A bearded man wearing a heavy backpack and sandals walks deliberately across the courtyard of St Sebastian’s Church in Sri Lanka on Easter Sunday. Moments later, he slips past the pews where women are sitting with their hair covered in veils of white lace, then detonates a bomb.
The explosion that followed — one of numerous blasts unleashed by eight suicide bombers at six sites in three cities — was strong enough to blow the tiles off the church roof.
At least 250 people died in the coordinated attacks, which were believed to have been carried out by a local cell that had pledged allegiance to the Islamic State. That would make it one of the deadliest attacks carried out by the group, nearly twice as lethal as the 2015 Paris attacks.
Just four weeks after the Islamic State caliphate was erased in Iraq and Syria — and four months after President Donald Trump first claimed the group was defeated — the terrorist group has reminded the world in dramatic fashion that it does not need to control territory to be a major threat.
“ISIS is not in disarray; it’s not ‘defeated,’” Laith Alkhouri, a senior director at Flashpoint, which assesses the global terrorist threat, said in a Twitter post on Wednesday, using an alternative name for the Islamic State group. “It’s not a membership-based organization. It’s skilled at reorganizing and modifying its strategy to fit the evolving security landscape around the world.”
Experts say the group has simply pivoted to exploit the resources at hand and the notoriety it has banked as a global brand. With its command-and-control hierarchy in Syria and Iraq seriously degraded, it has become more decentralized, turning to its affiliates further afield to spread its message and mayhem.
“As its core weakens, its peripheries will become more dangerous,” Charlie Winter, a senior research fellow at the International Center for the Study of Radicalization at King’s College London, tweeted on Thursday.
The Islamic State has always seen the caliphate as a global project, and despite the loss of territory in Iraq and Syria has continued to expand abroad.
When the remnants of al-Qaida were driven from Afghanistan in 2002, the group was also forced to become more decentralized, turning to foreign franchises in places like Yemen, Iraq and northern Africa to regenerate. But unlike al-Qaida then, the Islamic State already has numerous affiliates around the globe, an influential media ministry and thousands of fighters still underground in the group’s home base in Iraq and Syria.
As early as 2015, the Islamic State group began instructing recruits to migrate to territory held by its overseas affiliates. And in a development sometimes missed by local officials abroad, it began signing up kindred local groups in distant outposts.
“Rather than building up membership from scratch, the group poaches members from existing hard-liner groups, or oftentimes the entire groups themselves,” wrote Rita Katz, a co-founder of SITE Intelligence Group, which monitors extremist propaganda.
In the Philippines, the Islamic State group recruited insurgents from Abu Sayyaf to create what it considers its East Asia Province, which carried out an attack on a cathedral in January, killing 23 people. The Islamic State group affiliate in Afghanistan has swallowed whole units of Taliban fighters.
More recently, it cobbled together a new “province” in the Democratic Republic of Congo by recruiting members of the Allied Democratic Forces rebel group, which received cash transfers from an Islamic State financier.
These groups have felt little impact from the loss of territory in Iraq and Syria, and need no direct communication from the Islamic State to understand its objectives, which the terrorist group broadcasts in regular audio messages.
“They understand that the mission within their geographies is to amplify operations against law enforcement, military and, yes, non-Muslim and Shia groups,” Alkhouri said.
They also have local knowledge that can help identify seams in a country’s defenses — like the fact that after a 26-year military campaign against ethnic Tamil insurgents, most of whom are Hindu, Sri Lankan security officials were more focused on them than on Islamist extremists.
That blind spot may have contributed to Sri Lankan officials’ failure to act on warnings by Indian intelligence of a plot to bomb churches.
“When combined with ISIS’ technical know-how and expertise, the combination with the local knowledge of more parochial groups can have devastating effects,” said Colin P. Clarke, a senior fellow at the Soufan Center, a research organization for global security issues.
And now that it has lost its safe haven in the Middle East, the Islamic State may be increasingly relying there on the model it perfected abroad.
The group’s leader, Abu Bakr al-Baghdadi, has gone underground and is believed to communicate only by personal courier, but its fighters communicate freely by encrypted apps.
