Colombo, Sri Lanka(CNN) Early warnings from India's intelligence services to Sri Lankan officials ahead of the Easter Sunday bombings were based on information gleaned from an ISIS suspect, CNN has learned.
Delhi passed on unusually specific intelligence in the weeks and days leading up to the attacks, Sri Lankan officials have said, and at least some of it came from material obtained during interrogations of an ISIS suspect arrested in India, an Indian official told CNN.
The suspect gave investigators the name of a man he had trained, who is associated with a Sri Lankan extremist group implicated in the bombings, the source said. The man, Zahran Hashim, was identified in a video of the purported attackers released Tuesday by ISIS, which claimed responsibility for the Easter Sunday killings.
In a statement published by the ISIS-affiliated news agency Amaq, the group said the attackers were "fighters of the Islamic State."
The involvement of a foreign organization would explain how a previously marginal domestic extremist group blamed for the attacks, National Tawheed Jamath (NTJ), could have pulled off one of the worst terrorist atrocities since 9/11.
The number of casualties could have been even higher. Authorities said Tuesday that a fourth hotel was among the original targets, but the attack at that location failed. Officials previously said they found an unexploded pipe bomb near Colombo's international airport.
Four days after the coordinated attacks, the Sri Lankan Health Ministry revised the death toll, saying 253 people had died. That toll is significantly lower than the 359 initially reported to CNN by a Colombo police spokesman this week. The health ministry cited the condition of remains and the difficulty in identifying them for the discrepancy.
As investigators scrambled to track down the bombers' associates, there was growing anger in Sri Lanka at the failure to heed the warnings of India's intelligence service.
The first warning came more than two weeks before the attacks. Sri Lankan officials were told on April 4 of a potential plot to launch suicide attacks against Christian churches and tourist spots, government spokesman Rajitha Senaratne told reporters on Monday. The warnings were repeated two days and two hours before the attacks, Senaratne said.
Delhi's information came from the interrogation of an ISIS suspect, the Indian source told CNN. "While we were investigating ISIS cases, during the interrogation of an accused, he disclosed the name of a man, Zahran Hashim, who is one of the suicide bombers and is associated with NTJ," said the intelligence source in India. "The suspect said that he played a role in his (Hashim's) radicalization."
The Indian intelligence source did not specify when the arrest was made. "Indian intelligence agencies shared their information with their counterparts in Sri Lanka," the source said.
Hashim's name appears on a memo dated April 11 and signed by Sri Lanka's Deputy Inspector General of Police. The memo, a copy of which has been seen by CNN, named Hashim as the leader of the NTJ.
"A certain foreign intelligence service has reported that the leader of the National Tawheed Jamath -- NTJ, Mohamed Cassim Mohamed Zahran, also known as Zahran Hashim and his followers -- have been planning for suicide attacks within Sri Lanka," the memo reads. It was circulated widely to a range of security services and some government ministries.
On Tuesday, a video released by ISIS showed eight men purported to be the Sri Lankan attackers pledging allegiance to the terror group. All of the men have their hands placed together and are masked, except one. That man, identified as Zahran Hashim, is "leading them," according to the caption provided by the Amaq news agency.
A senior Sri Lankan official confirmed the unmasked man in the photograph was Hashim. "Zahran is the mastermind of these attacks. He is the one," said Azath Salley, governor of Sri Lanka's Western Province. "He is the guy who is giving them the ideology and when he talks to people they get convinced," Salley said in an interview with CNN.
In a press conference, Prime Minister Ranil Wickremesinghe also identified Hashim as part of the plot. "He is expected to be one of the suicide bombers," he said.
Speaking to CNN in Colombo, a former senior police official said the NTJ was known to Sri Lankan authorities for at least two years.
He said the group emerged in the Eastern Province of Sri Lanka, and was linked to the vandalizing of Buddhist statues. He said there were indications that the group was growing in size and extremism, and estimated that there are about 100 to 150 members currently in the country.
The former official said the failure to act on intelligence received about the group's plans was "criminally negligent." Specific warnings of the type received by Sri Lanka were "very rare," he said, making the failure to act upon them or spread them more widely even more inexplicable.
Sri Lankan officials said they had arrested dozens of suspects in the past two days. But they admitted that some were still at large. At his news conference in Colombo, Prime Minister Wickremesinghe told reporters that there are "still people on the run with explosives."
Wickremesinghe said investigators were making "good progress" in the investigation "but they need to identify all the culprits and look at what their network is."
He admitted that the attacks could have been prevented, if intelligence had been properly shared. "We, if it was known, certainly could have prevented many of the attacks in the churches and have (had) more security in the hotels," Wickremesinghe said.
Sri Lanka has been gripped by political turmoil since the President tried to remove the Prime Minister last year. The Supreme Court intervened and Wickremesinghe was reinstated, but deep divisions had remained. Ministers have accused the President, who is also the country's Defense Minister, of failing to share the intelligence ahead of the attacks.
Wickremesinghe said Tuesday that differences between him and the president had been "thrashed out" and that the priority was now to catch any remaining suspects.
President Maithripala Sirisena said he wasn't aware of the advance warnings, and that if he had been, he could have taken the appropriate measures. "I have to specifically mention that that intelligence was not reported to me by the responsible people," he said in a televised address. "If I had known they had received this intelligence, I could have taken actions accordingly.
Nine people appeared in court after being arrested on suspicion of providing materials used in Sunday's bombs. The nine were arrested in Wellampitya, a northeastern suburb of Colombo, on Monday. They all worked at a copper factory in the area, according to court papers seen by a source at Colombo Magistrates' Court. They are due back in court on May 6.
This article has been updated to reflect that the Indian ISIS source did not specify where he had trained his Sri Lankan associate.
Update: This story has been updated to reflect the death toll has been revised by the Sri Lankan Health Ministry.