But the president asked for foreign assistance to track down the bombers’ international links on Monday, because of intelligence reports “indicating that foreign terrorist organisations are behind the local terrorists”.
The targeting of churches and hotels popular with foreign tourists is a technique recently used by Isis and al-Qaeda affiliates.
Security analysts questioned whether an attack of such complexity, seeing multiple perpetrators strike targets in different parts of the country almost simultaneously – with at least nine bombs – could be prepared in little over a month.
Ruwan Wijewardene did not explain the source of the information but blamed “weakness” within Sri Lanka’s security apparatus for failing to prevent the bombings.
“By now it has been established that the intelligence units were aware of this attack and a group of responsible people were informed about the impending attack,” he added after a letter warning security services was leaked online. “However, this information has been circulated among only a few officials.”
“The scenes of death in the two mosques are enough to wake the sleep and incite the supporters of the caliphate who live there, to take vengeance for their religion and for sons of their Ummah, who are killed everywhere in the world,” it said.
Experts had warned that the Christchurch massacre could be used for “reciprocal radicalisation”, which sees Islamists justify their attacks using Western air strikes and far-right atrocities, and the far-right justify their attacks using Islamist terrorism.
At the time, security services said they feared a “domino effect” in atrocities as Isis sought publicity and momentum following the destruction of its caliphate.
Sri Lankan militants were among the foreigners who travelled to fight for the group in Iraq and Syria.
National Thowheed Jama’ath’s leader, known as Mohammed Zahran or Zahran Hashmi, became known three years ago for incendiary speeches posted online that called for non-Muslims to be eliminated.
Weeks before the attacks, National Thowheed Jama’ath was named in a police advisory to security services warning of a potential threat to Catholic churches.
Telecommunications minister Harin Fernando posted images of the letter, entitled “information on an alleged plan attack” and detailing names and other details, on Twitter.
Zahran was personally named in the warning and some international security experts said they had been asked about the group’s activity.
Anne Speckhard, director of the International Center for the Study of Violent Extremism, said a Sri Lankan intelligence official approached her at a February conference with concerns about a violent, homegrown jihadi group.
Ms Speckhard said the official feared militants that “would just disappear” when the government tried to crack down on them.
“The intel person kind of came up to me and said, ‘You know, we’re kind of worried about this new group and there’s some activity going. What do you think?'” Speckhard told the Associated Press. “It just kind of blows my mind that’s who it was.”
While Sri Lanka is no stranger to sectarian violence, following a 25-year civil war with Tamil separatists that raged until 2009, Islamists have previously been considered a lesser threat than other groups.
Amarnath Amarasingam, a senior research fellow with the Institute for Strategic Dialogue, pointed out that recent new year celebrations and Buddhist religious events passed off safely.
“If this were local Muslim extremist groups who wanted to retaliate against anti-Muslim attacks by Buddhists, I think the targeting would have been a bit different,” he wrote on Twitter.
A total of nine bombings on Sunday killed at least 321 people and injured more than 500.
Sri Lankan officials said two people were involved in the attack at the Shangri-La hotel.
One bomber each attacked the Cinnamon Grand and Kingsbury hotels, and St Anthony’s Shrine in Colombo, St Sebastian’s church in the city of Negombo and Zion Church in the city of Batticaloa.
Two bombings hours later at a guesthouse and near an overpass on the outskirts of Colombo are still under investigation.
Suspects detonated explosives at a safe house near the overpass blast as police closed in, killing three officers.