Features
The Lazarus heist: How North Korea almost pulled off a billion-dollar hack
In 2016 North Korean hackers planned a $1bn raid on Bangladesh’s national bank and came within an inch of success – it was only by a fluke that all but $81m of the transfers were halted, report Geoff White and Jean H Lee. But how did one of the world’s poorest and most isolated countries train a team of elite cyber-criminals?
It all started with a malfunctioning printer. It’s just part of modern life, and so when it happened to staff at Bangladesh Bank they thought the same thing most of us do: another day, another tech headache. It didn’t seem like a big deal.
But this wasn’t just any printer, and it wasn’t just any bank.
Bangladesh Bank is the country’s central bank, responsible for overseeing the precious currency reserves of a country where millions live in poverty.
And the printer played a pivotal role. It was located inside a highly secure room on the 10th floor of the bank’s main office in Dhaka, the capital. Its job was to print out records of the multi-million-dollar transfers flowing in and out of the bank.
When staff found it wasn’t working, at 08:45 on Friday 5 February 2016, “we assumed it was a common problem just like any other day,” duty manager Zubair Bin Huda later told police. “Such glitches had happened before.”
In fact, this was the first indication that Bangladesh Bank was in a lot of trouble. Hackers had broken into its computer networks, and at that very moment were carrying out the most audacious cyber-attack ever attempted. Their goal: to steal a billion dollars.
To spirit the money away, the gang behind the heist would use fake bank accounts, charities, casinos and a wide network of accomplices.
But who were these hackers and where were they from?
According to investigators the digital fingerprints point in just one direction: to the government of North Korea.
SPOILER ALERT: This is the story told in the 10-episode BBC World Service podcast, The Lazarus Heist.
That North Korea would be the prime suspect in a case of cyber-crime might to some be a surprise. It’s one of the world’s poorest countries, and largely disconnected from the global community – technologically, economically, and in almost every other way.
And yet, according to the FBI, the audacious Bangladesh Bank hack was the culmination of years of methodical preparation by a shadowy team of hackers and middlemen across Asia, operating with the support of the North Korean regime.
In the cyber-security industry the North Korean hackers are known as the Lazarus Group, a reference to a biblical figure who came back from the dead; experts who tackled the group’s computer viruses found they were equally resilient.
Little is known about the group, though the FBI has painted a detailed portrait of one suspect: Park Jin-hyok, who also has gone by the names Pak Jin-hek and Park Kwang-jin.
It describes him as a computer programmer who graduated from one of the country’s top universities and went to work for a North Korean company, Chosun Expo, in the Chinese port city of Dalian, creating online gaming and gambling programs for clients around the world.
While in Dalian, he set up an email address, created a CV, and used social media to build a network of contacts. Cyber-footprints put him in Dalian as early as 2002 and off and on until 2
013 or 2014, when his internet activity appears to come from the North Korean capital, Pyongyang, according to an FBI investigator’s affidavit.
The agency has released a photo plucked from a 2011 email sent by a Chosun Expo manager introducing Park to an outside client. It shows a clean-cut Korean man in his late 20s or early 30s, dressed in a pin-striped black shirt and chocolate-brown suit. Nothing out of the ordinary, at first glance, apart from a drained look on his face.
But the FBI says that while he worked as a programmer by day, he was a hacker by night.
In June 2018, US authorities charged Park with one count of conspiracy to commit computer fraud and abuse, and one count of conspiracy to commit wire fraud (fraud involving mail, or electronic communication) between September 2014 and August 2017. He faces up to 20 years in prison if he is ever tracked down. (He returned from China to North Korea four years before the charges were filed.)
But Park, if that is his real name, didn’t become a hacker for the state overnight. He is one of thousands of young North Koreans who have been cultivated from childhood to become cyber-warriors – talented mathematicians as young as 12 taken from their schools and sent to the capital, where they are given intensive tuition from morning till night.
When the bank’s staff rebooted the printer, they got some very worrying news. Spilling out of it were urgent messages from the Federal Reserve Bank in New York – the “Fed” – where Bangladesh keeps a US-dollar account. The Fed had received instructions, apparently from Bangladesh Bank, to drain the entire account – close to a billion dollars.
The Bangladeshis tried to contact the Fed for clarification, but thanks to the hackers’ very careful timing, they couldn’t get through.
The hack started at around 20:00 Bangladesh time on Thursday 4 February. But in New York it was Thursday morning, giving the Fed plenty of time to (unwittingly) carry out the hackers’ wishes while Bangladesh was asleep.
The next day, Friday, was the start of the Bangladeshi weekend, which runs from Friday to Saturday. So the bank’s HQ in Dhaka was beginning two days off. And when the Bangladeshis began to uncover the theft on Saturday, it was already the weekend in New York.
