Sri Lanka has accused a local Islamist extremist group, the National Thowheed Jamaath, of being behind a string of Easter bombings at churches and hotels that killed at least 311 people, and the United States pledged support for the investigation, dispatching FBI agents to help.
At least four US citizens are among the dead, and "several" Americans were seriously injured, said the State Department. Sri Lankan Tourism Minister John Amaratunga said a total of 39 foreigners were killed and 28 wounded.
A Sri Lankan state minister for defense said officials raised the death toll in Sunday's attacks to 311, up from 290 the day before. The country is marking a national day of mourning today.
FBI agents are being sent to assist Sri Lankan police in their investigation, according to a law enforcement official. The FBI has also offered laboratory expertise in testing some of the bomb evidence, and analysts have been scouring FBI databases for any pieces of information that could shed additional light on the plotters, officials said.
Health Minister Rajitha Senaratne said the Islamist group, whose name roughly translates to National Monotheism Organisation, used suicide bombers at three churches and three hotels. He added that a foreign network was probably involved.
"We do not believe these attacks were carried out by a group of people who were confined to this country," Senaratne said. "There was an international network without which these attacks could not have succeeded."
He called for the police inspector general, Pujith Jayasundara, to resign because security agencies had received a report warning of attacks by this group on churches and hotels weeks earlier.
President Maithripala Sirisena said he would seek "international assistance" with the investigation. Intelligence agencies have reported that "international organisations" were behind these "acts of local terrorists," his office said in a statement. The statement also said the government would implement anti-terrorism measures that give police additional powers, effective at midnight last night.
Attention is focusing on why and how the government and security forces were unable to foil the coordinated bombings. Two officials provided the Washington Post with the three-page intelligence report that the health minister alluded to, in which a senior police official warned of potential suicide attacks by the same Islamist extremist group.
The report also identified several members by name, including the group's alleged leader.
Mujibur Rahman, a member of Sri Lanka's Parliament who was briefed on the report, said it was based on information from Indian intelligence agencies.
Officials said 24 suspects have been taken into custody for questioning, news agencies reported.
Authorities said the main attacks - on churches and hotels - were carried out by seven suicide bombers.
A Sri Lankan security official characterised Thowheed Jamaath as a shell for the Islamic State and said it has been active in Kattankudy, an area in the eastern part of the country and home to one of its largest Muslim populations. The group's leadership is believed to be based there, the official said.
The official said there could be additional explosives or potential suicide bombers.
"Right now, they are searching everywhere for possible bombs and people involved," the official said, speaking on the condition of anonymity to discuss the investigation.
In Washington, President Donald Trump called Sri Lankan Prime Minister Ranil Wickremesinghe on Monday morning to express condolences and received an update on the investigation. Trump pledged US support in bringing the perpetrators to justice, and the leaders reaffirmed their commitment to the fight against global terrorism, a pool report said.
Earlier, Secretary of State Mike Pompeo blamed "Islamic radical terror" for the attacks. He also spoke with Wickremesinghe and pledged "all possible assistance" to Sri Lanka.
"This is America's fight, too," Pompeo said at a news conference. Although the Islamic State's "caliphate" has been destroyed with the collapse of the group's last strongholds in Syria, "radical Islamist terror remains a threat," he said. "We have to remain active and vigilant, and it's going to require attention."
Thowheed Jamaath "wasn't on anyone's radar," said Michael Leiter, who served as director of the National Counterterrorism Centre in the Bush and Obama Administrations. He said the attack probably had an international nexus, given that not only Sri Lankans were targeted.
"It wouldn't surprise me either if there were at least a couple of people who had traveled to Syria," Leiter said. "There was never a large Sri Lankan population there, but it only takes one or two to return and inspire a local group to align itself ideologically and tactically with a global violent jihadist organisation."
But the absence of any clear claim of responsibility from an established international terrorist organisation suggests it might be too soon to say whether the Sri Lankan bombers had outside assistance, said Nicholas Rasmussen, a former senior director for counterterrorism on the National Security Council who also ran the National Counterterrorism Centre in the Obama and Trump Administrations.
