In a recent episode of FBI Retired Case File Review, retired Special Agent Raj Patel revisits one of the most devastating terrorist attacks in recent history: the 2019 Sri Lanka Easter bombings. The coordinated attacks, carried out by eight ISIS-inspired suicide bombers, targeted three Western hotels and three churches in Colombo and Batticaloa, killing 270 people, including five Americans.
Patel, who served on the Los Angeles Division’s Extraterritorial Squad at the time, was deployed to Sri Lanka for approximately 75 days across two separate assignments. As the lead case agent, he spearheaded the investigation that ultimately led to the successful indictment of three non-U.S. persons for providing material support to terrorism. For their efforts, Patel and his team were honored with the 2021 Director Award for Most Outstanding International Investigation.
Over his 20-year career with the FBI, Patel held multiple key assignments. He began in Los Angeles working on cyber intrusions and later joined the Crimes Against Children and Sexual Assault Felony Enforcement teams, becoming a subject matter expert on child exploitation and Child Sex Tourism cases. His work often took him abroad, including operational deployments to Cambodia, Thailand, the Philippines, Bangladesh, and the Maldives.
Later, Patel focused on counterterrorism with the Extra-Territorial Squad, investigating ISIS and AQIS activities across Southeast Asia and the Indian Subcontinent. His work included embedded assignments with the Joint Special Operations Command (JSOC) in the southern Philippines and high-value detainee interrogations. He also contributed extensively to violent crime investigations in Los Angeles, specializing in kidnappings, extortion, and threats to life, before retiring as supervisor of the Violent Crimes Against Children and Human Trafficking Task Force.
Patel’s career also included roles as a firearms and defensive tactics instructor, an Advanced Law Enforcement Rapid Response Training (ALERRT) instructor, and an adjunct faculty member in interrogation techniques. He now serves as a Police Special Investigator with the Los Angeles Police Department’s Office of the Inspector General.
The podcast episode is hosted by Jerri Williams, a retired FBI agent, author, and podcaster, known for her FBI for Armchair Detectives nonfiction series and the Philadelphia FBI Corruption Squad crime fiction novels. Williams’ podcast, FBI Retired Case File Review, features more than 300 episodes exploring real-life FBI cases and is available on Apple Podcasts, Spotify, YouTube, and other platforms.
The Sri Lanka Easter bombings represented one of the most complex and high-pressure extraterritorial investigations ever undertaken by the FBI, demanding rapid mobilization, meticulous evidence collection, and a deeply victim-centered approach. For the agents involved, the first days and weeks were defined by a relentless rhythm that began in the early hours at the U.S. Embassy, followed by extensive fieldwork throughout Colombo and other affected areas, and concluded each night with detailed briefings and operational planning sessions. Each evening, specialized teams—including the Evidence Response Team (ERT), the Critical Analysis and Response Team (CART), and high-value detainee interrogators—would report their findings, while the ET squad agents coordinated strategy and assessed priorities. Late-night calls to FBI headquarters and supporting personnel in Los Angeles maintained a continuous, 24-hour operational link, ensuring that the unfolding investigation remained aligned with resources, legal requirements, and evolving intelligence. Guidance from experienced agents, particularly Marilee, who had previously worked large-scale terrorist attacks in Mumbai and Bali, provided crucial perspective and validation during this intense early phase, helping the ET squad maintain strategic focus and operational direction under immense pressure.
The initial response to the attacks involved careful coordination with Sri Lankan authorities and international law enforcement partners. Within hours of the bombings, the ET squad established operational command, assessing the immediate threat and determining who on the ground could provide support. At first, only a small group of three to five agents were deployed, including the Special Agent Bomb Technician (SABT), members of the ALAT from Singapore, and the flight team. Despite their small numbers, the team’s presence allowed for immediate engagement with local law enforcement, beginning with meetings at the U.S. Embassy and continuing with site assessments of blast areas and suspected safe houses. Coordination with the Sri Lankan Criminal Investigative Division (CID), led by Ranjith, proved invaluable, as it facilitated access to local detectives, evidence, and logistical support while fostering trust and cooperation with officials managing an overwhelming crisis under martial law conditions. This trust was essential, given Sri Lanka’s limited experience with radical Islamist terrorism and the unique challenges of post-civil war policing, which had previously focused largely on groups such as the Liberation Tigers of Tamil Eelam.