“So you see the elegance of the attack,” says US-based cyber-security expert Rakesh Asthana. “The date of Thursday night has a very defined purpose. On Friday New York is working, and Bangladesh Bank is off. By the time Bangladesh Bank comes back on line, the Federal Reserve Bank is off. So it delayed the whole discovery by almost three days.”
And the hackers had another trick up their sleeve to buy even more time. Once they had transferred the money out of the Fed, they needed to send it somewhere. So they wired it to accounts they’d set up in Manila, the capital of the Philippines. And in 2016, Monday 8 February was the first day of the Lunar New Year, a national holiday across Asia.
By exploiting time differences between Bangladesh, New York and the Philippines, the hackers had engineered a clear five-day run to get the money away.
They had had plenty of time to plan all of this, because it turns out the Lazarus Group had been lurking inside Bangladesh Bank’s computer systems for a year.
In January 2015, an innocuous-looking email had been sent to several Bangladesh Bank employees. It came from a job seeker calling himself Rasel Ahlam. His polite enquiry included an invitation to download his CV and cover letter from a website. In reality, Rasel did not exist – he was simply a cover name being used by the Lazarus Group, according to FBI investigators. At least one person inside the bank fell for the trick, downloaded the documents, and got infected with the viruses hidden inside.
Once inside the bank’s systems, Lazarus Group began stealthily hopping from computer to computer, working their way towards the digital vaults and the billions of dollars they contained.
And then they stopped.
Why did the hackers only steal the money a whole year after the initial phishing email arrived at the bank? Why risk being discovered while hiding inside the bank’s systems all that time? Because, it seems, they needed the time to line up their escape routes for the money.
Jupiter Street is a busy thoroughfare in Manila. Next to an eco-hotel and a dental surgery is a branch of RCBC, one of the country’s largest banks. In May 2015, a few months after the hackers accessed Bangladesh Bank’s systems, four accounts were set up here by the hackers’ accomplices. In hindsight, there were some suspicious signs: the driver’s licences used to set up the accounts were fakes, and the applicants all claimed to have exactly the same job title and salary, despite working at different companies. But no-one seemed to notice. For months the accounts sat dormant with their initial $500 deposit untouched while the hackers worked on other aspects of the plan.
By February 2016, having successfully hacked into Bangladesh Bank and created conduits for the money, the Lazarus Group was ready.
But they still had one final hurdle to clear – the printer on the 10th floor. Bangladesh Bank had created a paper back-up system to record all transfers made from its accounts. This record of transactions risked exposing the hackers’ work instantly. And so they hacked into the software controlling it and took it out of action.
With their tracks covered, at 20:36 on Thursday 4 February 2016, the hackers began making their transfers – 35 in all, totalling $951m, almost the entire contents of Bangladesh Bank’s New York Fed account. The thieves were on their way to a massive payday – but just as in a Hollywood heist movie, a single, tiny detail would catch them out.
As Bangladesh Bank discovered the missing money over the course of that weekend, they struggled to work out what had happened. The bank’s governor knew Rakesh Asthana and his company, World Informatix, and called him in for help. At this point, Asthana says, the governor still thought he could claw back the stolen money. As a result, he kept the hack secret – not just from the public, but even from his own government.
Meanwhile, Asthana was discovering just how deep the hack went. He found out the thieves had gained access to a key part of Bangladesh Bank’s systems, called Swift. It’s the system used by thousands of banks around the world to co-ordinate transfers of large sums between themselves. The hackers didn’t exploit a vulnerability in Swift – they didn’t need to – so as far as Swift’s software was concerned the hackers looked like genuine bank employees.
It soon became clear to Bangladesh Bank’s officials that the transactions couldn’t just be reversed. Some money had already arrived in the Philippines, where the authorities told them they would need a court order to start the process to reclaim it. Court orders are public documents, and so when Bangladesh Bank finally filed its case in late February, the story went public and exploded worldwide.
The consequences for the bank’s governor were almost instant. “He was asked to resign,” says Asthana. “I never saw him again.”
US Congresswoman Carolyn Maloney remembers clearly where she was when she first heard about the raid on Bangladesh Bank. “I was leaving Congress and going to the airport and reading about the heist, and it was fascinating, shocking – a terrifying incident, probably one of the most terrifying that I’ve ever seen for financial markets.”
As a member of the congressional Committee on Financial Services, Maloney saw the bigger picture: with Swift underpinning so many billions of dollars of global trade, a hack like this could fatally undermine confidence in the system.
She was particularly concerned by the involvement of the Federal Reserve Bank. “They were the New York Fed, which usually is so careful. How in the world did these transfers happen?”
Maloney contacted the Fed, and staff explained to her that most of the transfers had in fact been prevented – thanks to a tiny, coincidental detail.
