Understanding the Terror Attacks in Sri Lanka

A decade ago, an RMS colleague traveling to Bali for a climate change conference sought my advice on where to stay to minimize the risk of falling victim to terrorism. In 2002, some 204 people had been killed in a bomb attack by Islamist militants in Kuta Beach, a busy tourist area in Bali. My advice then, as it is now, was to stay away from luxury hotels. Not just for tourists, but for insurers also, the risk to luxury hotels is far higher than for lesser accommodation.

The basic principles of terrorism risk modeling explain the terrorist preference for luxury hotels and places of worship, both of which were targeted in a coordinated terrorist attack in Sri Lanka on Easter Sunday (April 21), which with a current death toll of 290, has nearly killed half as many more people than the Bali bombing.

• First, terrorists follow the path of least resistance in their operations. Hotels and places of worship are establishments open to the public, welcoming of visitors, and typically have minimal security.
• Secondly, terrorist attacks leverage maximum impact. For the same allocation of terrorist resources, the impact is greater if a luxury hotel, with international name recognition, is targeted.
• Thirdly, terrorism is the language of being noticed. Global media publicity is magnified by an attack on Easter Sunday.
• Fourthly, a suicide bomber can only die once. A terrorist with only a single attack opportunity has to choose an optimal target.

For Mohamed Azzam Mohamed, who checked in at the Cinnamon Grand Hotel, Colombo, on Easter Saturday (April 20), the packed restaurant on one of the busiest days of the year, and at the peak time of 8.30 a.m., was the optimal target for his suicide bombing. Half an hour later, the restaurant at the nearby Shangri-La Hotel was bombed. A third local five-star hotel, the Kingsbury Colombo, was likewise targeted.

The modus operandi of this coordinated multiple attack points to meticulous Islamist organization and planning. This evidence is strengthened further by the fact that suicide bombers struck three Catholic churches, including St. Anthony’s Shrine, the largest and best-known Christian church in Colombo. Indeed, a security advisory had been issued in early April that there was a threat to churches from a local radical Islamist Group, National Thowheeth Jama’ath.

This intelligence came from a Western source, almost certainly from the Five Eyes Alliance. Within this tight-knit Anglophone community of the U.S., U.K., Canada, Australia and New Zealand, the Sri Lankan coordinated attack most likely would have been interdicted because of broad electronic surveillance of terrorist networks: too many terrorists spoil the plot.

Islamist militants have a global agenda. Targets are substitutable. On Easter Sunday, Christendom is united worldwide. Reverting to the first principle above, if a coordinated attack on the Five Eyes Alliance is too difficult, terrorists will follow the path of least resistance and attack elsewhere. On Easter Sunday it was Sri Lanka. International terrorism underwriters may ponder which country will be next.