. Gen. Suresh Sallay as the mastermind” of the Easter attacks, what evidence establishes a connection between the two?
- What independently verified evidence exists beyond the claims via this foreign documentary?
- If there is new evidence, when did new evidence emerge, and why was it absent during prior multi-agency investigations?
- Why did foreign intelligence investigations, CID inquiries, and commissions not previously raise such allegations?
- The most important question – would this arrest have occurred without the documentary narrative and claims of its central witness?
- Another equally important question is – have the investigators independently verified the claims made by this single sole source against Maj. Gen. Sallays travel records, communications data, and location validation before arresting a top official?
- The bigger question is why the same prosecuting framework appears to rely on limited originating claims in the arrest of Maj. Gen. Suresh Sallay in contrast to earlier PTA cases where extensive internal evidence preceded charges.
After more than seven years of investigations, commissions, intelligence reviews, court proceedings, and international attention, the public is entitled to expect that any new allegation rests not on narratives, assumptions, or uncorroborated claims, but on independently verifiable evidence capable of meeting the high threshold demanded by law.
In a case of this magnitude, the greater the allegation, the greater the burden of proof. That burden is owed not only to the Court, but also to the public, the victims, and the integrity of the justice system itself.
Contradictions in Narrative
A further inconsistency emerges: the same narrative creators simultaneously describe Sallay as both a mastermind” and an instrument of wider political objectives.
Both cannot stand together.
One narrative assign direct operational control; the other assigns secondary influence.
If he was mastermind – what was his objective is what the prosecution needs to establish beyond doubt.
If he was an instrument of a wider political objective – evidence to this must be provided beyond a single source.
Service Record and Contextual Gaps
It is also relevant that Sallay’s service timeline placed him outside active operational intelligence command during key periods, including diplomatic postings and training assignments between 2016 and 2019.
This further underscores the need for clear evidence rather than assumption-based attribution alongside social media sensationalism.
Eventually the court must decide and not social media adjudicators.
Core Crime Must Remain Central
Easter Sunday was executed by radicalised suicide attackers.
These attacks have historical & contemporary significance and links with the ideology followed.
That remains the central fact.
Most importantly, members of the radicalized group are still at large.
What has been done to neutralize their radicalism.
Any investigation must establish the full chain: radicalisation, recruitment, financing, facilitation, and execution.
New narratives must be tested within this framework-not replace or dilute it.
If focus shifts away from perpetrators toward unverified secondary theories, there is a risk of obscuring the original crime and enabling a future security threat.
We then return to the negligence factor that resulted in the attacks without learning lessons.
Closing Principle: Consistency & Evidence
This is not about selecting between individuals or competing narratives.
It is about consistency in the application of accepting & investigating evidence to the same national tragedy that occurred on Easter Sunday.
The victims & their families deserve closure.
The accused deserve due process.
The public deserves clarity grounded in evidence.
Investigative and prosecutorial authority is not absolute.
It must operate within law, institutional mandate, and evidentiary integrity and notably outside satisfying political objectives.
Where actions are perceived as politically influenced or inconsistent, questions of legality, abuse of authority, and procedural fairness arise.
At the same time, not only must public officials function as per their statutory mandate without political influence they must also realize that misusing their powers to compromise intelligence and security mechanisms will risk a key tier that protects the nation & its people.
If the same political interference is diverting officials from neutralizing the radicalization taking place given the lack of attention to such, then Sri Lanka risks once again ignoring a likely future threat. We must learn from 30 years of LTTE terror and the blunders of negligence in taking preventive action when the clues and the warnings were placed before every individual that had the powers to take action.
Those who had prior knowledge of an impending attack and failed to act must be held accountable for that failure.
Questions may also arise regarding the role of individuals who had prior knowledge but only protected themselves.
The key question remains:
Are we still focused on fully resolving responsibility for Easter Sunday, while ensuring that all roaming radical elements are identified, monitored, and neutralised to prevent a similar attack in the future—or are we expanding inconsistent narratives to serve political objectives, thereby delaying closure, obscuring the original crime, and weakening preventive security action and intelligence coordination for national security?
Shenali D Waduge