Police were investigating suspected sympathizers of the withered caliphate in southern India when a name they had no record of surfaced — National Towheed Jamaat, the Sri Lankan IS-backed militant organization that authorities say conducted the coordinated Easter Sunday attacks on churches and hotels in Sri Lanka that killed more than 250 people.
Indian police managed to break into the group's communications and began tapping into the plot, according to Ajai Sahni, executive director of the Institute for Conflict Management in New Delhi.
"That is why the kind of detailing of the incident they received was very, very specific," Sahni said. "They knew the group, they knew the targets, they knew the time, they knew the whereabouts of the suicide bombers, and all of this was communicated to the Sri Lankan government."
Top Sri Lankan officials have acknowledged that some of the island nation's intelligence units were given advance notice about the attacks — starting weeks ago and up until the morning of the bombings — but that little was done to prevent them.
Both President Maithripala Sirisena, who is also Sri Lanka's minister of defense and in charge of national police, and Prime Minister Ranil Wickremesinghe, who has been kept out of high-level security meetings since Sirisena tried to oust him last fall, said they only learned about the plot after it had been carried out.
"The fact is, it's very, very specific information and that has been conveyed to everyone in writing. That is the action that was missing in some cases. That's what we're investigating," Wickremesinghe said.
The first intelligence brief from India arrived April 4, more than two weeks before the bombings. It said a suicide terrorist attack was planned against "some important churches" and listed six people likely to be involved.
The deputy inspector of police shared the report with at least four security unit directors, including those responsible for "VIPs" and foreign embassies, along with a memo, urging the directors to pay extra attention to the places and people in their care.
India's final intelligence warning came just before the Easter morning blasts, Sahni said.
Why the warnings went unheeded is the subject of intense public debate, with some blaming the dismantling of a system built by former strongman President Mahinda Rajapaksa for rapid response to rebel activity during Sri Lanka's long civil war.
For 26 years, the Tamil Tigers militants from Sri Lanka's minority Tamil ethnic community fought for independence from the Buddhist, ethnically Sinhalese-majority state. Military forces under Rajapaksa's brother, then-Secretary of Defense Gotabhaya Rajapaksa, brutally crushed them in 2009.
The current state minister of defense, Ruwan Wijewardene, said "weakness" within Sri Lanka's security apparatus led to the failure to prevent the Easter bombings.
Sirisena, while campaigning for the 2015 election to defeat Rajapaksa, had stressed the need for fresh investigations of military officials, including intelligence officers accused of abducting and killing civilians, political opponents and journalists during the civil war.
Since then, some military officials have been arrested on charges related to their actions during the war and remanded in detention facilities. Court cases are ongoing.
But on Friday, Sirisena, perhaps with an eye toward the 2020 election, said that arresting military intelligence officials after the civil war had weakened national security. He promised a shake-up, asking for the resignations of both his secretary of defense and inspector general of police.
Some experts believe Sri Lankan security forces may not have given much credence to Indian intelligence because of its controversial role in the civil war.
India's Research and Analysis Wing, or RAW, the country's external intelligence group, initially supported Tamil separatists, training and arming the Liberation Tigers of Tamil Eelman in the 1970s. But after the group's terrorist activities in the 1980s, RAW withdrew its support.
New Delhi made a pact with Colombo in 1987 to send peacekeeping forces to the island on its southern tip, and they ended up fighting the rebels. They were asked to withdraw a few years later amid allegations of abuses against Tamils. In 1991, Indian Prime Minister Rajiv Gandhi was assassinated by a Tamil Tiger suicide bomber.
India questioned Sri Lanka's heavy-handed approach to defeating the Tigers in the final months of the war, when tens of thousands of civilians were reportedly killed by government troops. Thousands more are still missing. Ethnic minority Tamils in the country's north and east are still reeling from the effects of the war.
Indian security and intelligence agencies lost some of their "moral authority" with the Sri Lankans, said M.K. Narayanan, the former head of India's external intelligence service.
"What really happened was India lost moral authority. India did not accept the policies that were being followed, so they lost a lot of support in Sri Lanka," he said.
Genealogical and cultural ties between Sri Lanka and India date back thousands of years. According to folklore, the island's majority Sinhalese are descendants of an Indian prince banished there 2,000 years ago.
The nation's minority Tamils, meanwhile, are in part the descendants of more than a million tea and rubber plantation workers brought to Sri Lanka from southern India by British colonial rulers in the 18th and 19th centuries.
And India shares intelligence with its neighbors in part to keep them within its sphere of influence, Narayanan said.
Located just 23 kilometers (14 miles) off its southeast coast, India sees Sri Lanka as a bulwark in its military defenses to ward off potential Chinese incursions. Soon after the Easter attacks, India deployed naval and coast guard ships along the narrow Palk Strait.