Sri Lanka’s investigation into the 2019 Easter Sunday attacks, under the National People’s Power (NPP) government, has moved into the intelligence services. A few years ago, this would have been unimaginable.
The arrest of former State Intelligence Service Director Major General (retd.) Tuan Suresh Sallay for his suspected role in the Easter terrorist attacks, forces Sri Lanka to confront the security architecture that expanded during the civil war, survived the postwar transition, and often operated beyond public scrutiny.
From Security Failure to State Suspicion
During the first few years after the attacks, many Sri Lankans believed that the Easter attacks were the result of the failure of coordination and the incompetence of the Sirisena-Wickremesinghe administration. The accepted narrative was that intelligence officials failed to act on warnings from India, and the government, divided between President Maithripala Sirisena and Prime Minister Ranil Wickremesinghe, neglected national security. There was a lack of coordination across the bureaucracy that had weakened the state at the worst possible moment.
The Parliamentary Select Committee and the Presidential Commission of Inquiry documented serious failures in the security apparatus and several committees appointed by Wickremesinghe, once he came into the presidency in 2022, all reinforced the narrative that negligence and dysfunction had made the attacks possible.
But in the years following 2022, cracks started appearing in the narrative. With the collapse of trust in the established order, claims that once remained at the margins moved to the center of public debate.
The attacks killed over 260 people, shattered the fragile postwar normalcy, and helped Gotabaya Rajapaksa win the 2019 presidential election in a landslide. Rajapaksa presented himself as the candidate of security and order, and promised to get to the bottom of the attacks. Yet his government made little visible progress.
About 41 High Court cases were filed in connection with the Easter Sunday attacks, and 38 of them grew out of investigations carried out by Shani Abeysekara, who was director of the Criminal Investigation Department (CID) when the attacks took place. Only three cases were filed after Abeysekara was removed from the CID following Gotabaya Rajapaksa’s rise to power in November 2019. The lack of progress under the Rajapaksa administration made many Sri Lankans uneasy and strengthened the suspicion that the investigation had not merely stalled, but had been redirected away from politically sensitive questions. If Abeysekara’s investigations had done the heavy lifting, people began to question why he was removed.
That unease made people open to claims that the attacks may have involved more than Islamist extremism and official negligence. When Azad Maulana, a former aide to Sivanesathurai Chandrakanthan aka Pillayan, alleged that senior intelligence officers had maintained contacts with extremist actors before the attacks, his claims reinforced growing public doubt about the official story. Pillayan is the former chief minister of the Eastern Province and a close associate of the Rajapaksas. Maulana’s claims would not have created an impact if not for the stalled investigation.
A promise for answers became one of the NPP’s election pledges. After coming to power, the NPP renewed and reinvigorated the investigations. Abeysekara was reappointed CID director, and a number of cases are making rapid progress.
One of the most important new developments is the focus on whether elements of Sri Lanka’s intelligence apparatus worked with, protected or manipulated Islamist extremists before the attacks.
In 2025, President Anura Kumara Dissanayake described the bombings as a tragedy used to seize power. He later told Parliament that even destroyed evidence would not prevent the government from finding the truth. He has also warned that rogue elements within the police and armed forces would not be spared.
While Maulana’s Channel 4 interview remains the most discussed source of the allegation, the line of inquiry did not begin there. As early as May 2019, a suspect had reportedly pointed investigators toward contacts between Zahran Hashim’s circle and Pillayan. The investigation has therefore moved toward Sallay not only because of one televised allegation, but because investigators are now revisiting whether early leads about extremists, armed political actors and intelligence personnel were neglected after the change of government in 2019.
Sallay has denied wrongdoing. His lawyers and political defenders say the case is politically motivated, that the investigation humiliates a decorated intelligence officer and undermines the defense establishment. His family has raised concerns about his health and detention conditions.
Sallay, like everyone arrested in connection with the Easter Sunday attacks, has been arrested under the Prevention of Terrorism Act (PTA). It’s widely acknowledged that the PTA is a draconian legislation that allows prolonged detention and contains weak safeguards. Since its inception in 1979, thousands were detained under this law, and ironically, many who now speak passionately about Sallay’s rights spent years defending the PTA when it crushed their political opponents, often from non-privileged classes. Their hypocrisy is obvious but that should not matter.
The case also raises a question about who owns intelligence information in Sri Lanka. Some opposition figures have argued that investigators should not access Sallay’s devices because they may contain sensitive state secrets. That claim creates its own problem. Intelligence does not belong to the officer who handled it, but to the state. A system that allows secret records to leave with retired officials is not protecting national security; it is compromising it.
This takes the case beyond Sallay. Sri Lanka built much of its modern security architecture during the war. The state had to fight a ruthless insurgent organization, and intelligence work became central to survival. But wartime institutions rarely shrink on their own when war ends. They protect budgets, relationships, methods, and influence; they also attract politicians who see secret institutions as useful tools. After the defeat of the LTTE in 2009, Sri Lanka did not consider which parts of the wartime security system still served national security and which parts had become instruments of political power.
The Easter attacks investigation has now reopened that postwar debate Sri Lanka never had. The challenge before Sri Lanka is to ensure that various branches of bureaucracy answer to the law, elected authority, courts, and institutional controls.
The NPP government came to power promising to clean up institutions, punish corruption, and end the old culture of political protection. The public gave it an extraordinary mandate because many Sri Lankans believed the country’s collapse was not only economic, but also institutional. A lack of accountability crippled Sri Lanka’s institutions.
Recent arrests and investigations have reinforced that sense of a larger accountability moment. Former ministers, politically connected businessmen, senior officials, and members of influential families now face cases involving bribery, organized crime, money laundering, and abuse of office. While not every arrest will lead to a conviction, the old assumption that power could delay accountability indefinitely has begun to shake.
The opposition will call these cases political, especially when they touch its allies. The government’s answer should come in the shape of well-developed cases that stand the scrutiny of the courts. Not all Sri Lankan governments pass this test. The 2015 Yahapalana government came to power on a platform of anti-corruption and good governance, but failed to deliver meaningful accountability. Its failure deepened cynicism and helped restore the very forces it had promised to check.
The victims of Easter Sunday deserve answers that can stand in court. The public deserves to know whether the state failed them, or whether parts of it betrayed them. And Sri Lanka needs intelligence agencies powerful enough to protect the country, but not above the law.
That is the real test now before the NPP government. Sallay may be convicted or cleared. But the investigation has forced open a door Sri Lanka kept closed after the war. What lies behind that door will determine not only how the country remembers Easter Sunday, but how it governs the hidden parts of the state.