The RCBC bank branch in Manila to which the hackers tried to transfer $951m was in Jupiter Street. There are hundreds of banks in Manila that the hackers could have used, but they chose this one – and the decision cost them hundreds of millions of dollars.
“The transactions… were held up at the Fed because the address used in one of the orders included the word ‘Jupiter’, which is also the name of a sanctioned Iranian shipping vessel,” says Carolyn Maloney.
Just the mention of the word “Jupiter” was enough to set alarm bells ringing in the Fed’s automated computer systems. The payments were reviewed, and most were stopped. But not all. Five transactions, worth $101m, crossed this hurdle.
Of that, $20m was transferred to a Sri Lankan charity called the Shalika Foundation, which had been lined up by the hackers’ accomplices as one conduit for the stolen money. (Its founder, Shalika Perera, says she believed the money was a legitimate donation.) But here again, a tiny detail derailed the hackers’ plans. The transfer was made to the “Shalika Fundation”. An eagle-eyed bank employee spotted the spelling mistake and the transaction was reversed.
And so $81m got through. Not what the hackers were aiming for, but the lost money was still a huge blow for Bangladesh, a country where one in five people lives below the poverty line.
By the time Bangladesh Bank began its efforts to claw the money back, the hackers had already taken steps to make sure it stayed beyond reach.
On Friday 5 February, the four accounts set up the previous year at the RCBC branch in Jupiter Street suddenly sprang to life.
The money was transferred between accounts, sent to a currency exchange firm, swapped into local currency and re-deposited at the bank. Some of it was withdrawn in cash. For experts in money laundering, this behaviour makes perfect sense.
“You have to make all of that criminally derived money look clean and look like it has been derived from legitimate sources in order to protect whatever you do with the money afterwards,” says Moyara Ruehsen, director of the Financial Crime Management Programme at the Middlebury Institute of International Studies in Monterey, California. “You want to make the money trail as muddy and obscure as possible.”
Even so, it was still possible for investigators to trace the path of the money. To make it completely untrackable it had to leave the banking system.
The Solaire sits on the waterfront in Manila, a gleaming white palace of hedonism, home to a hotel, a huge theatre, high-end shops and – its most famous attraction – a sprawling casino floor. Manila has become a big draw for gamblers from mainland China, where the pastime is illegal, and the Solaire is “one of the most elegant casino floors in Asia”, according to Mohammed Cohen, editor-at-large of Inside Asian Gaming Magazine. “It’s really beautifully designed, comparable to anything in south-east Asia. It has roughly 400 gaming tables and about 2,000 slot machines.”
It was here in Manila’s glitzy casino scene that the Bangladesh Bank thieves mounted the next stage of their money laundering operation. Of the $81m that washed through the RCBC bank, $50m was deposited in accounts at the Solaire and another casino, the Midas. (What happened to the other $31m? According to a Philippines Senate Committee set up to investigate, it was paid to a Chinese man called Xu Weikang, who’s believed to have left town on a private jet and never been heard of since.)
The idea of using casinos was to break the chain of traceability. Once the stolen money had been converted into casino chips, gambled over the tables, and changed back into cash, it would be almost impossible for investigators to trace it.
But what about the risks? Aren’t the thieves in danger of losing the loot across the casino tables? Not at all.
Firstly, instead of playing in the public parts of the casino, the thieves booked private rooms and filled them with accomplices who would play at the tables; this gave them control over how the money was gambled. Secondly, they used the stolen money to play Baccarat – a wildly popular game in Asia, but also a very simple one. There are only three outcomes on which to bet, and a relatively experienced player can recoup 90% or more of their stake (an excellent outcome for money launderers, who often get a far smaller return). The criminals could now launder the stolen funds and look forward to a healthy return – but to do so would take careful management of the players and their bets, and that took time. For weeks, the gamblers sat inside Manila’s casinos, washing the money.
Bangladesh Bank, meanwhile, was catching up. Its officials had visited Manila and identified the money trail. But when it came to the casinos, they hit a brick wall. At that time, the Philippines gambling houses were not covered by money laundering regulations. So far as the casinos were concerned, the cash had been deposited by legitimate gamblers, who had every right to fritter it away over the tables. (The Solaire casino says it had no idea it was dealing with stolen funds, and is co-operating with the authorities. The Midas did not respond to requests for comment.)
The bank’s officials managed to recover $16m of the stolen money from one of the men who organised the gambling jaunts at the Midas casino, called Kim Wong. He was charged, but the charges were later dropped. The rest of the money, however – $34m – was leaching away. Its next stop, according to investigators, would take it one step closer to North Korea.
