The court has imposed individual criminal liability for failing to prevent the Easter Sunday attacks. But two convictions cannot close a case defined by failures across intelligence, policing and political leadership.
By Kithmi Gunaratne
A court can convict two officials while the state still fails to account for itself.
On 31 July, a three-judge High Court Trial-at-Bar sentenced Sri Lanka’s former inspector general of police, Pujith Jayasundara, and former defence secretary, Hemasiri Fernando, to death over their failure to prevent the 2019 Easter Sunday bombings. More than 260 people were killed when suicide bombers struck three churches and three hotels. The judgment was delivered by a two-to-one majority, with one judge favouring acquittal. Both defendants may appeal.
For a country in which the senior office has too often appeared to offer protection from consequences, the judgment is momentous. It affirms an elementary principle of constitutional government: public power carries public duties, and officials entrusted with protecting life may be answerable for a culpable failure to act.
But Sri Lanka must resist the comforting fiction that two condemned officials can absorb the responsibility of an entire security establishment.
The attacks were not preceded by one unanswered letter or one negligent decision. They followed failures across the presidency, defence ministry, police, intelligence services and national security machinery. Intelligence was received but not converted into protection. Agencies failed to communicate. Political rivalry weakened decision-making. Responsibility became so fragmented that, when action was urgently required, nobody appeared to own it.
A criminal court may determine the liability of two defendants. Its judgment cannot amount to an institutional acquittal of the state.
The judicial history makes any claim of closure particularly difficult to sustain. In February 2022, an earlier three-judge Trial-at-Bar unanimously acquitted Fernando and Jayasundara after the prosecution closed its case, without requiring them to present a defence. That bench concluded that the prosecution’s evidence had not established the alleged offences sufficiently to call for a defence.
The attorney general appealed. In November 2024, a five-judge supreme court bench set aside the acquittal not because it had found Fernando and Jayasundara guilty, but because it held that the Trial-at-Bar had erred in ending proceedings without hearing their defence. The supreme court ordered the trial to resume and the defence evidence to be recorded.
A differently constituted three-judge Trial-at-Bar then completed the case and divided two to one: two judges convicted the defendants and imposed the death penalty; one concluded that the prosecution had not proved its case beyond reasonable doubt.
Across the two High Court benches that directly considered their criminal liability, four of six judges favoured acquittal and two favoured conviction.
That arithmetic is not itself a legal verdict. The first acquittal was set aside for an error of law, and the later majority judgment is now the operative decision. But the history demonstrates profound judicial disagreement over whether the prosecution established criminal guilt.
Judicial disagreement does not prove innocence. It does, however, make an irreversible sentence exceptionally difficult to defend. A case in which one bench unanimously acquitted, the supreme court intervened without determining guilt, and a later bench convicted only by majority is precisely the kind of case in which capital punishment should inspire unease rather than satisfaction.
Criminal liability must be individualised. Prosecutors must prove beyond reasonable doubt that each defendant had a legal duty to act, possessed the capacity to intervene, committed a culpable omission and bore the necessary connection to the resulting deaths. No official should be convicted merely because of rank, association or public anger.
But criminal responsibility is only one layer of accountability. Constitutional liability, professional misconduct, political responsibility and institutional failure are governed by different legal standards. They may coexist without being confused.
Sri Lanka’s supreme court recognised this in its 2023 fundamental-rights judgment. It held the former president and senior defence, police and intelligence officials responsible for failing to act on advance intelligence and ordered personal compensation to victims. The court described a fundamental-rights violation caused by state action or inaction as a “constitutional tort” : a public-law wrong for which both officials and the state may be held accountable.
The parliamentary select committee investigating the attacks reached an equally disturbing conclusion. It found that the director of the State Intelligence Service bore the greatest responsibility within the intelligence apparatus. But it also identified failures by the defence secretary, police chief, chief of national intelligence and director of military intelligence, all of whom had received information before the attacks. It criticised the former president’s leadership, irregular national security council meetings and failures involving other political and public institutions.
These findings do not make every person criticised by an inquiry criminally guilty. A parliamentary committee does not apply the criminal standard of proof. Nor should the phrase “systemic failure” become a device through which identifiable officials dissolve their own conduct into an abstract bureaucracy.
The more difficult truth is this: criminal guilt is personal, but institutional responsibility can be distributed across an entire system.
That is why forwarding an intelligence warning cannot automatically discharge a senior official’s duty.
Government necessarily operates through delegation. A police chief cannot personally guard every church, conduct every surveillance operation or make every arrest. But delegating a task does not eliminate the duty to supervise its execution.
When intelligence warns of possible suicide attacks against places of worship, the words “for necessary action” written on a document do not constitute an operational response.
Were provincial commanders informed? Were churches and hotels warned? Were suspected extremists placed under surveillance? Were protective deployments ordered? Did officers receiving instructions report back? Was the political leadership urgently briefed?
