A bearded man wearing a heavy backpack and sandals walks deliberately across the courtyard of St. Sebastian’s Church in Sri Lanka on Easter Sunday. Moments later, he slips past the pews where women are sitting with their hair covered in veils of white lace, then detonates a bomb.
The explosion that followed — one of numerous blasts unleashed by eight suicide bombers at six sites in three cities — was strong enough to blow the tiles off the church roof. The coordinated attacks were believed to have been carried out by a local cell that had pledged allegiance to the Islamic State.
Sri Lankan officials on Thursday lowered their estimate of the death toll by about 100, to 250 to 260 people killed. Even so, that would make it one of the deadliest attacks carried out by the Islamic State, nearly twice as lethal as the 2015 Paris attacks.
Just four weeks after the ISIS caliphate was erased in Iraq and Syria — and four months after President Trump first claimed the group was defeated — the terrorist group has reminded the world in dramatic fashion that it does not need to control territory to be a major threat.
“ISIS is not in disarray; it’s not ‘defeated,’” Laith Alkhouri, a senior director at Flashpoint, which assesses the global terrorist threat, said in a Twitter post on Wednesday. “It’s not a membership-based organization. It’s skilled at reorganizing and modifying its strategy to fit the evolving security landscape around the world.”
Experts say the group has simply pivoted to exploit the resources at hand and the notoriety it has banked as a global brand. With its command-and-control hierarchy in Syria and Iraq seriously degraded, it has become more decentralized, turning to its affiliates further afield to spread its message and mayhem.
“As its core weakens, its peripheries will become more dangerous,” Charlie Winter, a senior research fellow at the International Center for the Study of Radicalization at King’s College London, tweeted on Thursday.
The Islamic State has always seen the caliphate as a global project, and despite the loss of territory in Iraq and Syria has continued to expand abroad.
When the remnants of Al Qaeda were driven from Afghanistan in 2002, the group was also forced to become more decentralized, turning to foreign franchises in places like Yemen, Iraq and northern Africa to regenerate. But unlike Al Qaeda then, the Islamic State already has numerous affiliates around the globe, an influential media ministry and thousands of fighters still underground in the group’s home base in Iraq and Syria.
As early as 2015, ISIS began instructing recruits to migrate to territory held by its overseas affiliates. And in a development sometimes missed by local officials abroad, it began signing up kindred local groups in distant outposts.
“Rather than building up membership from scratch, the group poaches members from existing hard-liner groups, or oftentimes the entire groups themselves,” wrote Rita Katz, a co-founder of SITE Intelligence Group, which monitors extremist propaganda.
In the Philippines, ISIS recruited insurgents from Abu Sayyaf to create what it considers its East Asia Province, which carried out an attack on a cathedral in January, killing 23 people. The ISIS affiliate in Afghanistan has swallowed whole units of Taliban fighters.
More recently, it cobbled together a new “province” in the Democratic Republic of Congo by recruiting members of the Allied Democratic Forces rebel group, which received cash transfers from an ISIS financier.
These groups have felt little impact from the loss of territory in Iraq and Syria, and need no direct communication from the Islamic State to understand its objectives, which the terrorist group broadcasts in regular audio messages.
“They understand that the mission within their geographies is to amplify operations against law enforcement, military and, yes, non-Muslim and Shia groups,” Mr. Alkhouri said.
They also have local knowledge that can help identify seams in a country’s defenses — like the fact that after a 26-year military campaign against ethnic Tamil insurgents, most of whom are Hindu, Sri Lankan security officials were more focused on them than on Islamist extremists.
That blind spot may have contributed to Sri Lankan officials’ failure to act on warnings by Indian intelligence of a plot to bomb churches.
“When combined with ISIS’ technical know-how and expertise, the combination with the local knowledge of more parochial groups can have devastating effects,” said Colin P. Clarke, a senior fellow at the Soufan Center, a research organization for global security issues.
And now that it has lost its safe haven in the Middle East, the Islamic State may be increasingly relying there on the model it perfected abroad.
The group’s leader, Abu Bakr al-Baghdadi, has gone underground and is believed to communicate only by personal courier, but its fighters communicate freely by encrypted apps.
