The devasting Easter bombings in Sri Lanka are one of the deadliest ever attacks claimed by Islamic State (IS).
The attacks shocked many because Sri Lanka was not an obvious location for IS activity and the group was hobbled after the collapse of its caliphate project in Syria and Iraq. The lack of appreciation of this threat, led to multiple compounding intelligence and security failures by the Sri Lankan authorities, which resulted in these deadly bombings.
Yet the attacks in Sri Lanka should not have been all that surprising. While the territorial defeat of Islamic State was an important counter-terrorism win, the attacks in Sri Lanka are a stark reminder of what counter-terrorism officials have been stating for years — IS does not need to hold territory in order to remain a lethal global threat.
Increasingly that threat is presenting itself in Asia.
Thinking beyond the caliphate
The collapse of the caliphate and the retreat of IS leader Abu Bakr al-Baghdadi has not diminished the appeal of jihad as a solution to injustice, corruption and poor governance.
Growing sectarianism, disinformation and extremism provide openings for the ideology to take hold in people's hearts and minds.
Sri Lanka, and other regions in Asia, fit into Islamic State's broader strategy of gaining a foothold in countries and regions where there is a history of communal violence, where there are weapons and explosives readily available, where political and security structures are weak or weakening.
But practically speaking, how does IS manage to maintain its global reach even while losing its base in Iraq and Syria?
There are three ways:
1. Reliance on its regional networks and affiliates
IS is increasingly relying on its affiliate organisations and networks around the world to maintain its relevance via mayhem and to serve as vectors for its ideology.
IS began preparing for the eventuality of the caliphate's collapse since at least 2015. Instead of calling its followers to travel to Iraq and Syria, it reversed its instruction and told its supporters to migrate to its affiliate organisations or to remain in their home countries and conduct terrorist attacks on their behalf there.
IS has invested resources and energy in developing affiliates and networks in Asia — such as incorporating local groups like Abu Sayyaf and the Ansar Khalifa Philippines in the Philippines under its banner, establishing Islamic State Khorasan Province (ISKP) in Central Asia with operations in Pakistan and Afghanistan, and nurturing networks in India, the Maldives and Bangladesh.
IS supporters in Asia are also increasingly networking among themselves with some reports of Maldivians and Sri Lankans training with ISKP.
2. Use of remote-controlled operations
Islamic State is using a modus operandi known as "remote-controlled operations". These types of operations pair IS expertise in operational management and security, explosives and networking with local knowledge of a country, its rhythms and its targets.
IS operatives act as handlers for local individuals, guiding their attack plotting, helping identify targets, maintaining their motivation and remotely organising logistics.
The group fingered for the Easter attack, National Tawheed Jamaath, was a small, little-known group whose only previous activity was defacing Buddhist statues.
It stretches credulity that they could have conducted synchronised, sophisticated attacks of this magnitude alone. They needed outside management to pull off this highly coordinated operation.
We do not yet know the exact role Islamic State had in the Sri Lanka attack, but there are indications the Easter bombings where not just inspired by IS but in some way directed.
India's National Investigation Agency passed intelligence to the Sri Lankan's that IS sympathisers in Tamil Nadu indicated an attack in Sri Lanka was likely, suggesting IS-connected individuals in India had advance knowledge of the attack planning.
The ring leader of the Sri Lanka attacks, Zahran Hashmi aka Mohamed Zaharan, was known to have travelled to neighbouring Maldives, a country with known IS supporters, where he could have been in contact with individuals who could have assisted in planning the attacks.
There are also at least 32 Sri Lankans who were known to have travelled to IS territory in Syria and Iraq. Authorities have acknowledged some could have returned to Sri Lanka at some point or gone to neighbouring countries and there is a possibility one or more of them could have served as a connection between NTJ and IS.
Moreover, IS has used this strategy before, most clearly in organising a failed cell in Hydrabad, India. And it will likely use this strategy again in the region.
3. A propaganda machine in multiple languages
The IS media and propaganda machinery is alive and well and fuelled by a global network that can release messages across times zones and in multiple languages.
IS still maintains a sophisticated strategy of targeted outreach through speaking directly in local languages.
When IS claimed the Sri Lanka attacks, it released statements in Arabic and English, as is its wont, but it also did so in Tamil and Malayalam, two languages spoken in Tamil Nadu and Kerala, India, where it has a number of supporters.
IS has still not made major inroads among the Muslim population in those areas, but the fact it is putting in so much targeted effort reveals its persistence in seeking to establish its presence throughout Asia.