If nobody asked those questions, the warning was not acted upon. It was merely circulated.
The same principle applies farther down the chain of command. An officer who receives credible intelligence, possesses lawful authority and fails to act cannot hide behind the seniority of those above. Supervisory failure does not erase operational failure; operational failure does not absolve senior command.
Accountability must therefore follow the warning through the whole system: who knew, when they knew, what authority they possessed, what they did and who verified that action had been taken.
Other countries confronting catastrophic security failures have generally combined investigation and individual accountability with institutional reconstruction.
After the attacks of 11 September 2001, the United States established a bipartisan commission and created the office of the director of national intelligence and the National Counterterrorism Center. The latter was given responsibility for integrating and sharing terrorism intelligence and supporting strategic operational planning across government. The reforms were imperfect, but they addressed a central institutional failure: critical information had remained divided among agencies without sufficient coordination or ownership.
After the Manchester Arena bombing, Britain held a statutory public inquiry that examined missed intelligence opportunities, information-sharing and security at the venue. It later enacted Martyn’s Law, requiring qualifying premises and events to consider how they would respond to terrorist attacks and, for larger venues, how they could reduce their vulnerability.
Norway established an independent commission after the attacks of 22 July 2011. It examined policing, emergency preparedness, leadership and coordination, asking not only who had failed but how the state’s structures had allowed those failures to become catastrophic. Its recommendations were subsequently incorporated into broader reforms and counter-terrorism planning.
None of these responses eliminated the threat of terrorism. Nor should commissions and reforms become substitutes for individual accountability. But each recognised the same principle:
punishment addresses individual wrongdoing; reform addresses the conditions that allowed failure to become catastrophe.
Sri Lanka already knows much of what must change. Its parliamentary inquiry recommended an independent and strengthened national security council, supported by a permanent secretariat and a national security adviser. It called for clear responsibilities, regular coordination, follow-up on decisions, stronger communication among intelligence and law-enforcement agencies and effective parliamentary oversight.
Those recommendations must no longer remain buried in an official report.
Every serious intelligence warning should receive a threat classification, a named operational owner and a deadline. Recipients should be required to acknowledge it, record the measures taken and escalate it where necessary. Senior officials should receive confirmation that protective action has actually been implemented.
The administrative record must answer four questions: who received the warning, who owned the response, what action followed and who verified it?
A warning should not be considered dealt with merely because it has been forwarded. The chain must close only when assessment, action and verification have been completed.
Sri Lanka also needs permanent coordination among intelligence agencies, police, the military, prosecutors and relevant civilian authorities. National security cannot depend on personal relationships, selective invitations to meetings or whether the president and prime minister happen to cooperate.
A security-cleared parliamentary body should scrutinise intelligence coordination and determine whether recommendations made after the attacks have been implemented. An independent expert body should be empowered to examine the legal and administrative framework, institutional capacity and persistent gaps. Oversight does not weaken national security. It prevents secrecy from becoming a shelter for incompetence.
Clear procedures are also required for warning vulnerable institutions. When intelligence reaches an established threshold, local police, religious leaders, hotels, schools and public venues must know what protective measures to take. Regular exercises should test whether information received in Colombo can reach the police officer, priest, hotel manager or local official capable of protecting people on the ground.
Intelligence that never reaches those able to act is not preventive intelligence. It is merely advance documentation of a future tragedy.
The death sentences risk obscuring this larger obligation. Sri Lanka has not carried out an execution since 1976, but a moratorium is not abolition. International human-rights standards restrict capital punishment, where it remains legal, to the most serious crimes involving intentional killing, making its use in a case centred on omissions especially troubling.
Capital punishment also offers the illusion of finality: the court condemns two officials, public anger is answered and the political system is permitted to move on.
It must not.
If the convictions survive appellate scrutiny, serious imprisonment may be justified. But the severity of the punishment cannot substitute for examining the wider chain of responsibility or repairing the institutions that failed.
The families of the victims deserve more than two convictions. They deserve the fullest possible truth about every institutional failure, continued investigation of any wider planners or facilitators, and evidence that the state has rebuilt the machinery intended to protect its citizens. Separate trials involving alleged associates continue, while Catholic Church leaders maintain that the ultimate masterminds have not yet been identified.
Fernando and Jayasundara cannot escape accountability merely by arguing that intelligence was passed down. But those beneath, beside and above them cannot escape scrutiny merely because the court has convicted two senior officials.
The judiciary can adjudicate criminal guilt. It cannot reorganise intelligence services, repair political coordination or ensure that future warnings produce action. Those obligations belong to the government, parliament and institutions of the state.
Sri Lanka does not need two officials to carry the failures of an entire system. It needs a system in which authority is defined, intelligence is shared, responsibility is traceable and failure is detected before citizens are buried.
A court can punish individual failures of the past. Only the state can prevent their repetition.