"But it wouldn't take much - a connection between Sri Lankan foreign fighters in Syria with like-minded people back home - in order to create such a connection," Rasmussen said. He added that the high death toll and simultaneous attacks suggested a degree of sophistication in bombmaking and organisation, which are "characteristic of an established group."
The SITE Intelligence Group, which tracks extremist activity online, said that an unidentified Islamic State supporter distributed photos of three alleged "commandos" involved in the Sri Lanka attacks. The photos were posted in pro-Islamic State chat rooms, and the men, pictured holding weapons in front of Islamic State banners, were described as "among the commando brothers in Sri Lanka," SITE said.
The group reported that Islamic State supporters were portraying the attacks as revenge for strikes on mosques and Muslims.
The highly coordinated attacks left the island nation reeling, a crushing blow after almost a decade of peace since the end of its civil war.
In that time, tourism in Sri Lanka had been steadily growing, the country transformed by the apparent end of instability, bloodshed and frequent suicide bombings over the 26-year war.
A huge number of the dead were worshipers at St. Sebastian's Church in Negombo, north of Colombo; officials reported at least 104 killed there.
In a sign of rising tensions in the wake of the attacks, 22 Muslim refugees from Pakistan living in Negombo faced threats and intimidation from a group of local residents. Police arrived and separated the two groups, said Kosela Navaratna, the officer in charge at the Katana police station in Negombo. The refugees are in police protection.
In Colombo, the three high-end hotels attacked included the Shangri-La and the Cinnamon Grand. An official with the Sri Lankan air force said an explosive was defused close to the Bandaranaike International Airport, the city's main airport, on Sunday night, probably an additional target.
Police also confirmed a controlled explosion late Monday afternoon of a van parked near St. Anthony's Church in Colombo, where several people were killed the day before.
At the Shangri-La Hotel, the bombing occurred in a restaurant as guests were having breakfast. Investigators who spoke on the condition of anonymity because they were not authorised to talk to the media said two suspects had checked into a room at the hotel earlier in the morning and gave local addresses.
Officers were killed by an explosion when they raided a house at one of those addresses, the Sri Lankan security official said.
Wickremesinghe, the Prime Minister, said that some government officials had prior intelligence about the attacks but did not act on it.
"Information was there," he said at a news conference. "This is a matter we need to look into."
There was an international network without which these attacks could not have succeeded. Health Minister Rajitha Senaratne
The security apparatus in Sri Lanka is controlled by Sirisena, the President. Relations between him and the Prime Minister have been at a low point since Sirisena tried to oust Wickremesinghe from office late last year, leading to a political crisis.
Rahman, the member of Parliament briefed on the report, is affiliated with the Prime Minister. He said Wickremesinghe "had the letter in his hand" when he met with lawmakers on Sunday.
"He told us that the Indian intelligence had conveyed threats of possible attacks. Two possible dates were mentioned, April 4 and 11," Rahman said. "Part of the problem is since the October 26 coup, the Prime Minister has not been invited to the security council meetings, so we don't know what is being discussed," he added.
At least seven Indian citizens were killed in the attacks, the Indian Embassy reported.
Three police officers were killed during a raid at a suspect's house.
Although a majority of the dead were Sri Lankan, at least two dozen were foreigners, including people from Britain, India, Japan, Turkey and the United States. The unidentified bodies of 25 people believed to be foreigners were at a government mortuary in Colombo.
Sri Lanka is a predominantly Buddhist nation, but it is also home to significant Hindu, Muslim and Christian communities. There has been intermittent conflict between religious groups - including threats to Christians - but nothing remotely like Sunday's attacks had occurred.
Six of the blasts occurred between 8:45 and 9:30 a.m. Sunday. A seventh occurred at a banquet hall about 2 p.m. and an eighth at the house police raided about 2:45 p.m.
In an updated travel advisory issued late Sunday, the State Department warned that "terrorist groups continue plotting possible attacks in Sri Lanka," citing threats to tourist sites, shopping malls, hotels, places of worship and other public areas.
Sri Lankan authorities blocked Facebook and the messaging application WhatsApp in an attempt to halt the spread of false and inflammatory messages. Security was heightened at churches nationwide, and the streets of Colombo grew quiet and deserted as the curfew took effect.