Despite the declarations of victory, the Islamic State’s insurgent campaign is steadily gaining momentum across Iraq and Syria, according to a new report by the Institute for the Study of War in Washington. The report found that the Islamic State group was ramping up attacks in parts of northern Syria and Iraqi Kurdistan as well as in major cities that were once under its control, including Raqqa, Syria — its former capital — and Mosul and Fallujah, Iraq.
Last week, in its biggest operation since losing its Syrian stronghold, the group carried out attacks against the Syrian army and allied militias in central Syria, killing 35 soldiers over two days, according to the Syrian Observatory for Human Rights, a monitoring group based in Britain.
As it has decentralized, the Islamic State group has increasingly depended on its mass-media operation, which continues to spread its message around the world.
Every day since officials of the U.S.-led military coalition touted the end of the caliphate, the group’s media operatives have issued claims of responsibility for attacks around the world.
On the same day as the Sri Lanka attack, for instance, the Islamic State group issued a video showing Saudi jihadis pledging allegiance to al-Baghdadi before carrying out an assault near Riyadh and it published details of an attack by its Afghan affiliate on the country’s Ministry of Communications.
“Because ISIS’ media machine capitalizes on every single sphere of operation, it looks to many of its followers as still a strong, global group,” Alkhouri said. “Followers wholeheartedly believe that the breakdown of their caliphate in Iraq and Syria is nothing but a temporary tribulation.”
While the group’s production of high-end videos has declined, the constant stream of propaganda published around the clock in multiple time zones and languages suggests that the Islamic State group’s media unit has a global network of editors and writers.
It is a redundancy that has allowed the operation to survive.
Just weeks ago, Iraqi officials announced that they had dismantled an Islamic State media office in a mountainous hideout, claiming that it produced the weekly newsletter, Naba. But the next week, Naba came out on schedule.
The Islamic State can still tap a large war chest to finance its global operations. It has $50 million to $300 million in cash either hidden in Iraq and Syria or smuggled into neighboring countries for safekeeping, according to a United Nations report released in February.
The terrorist group is still engaged in kidnapping for ransom, and is believed to have invested in legitimate businesses, including fish farming, car dealing and cannabis growing, Clarke said. Stealthily distributing the money abroad is a skill that the group has developed over the years, using proxies, cutouts and known middlemen, he said.
Decentralization makes it difficult to know the extent of the group’s involvement in attacks like the one in Sri Lanka.
The Islamic State has claimed responsibility for the bombings, but experts and the local authorities have yet to determine the extent of its ties to local group said to have carried them out. Until this week, the group, National Towheed Jamaat, was an obscure organization best known for defacing Buddhist statues.
US intelligence officials have so far characterized the Sri Lanka attacks as having been inspired by the Islamic State, as opposed to having been executed directly by the group. But analysts say there may be some middle ground.
A video released by the Islamic State group on Tuesday, showing members of National Towheed Jamaat pledging fealty to al-Baghdadi, shows at the least that the group had a means of communicating with core Islamic State operatives and was able to transmit video to them.
“The fact that the attackers knew the right people in ISIS to send the video to so that it would be released through its official media channel, shows that it’s more than mere inspiration,” Amarnath Amarasingam, an expert at the Institute for Strategic Dialogue, said on Twitter on Wednesday. “That’s just one of many pieces of info emerging pointing to a more directed attack.”
So far, there is no public evidence that the Islamic State played an active role in guiding or otherwise aiding the Sri Lanka attack.
This gray area may be a fertile environment for the group’s future.
The attack was among the deadliest ever carried out by Islamic State acolytes outside Iraq and Syria. That the group responsible for it existed so far below the radar of international intelligence agencies troubles counterterrorism officials, who wonder how many similar groups are active or operating surreptitiously in North Africa, South Asia and elsewhere.
Current and former counterterrorism officials warned that the Sri Lanka bombings may be a harbinger for a new phase of Islamic State attacks.
“Former ISIS fighters and sympathizers are rebranding themselves ideologically with other terrorists,” said Christopher P. Costa, who was a senior director for counterterrorism on the National Security Council under the Trump administration. “It’s not just a question of the loss of a physical caliphate so much as considering exactly what ISIS will look like as it tries to reconstitute itself.
“We will see more of these kinds of attacks in the future,” he said.
