When a series of suicide bombs tore apart churches and hotels across Sri Lanka on Easter Sunday, most of the country -- and the rest of the world -- was taken completely by surprise. But in the capital, Colombo, it was not a shock to everyone.
Some elements of the government had known for weeks about warnings of a potential attack on churches and tourist destinations.
Intelligence services in India and the US told Sri Lanka of the threat in early April, officials said. One of the warnings was so specific that it even gave a list of suspects. In the runup to the most holy day in the Christian calendar, the warnings seemed to increase in frequency and urgency.
But none made any difference.
When suicide bombers walked into three churches around Sri Lanka, and three upscale hotels in Colombo, none faced enhanced security. As worshipers closed their eyes in prayer, and as hotel guests lined up for breakfast, the attackers detonated their devices -- and the effects were devastating.
It was unclear on Monday why the red flags went unheeded. But Sri Lanka has been wracked by political divisions since a constitutional crisis last year, when President Maithripala Sirisena attempted to replace the incumbent Prime Minister, Ranil Wickremesinghe, with a favored candidate. Wickremesinghe was reinstated in December but the government remains deeply divided.
Now, there are fears that the political feuding could have provided a window for a catastrophic security failure that could reverberate across the region.
Series of warnings
The origins of what appears to be a spectacular security failure go back more than two weeks. On April 4, according to government spokesman Rajitha Senaratne, foreign international intelligence agencies told Sri Lankan officials of a potential plot to launch suicide attacks against Christian churches and tourist spots.
Five days later, on April 9, the country's Defense Ministry informed the Inspector General of Police of this alleged plot, and named a group believed to be behind the plan, the Nations Thawahid Jaman (NTJ). Unusually, the memo also included a list of suspects.
On April 11, another memo, signed by Priyalal Dissanayake, the Deputy Inspector General of Police, was circulated widely to a range of security services and some government ministries, according to Senaratne and a police source. That memo, a copy of which has been seen by CNN, laid out the threat and again contained a list of suspects.
Foreign security services repeated their warnings in the days and hours before the attack, Senaratne said. One warning came ten minutes before, he claimed -- although it was not clear whether he was speaking with precision.
Harsha de Silva, an economy minister, told CNN's Christiane Amanpour that international warnings that "something terrible was to happen" came from the US and neighboring India.
Government infighting
All of this came against the backdrop of the divisions within government. In his interview with CNN, De Silva said the Prime Minister was "kept in the dark" about the warnings.
Senaratne, who is also a health minister, said the Prime Minister had been removed from the national security council in December.
Even after the attack, members of the national security council refused to attend a meeting called by the Prime Minister, Senaratne claimed. "I think this is the only country in the world where the security council does not like to come when summoned by the Prime Minister of the country," he said.
Referring to the warnings about the involvement of the NTJ in a potential attack, Senaratne said he did not believe a local group could have acted alone. "There must be a wider international network behind it," he told reporters.
In a statement, reported by Reuters, President Sirisena said the Sri Lankan government would seek would seek foreign assistance as it investigated potential international links to the attack. His office would not comment on the apparent failure to heed warnings, Reuters said.
De Silva, an ally of the Prime Minister, argued the Sunday's terrible loss of life did not amount to a failure of intelligence, but a failure to mount an appropriate response to the intelligence.
Focus on Islamist group
The group named in the memos as planning an attack on churches and tourists spots, Nations Thawahid Jaman, has hitherto acted only in the margins, blamed for little more than defacing Buddhist statues.
According to Saroj Kumar Rath, a terrorism and security expert at the University of Delhi, NTJ has its origins in the South Indian state of Tamil Nadu in the early 2000s.
Manoj Joshi, a fellow at Indian think tank Observer Research Foundation, said that NTJ had carried out protests at places like liquor stores in the past, but he wasn't aware that it had initiated any previous terror attacks.
There are numerous small groups like the NTJ around India and South Asia, Joshi said. "The problem was that this group did not have a history of any kind (of violence) in the past. They (the authorities) may have been blindsided by the lack of focus on this group," Joshi said, noting that that while Sri Lanka was no stranger to terrorist attacks, violence there has historically existed under a very different context.
Mainstream Muslim groups have said they tried to warn the Sri Lankan authorities about the potential danger posed by NTJ. But its relative obscurity has raised questions about whether it would have had the capacity to carry out such a sophisticated and coordinated attack alone.
Dhruva Jaishankar, a fellow in Foreign Policy Studies at Brookings India, told CNN that while it was "premature" to speculate on which organizations might have been involved, the role of "a larger organization cannot be dismissed."
"It's a bit of a stretch for an organization like that to conduct sophisticated simultaneous explosions," he said.
Jaishankar said there was a known presence of ISIS-linked groups in neighboring India, the Maldives, and Bangladesh -- as well as Pakistan and the Philippines -- but that there was little evidence of ISIS activity in Sri Lanka.
What seems clear, Jaishankar said, is that the assault had a religious motivation and was also designed to target foreigners. "These are people who wanted to hurt Sri Lanka's reputation," he said.
The coordination and planning of Sunday's attacks -- involving multiple high profile targets, suicide bombers and powerful bombs -- appears to have been intense, and must have been long in the works.
Sri Lankan authorities have already admitted to missing multiple warning signs. Now a nation still reeling in horror from Sunday's bloodshed is waiting to see just how widespread the failure was, and how much the country's disfunctional politics played a role in it.