In the weeks and days leading up to the attacks, Delhi provided unusually specific information, the Sri Lankan authorities said, and at least part of the information was derived from material obtained during the interrogation of an ISIS suspect arrested in India, an Indian representative said CNN.
The suspect gave the investigators the name of a man he had trained in Sri Lanka, who is linked to a local extremist group involved in the bombings. The man, Zahran Hashim, was identified in a video of the alleged assailants who released ISIS on Tuesday and took responsibility for the murders on Easter Sunday.
In a statement released by ISIS News Agency Amaq, the group said the attackers were "fighters of the Islamic state".
The involvement of a foreign organization would explain how a previously marginally domestic extremist group blamed for the attacks could have ruled out National Tawheed Jamath (NTJ), one of the worst terrorist atrocities since 9/11.
The number of victims could have been even higher. Authorities said on Tuesday that a fourth hotel was one of the original targets, but the attack on that location failed. Officials said they found an unexploded pipe bomb near Colombo International Airport.
As the investigators sought to track down the bombers' allies, anger grew in Sri Lanka because the warnings of the Indian secret service were ignored.
The first warning came more than two weeks before the attacks. Officials in Sri Lanka were reported on 4 April by a possible attack on suicide attacks against Christian churches and tourist attractions, said government spokesman Rajitha Senaratne on Monday to reporters. The warnings were repeated two days and two hours before the attacks, Senaratne said.
The information from Delhi came from the questioning of an ISIS suspect, the Indian source told CNN. "While we were investigating ISIS cases, while interrogating a defendant, he revealed the name of a man, Zahran Hashim, who is one of the suicide bombers and associated with NTJ," India's intelligence agency said. "The suspect said he played a role in his radicalization (Hashim)."
The Indian intelligence agency did not state when the arrest took place. "Indian intelligence agencies shared their information with their colleagues in Sri Lanka," the source said.
The name of Hashim appears on a memo dated April 11, signed by the Deputy Inspector General of Sri Lanka Police. The memo from which CNN has seen a copy called Hashim the leader of the NTJ.
"A special foreign intelligence service has reported that National Tawheed Jamath – NTJ leader Mohamed Cassim Mohamed Zahran, also known as Zahran Hashim and his followers, has planned suicide attacks in Sri Lanka," the memo said. It has been widely distributed to a number of security services and some ministries.
On Tuesday, a video released by ISIS showed that eight men were allegedly the Sri Lankan invaders who pledged allegiance to the terrorist group. All men have their hands together and are masked except for a mask. This man, referred to as Zahran Hashim, "leads them," reads the caption provided by the Amaq news agency.
A senior Sri Lankan official confirmed that the man exposed in the photo was Hashim. "Zahran is the mastermind of these attacks, he's the one," said Azath Salley, governor of the Western Province of Sri Lanka. "He's the guy who teaches them the ideology, and when he talks to people, they get convinced," Salley said in an interview with CNN.
At a press conference on Tuesday, Prime Minister Ranil Wickremesinghe also identified Hashim as part of the plot. "He is expected to be one of the suicide bombers," he said.
In a conversation with CNN in Colombo on Tuesday, a senior police official said the NTJ had been known to the Sri Lankan authorities for at least two years.
He said the group had emerged in the eastern province of Sri Lanka and associated with the destruction of Buddhist statues. He said there was evidence that the group was growing in size and extremism and estimated that there are currently about 100 to 150 members in the country.
The former official said that failure to provide information about the group's plans was "criminally negligent". Specific warnings of the type Sri Lanka received are "very rare", so the failure to respond or disseminate it is even more inexplicable.
The investigation is gaining pace
Sri Lankan officials said they had arrested dozens of suspects in the last two days. However, they admitted that some were still at large. At his press conference in Colombo, Prime Minister Wickremesinghe told reporters that "there are still people fleeing with explosives".
Wickremesinghe said the investigators made "good progress" in the investigation, "but they have to identify all guilty parties and see what their network is."
He admitted that the attacks could have been prevented if the information had been properly exchanged. "If it were known, we would certainly have prevented many of the attacks in the churches and would have more security in the hotels," said Wickremesinghe.
Sri Lanka has been affected by political turmoil since the president tried to depose the prime minister last year. The Supreme Court intervened and Wickremesinghe was reinstated, but deep divisions remained. The ministers accused the president, who is also the country's defense minister, of not having shared the intelligence services before the attacks.
Wickremesinghe said on Tuesday that the differences between him and the president had been "eradicated" and that it was now paramount to catch all remaining suspects.
President Maithripala Sirisena said he did not know the alerts, and if he had, he would have taken appropriate action. "I have to mention explicitly that this information was not forwarded to me by the responsible persons," he said in a televised address. "If I had known that they had received this information, I could have acted accordingly.
Nine people appeared in court after being arrested on suspicion of providing material for the bombs on Sunday. The nine people were arrested on Monday in Wellampitya, a northeastern suburb of Colombo. They all worked in a copper factory in the area, according to a source from the Colombo district court, which comes from a source. They will be back in court on 6 May.
James Griffiths reported from Colombo, Sri Lanka. Swati Gupta reported from New Delhi, India. CNhils Nikhil Kumar and the journalist Iqbal Athas have reported from Colombo. CNN expert Steve George contributed to the coverage from Hong Kong.