The ET squad faced the immediate task of processing the immense volume of evidence generated by multiple simultaneous bombings at churches and hotels. Initial priorities included DNA collection from detainees, fingerprint analysis, and processing of crime scenes by both the ERT and local law enforcement. As the investigation unfolded, it became clear that tangible, verifiable evidence would be critical for building a U.S.-based criminal case, given the uncertainties inherent in international prosecution, the potential for witnesses and detainees to change their stories, and the possibility of shifting cooperation from host-nation authorities. The agents relied heavily on forensic analysis of blast sites, safe houses, and bomb-making materials, documenting fingerprints, chemical residues, and structural damage. Every step of this evidence collection was executed with precision, from photographing lease agreements to tracing the purchase of chemicals and explosives used in the attacks. By directly linking suspects such as Rizqan and Sanazdin to these materials through fingerprints and documentation, the team ensured that the case was anchored in concrete, irrefutable evidence rather than relying solely on statements or circumstantial findings.
Digital evidence was equally critical. The attackers had employed sophisticated operational security measures, destroying most of their phones and relying on encrypted peer-to-peer messaging via Threema. Despite this, investigators were able to gather substantial social media and digital communications that linked suspects to the ISIS-affiliated National Tauhid Jamaat (NTJ) network. CART personnel, augmented by experts from the Los Angeles field office and international partners from Australia, organized and processed hundreds of digital devices collected from safe houses and detainees. The establishment of a rigorous cataloging system enabled investigators to track the origin of each device, cross-reference user activity, and integrate these findings with physical evidence and interrogation results. By maintaining meticulous records, the ET squad minimized reliance on foreign authorities while ensuring that evidence was prosecutable in the U.S., recognizing that host-nation cooperation could fluctuate and that witnesses or detainees might alter their accounts over time.
Interrogations of detainees were a central component of the investigation, providing critical insight into suspect roles, operational planning, and logistical networks. The ET squad leveraged High-Value Detainee Interrogation Group (HIG) augmentees to conduct sophisticated interviews, ensuring that all statements were gathered in a legally defensible and tactically sound manner. Through these interrogations, investigators obtained details about chemical procurement, the assembly and testing of explosives, and the internal organization of NTJ and its ISIS-aligned affiliates. These findings were cross-referenced with physical and digital evidence to build a comprehensive narrative of the attacks. The team carefully resisted the urge to conduct premature interrogations, understanding that detainees might be deceptive and that the immediate goal was to secure concrete, verifiable links between suspects and evidence before moving into detailed interviews.
Throughout the operation, the ET squad maintained a victim-centered approach, prioritizing support and communication with the families of those killed or injured. Five Americans lost their lives in the bombings, including two dual U.K. citizens, a U.S. commerce employee working officially in Sri Lanka, an American businessman, and an 11-year-old boy from the D.C. area. Agents personally contacted victims’ families, establishing lines of communication to provide reassurance and updates, emphasizing the FBI’s commitment to justice and care for the affected families. Particular attention was given to the mother of the young boy, who had lost her only child in the attack and faced immense personal hardship, including caring for a grandmother with dementia and coping with the death of the child’s father. This personal engagement extended beyond the immediate investigation, with regular calls and visits to ensure ongoing support, underscoring the human stakes behind the operational and investigative work. The lead agent carried a photograph of the child in his office as a daily reminder of why the mission mattered, reflecting a deeply personal commitment to victims that informed decision-making throughout the case.