Despite the declarations of victory, the Islamic State’s insurgent campaign is steadily gaining momentum across Iraq and Syria, according to a new report by the Institute for the Study of War in Washington. The report found that ISIS was ramping up attacks in parts of northern Syria and Iraqi Kurdistan as well as in major cities that were once under its control, including Raqqa, Syria — its former capital — and Mosul and Falluja, Iraq.
Last week, in its biggest operation since losing its Syrian stronghold, the group carried out attacks against the Syrian Army and allied militias in central Syria, killing 35 soldiers over two days, according to the Syrian Observatory for Human Rights, a monitoring group based in Britain.
As it has decentralized, ISIS has increasingly depended on its mass-media operation, which continues to spread its message around the world.
Every day since officials of the American-led military coalition touted the end of the caliphate, the group’s media operatives have issued claims of responsibility for attacks around the world.
On the same day as the Sri Lanka attack, for instance, ISIS issued a video showing Saudi jihadists pledging allegiance to Mr. al-Baghdadi before carrying out an assault near Riyadh and it published details of an attack by its Afghan affiliate on the country’s Ministry of Communications.
“Because ISIS’s media machine capitalizes on every single sphere of operation, it looks to many of its followers as still a strong, global group,” Mr. Alkhouri said. “Followers wholeheartedly believe that the breakdown of their caliphate in Iraq and Syria is nothing but a temporary tribulation.”
While the group’s production of high-end videos has declined, the constant stream of propaganda published around the clock in multiple time zones and languages suggests that ISIS’ media unit has a global network of editors and writers.
It is a redundancy that has allowed the operation to survive.
Just weeks ago, Iraqi officials announced that they had dismantled an ISIS media office in a mountainous hide-out, claiming that it produced the weekly newsletter, Naba. But the next week, Naba came out on schedule.
The Islamic State can still tap a large war chest to finance its global operations. It has $50 million to $300 million in cash either hidden in Iraq and Syria or smuggled into neighboring countries for safekeeping, according to a United Nations report released in February.
The terrorist group is still engaged in kidnapping for ransom, and is believed to have invested in legitimate businesses, including fish farming, car dealing and cannabis growing, Mr. Clarke said. Stealthily distributing the money abroad is a skill that the group has developed over the years, using proxies, cutouts and known middlemen, he said.
Decentralization makes it difficult to know the extent of the group’s involvement in attacks like the one in Sri Lanka.
The Islamic State has claimed responsibility for the bombings, but experts and the local authorities have yet to determine the extent of its ties to the local group said to have carried them out. Until this week, the group, National Thowheeth Jama’ath, was an obscure organization best known for defacing Buddhist statues.
American intelligence officials have so far characterized the Sri Lanka attacks as having been inspired by the Islamic State, as opposed to having been executed directly by the group. But analysts say there may be some middle ground.
A video released by ISIS on Tuesday, showing members of National Thowheeth Jama’ath pledging fealty to Mr. al-Baghdadi, shows at the least that the group had a means of communicating with core ISIS operatives and was able to transmit video to them.
“The fact that the attackers knew the right people in ISIS to send the video to so that it would be released through its official media channel, shows that it’s more than mere inspiration,” Amarnath Amarasingam, an expert at the Institute for Strategic Dialogue, said on Twitter on Wednesday. “That’s just one of many pieces of info emerging pointing to a more directed attack.”
So far, there is no public evidence that ISIS played an active role in guiding or otherwise aiding the Sri Lanka attack.
This gray area may be a fertile environment for the group’s future.
The attack was the deadliest ever carried out by Islamic State acolytes outside Iraq and Syria. That the group responsible for it existed so far below the radar of international intelligence agencies troubles counterterrorism officials, who wonder how many similar groups are active or operating surreptitiously in North Africa, South Asia and elsewhere.
Current and former counterterrorism officials warned that the Sri Lanka bombings may be a harbinger for a new phase of ISIS attacks.
“Former ISIS fighters and sympathizers are rebranding themselves ideologically with other terrorists,” said Christopher P. Costa, who was a senior director for counterterrorism on the National Security Council under the Trump administration. “It’s not just a question of the loss of a physical caliphate so much as considering exactly what ISIS will look like as it tries to reconstitute itself.”
“We will see more of these kinds of attacks in the future,” he said.