Operational challenges were compounded by the complexity of the attack itself. The NTJ network, led by Mohammed Qasim Mohammed Zahran, had planned and executed coordinated bombings, including suicide attacks involving members of Zahran’s family. The confrontations with these operatives highlighted the extreme risk environment in which the ET squad and local authorities operated. Detailed evidence collection, from fingerprints and chemical procurement records to lease agreements and surveillance footage, allowed investigators to establish clear links between specific individuals and acts of terrorism. The agents employed a methodical, step-by-step approach to ensure that all evidence could withstand scrutiny in U.S. courts. This approach involved cross-verifying information across multiple sources, maintaining direct control over critical evidence, and leveraging local expertise while safeguarding prosecutorial integrity.
Coordination with international partners was essential. The first four weeks saw engagement with representatives from 45 countries affected by the attacks, including substantial teams from Australia, the United Kingdom, and other nations. Daily briefings provided updates on investigative progress, evidence processing, and detainee management, while fostering collaborative relationships that enhanced operational efficiency. The ET squad established leadership over these meetings, ensuring that all partners were informed, aligned, and able to contribute effectively. Cooperation with the Sri Lankan CID and its head, Ranjith, was particularly significant, providing access to local investigators, ensuring cultural and procedural context was respected, and creating a partnership that facilitated evidence collection and operational planning. This collaboration highlighted the importance of building trust in international counterterrorism efforts, especially in nations with limited experience in handling complex terrorist attacks.
Evidence collection was exhaustive and methodical. Safe houses, blast sites, and chemical suppliers were meticulously documented, with photographs, fingerprints, and physical evidence collected and cataloged. The investigation traced the procurement of explosives, including water gel dynamite, and mapped the operational network of NTJ. Direct interaction with local vendors, landlords, and intermediaries allowed investigators to secure receipts, ledgers, and other records that tied suspects to illegal activities. The agents’ approach emphasized minimizing reliance on host-nation testimony, instead documenting direct evidence that could be presented in U.S. courts. These efforts ensured that the criminal complaint was supported by verifiable facts, reducing vulnerabilities associated with witness unreliability or jurisdictional complications.
The process of interrogations, evidence collection, and digital analysis continued over months. After initial deployments, smaller teams returned to maintain continuity and pursue remaining investigative leads. Agents revisited blast sites, verified safe house contents, and conducted further interrogations to fill gaps in knowledge. These operations included detailed tracking of chemical purchases, revisiting suppliers, and confirming the distribution of materials used in bomb-making. Surveillance footage from hotels, combined with fingerprint analysis, allowed investigators to tie individual suspects to specific operational acts. Digital forensics complemented these efforts, documenting social media activity and other online communications to establish the ideological affiliations and operational behaviors of NTJ members. These cumulative efforts resulted in a comprehensive understanding of the network, its members, and their respective roles, creating a robust evidentiary framework for prosecution.
Throughout the investigation, the ET squad maintained an unwavering focus on legal defensibility, operational effectiveness, and victim advocacy. Evidence was collected, documented, and corroborated to ensure prosecutorial viability in U.S. courts. Coordination with the U.S. Attorney’s Office and ongoing communication with FBI headquarters ensured alignment between investigative activities and the legal standards required for criminal complaints. The team’s approach combined operational agility, strategic patience, and meticulous attention to detail, reflecting the rigorous standards necessary for international counterterrorism investigations. At the same time, the agents’ consistent engagement with victims’ families reinforced the human-centered philosophy that underpinned all actions, demonstrating the Bureau’s commitment to justice, accountability, and empathy.
The Sri Lanka Easter bombings case exemplifies the complexity, scale, and human impact of modern terrorist investigations. It required rapid mobilization across continents, careful coordination with multiple agencies and international partners, and exhaustive evidence collection under challenging operational conditions. The ET squad’s focus on hard evidence, supported by forensic, digital, and testimonial corroboration, ensured the creation of a legally defensible case capable of withstanding scrutiny in U.S. courts. Simultaneously, the investigators’ dedication to victim care and personal engagement with affected families highlighted the moral and ethical dimensions of counterterrorism work, emphasizing that behind every operational decision lies the responsibility to protect and support human life. The investigation reflects a holistic approach to modern terrorism response, combining tactical precision, strategic coordination, and empathetic engagement to achieve justice and maintain public trust.