Macau is an enclave of China, similar in constitution to Hong Kong. Like the Philippines, it’s a hotspot for gambling and home to some of the world’s most prestigious casinos. The country also has long-established links to North Korea. It was here that North Korean officials were in the early 2000s caught laundering counterfeit $100 notes of extremely high quality – so-called “Superdollars” – which US authorities claim were printed in North Korea. The local bank they laundered them through was eventually placed on a US sanctions list thanks to its connections with the Pyongyang regime.
It was also in Macau that a North Korean spy was trained before she bombed a Korean Air flight in 1987, killing 115 people. And it was in Macau that Kim Jong-un’s half brother, Kim Jong-nam, lived in exile before being fatally poisoned in Malaysia in an assassination many believe was authorised personally by the North Korean leader.
As the money stolen from Bangladesh Bank was laundered through the Philippines, numerous links to Macau started to emerge. Several of the men who organised the gambling jaunts in the Solaire were traced back to Macau. Two of the companies that had booked the private gambling rooms were also based in Macau. Investigators believe most of the stolen money ended up in this tiny Chinese territory, before being sent back to North Korea.
At night, North Korea famously appears to be a black hole in photos taken from outer space by Nasa, due to the lack of electricity in most parts of the country – in stark contrast to South Korea, which explodes with light at all hours of the day and night. North Korea ranks among the 12 poorest nations in the world, with an estimated GDP of just $1,700 per person – less than Sierra Leone and Afghanistan, according to the CIA.
And yet North Korea has produced some of the world’s most brazen and sophisticated hackers, it appears.
Understanding how, and why, North Korea has managed to cultivate elite cyber-warfare units requires looking at the family that has ruled North Korea since its inception as a modern nation in 1948: the Kims.
Founder Kim Il-sung built the nation officially known as the Democratic People’s Republic of Korea on a political system that is socialist but operates more like a monarchy.
His son, Kim Jong-il, relied on the military as his power base, provoking the US with tests of ballistic missile and nuclear devices. In order to fund the programme, the regime turned to illicit methods, according to US authorities – including the highly sophisticated counterfeit Superdollars.
Kim Jong-il also decided early on to incorporate cyber into the country’s strategy, establishing the Korea Computer Centre in 1990. It remains the heart of the country’s IT operations.
When, in 2010, Kim Jong-un – Kim Jong-il’s third son – was revealed as his heir apparent, the regime unfurled a campaign to portray the future leader, only in his mid-20s and unknown to his people, as a champion of science and technology. It was a campaign designed to secure his generation’s loyalty and to inspire them to become his warriors, using these new tools.
The young Kim, who took power in late 2011 upon his father’s death, called nuclear weapons a “treasured sword”, but he too needed a way to fund them – a task complicated by the ever tighter sanctions imposed by the UN Security Council after the country’s first tests of a nuclear device and a long-range ballistic missile in 2006. Hacking was one solution, US authorities say.
The embrace of science and technology did not extend to allowing North Koreans to freely connect to the global internet, though – that would enable too many to see what the world looks like outside their borders, and to read accounts that contradict the official mythology.
So in order to train its cyber-warriors, the regime sends the most talented computer programmers abroad, mostly to China.
There they learn how the rest of the world uses computers and the internet: to shop, to gamble, to network and to be entertained. It’s there, experts say, that they are transformed from mathematical geniuses into hackers.
Scores of these young men are believed to live and work in North Korean-run outposts in China.
“They are very good at masking their tracks but sometimes, just like any other criminal, they leave crumbs, evidence behind,” says Kyung-jin Kim, a former FBI Korea chief who now works as a private sector investigator in Seoul. “And we’re able to identify their IP addresses back to their location.”
Those crumbs led investigators to an unassuming hotel in Shenyang, in China’s north-east, guarded by a pair of stone tigers, a traditional Korean motif. The hotel was called the Chilbosan, after a famous mountain range in North Korea.
Photos posted to hotel review sites such as Agoda reveal charming Korean touches: colourful bedspreads, North Korean cuisine and waitresses who sing and dance for their customers.
It was “well-known in the intel community”, says Kyung-jin Kim, that suspected North Korean hackers were operating from the Chilbosan when they first broke on to the world stage in 2014.
Meanwhile, in the Chinese city of Dalian, where Park Jin-hyok is believed to have lived for a decade, a community of computer programmers was living and working in a similar North-Korea-run operation, says defector Hyun-seung Lee.
Lee was born and raised in Pyongyang but lived for years in Dalian, where his father was a well-connected businessman working for the North Korean government – until the family defected in 2014. The bustling port city across the Yellow Sea from North Korea was home to about 500 North Koreans when he was living there, Lee says.
Among them, more than 60 were programmers – young men he got to know, he says, when North Koreans gathered for national holidays, such as Kim Il-sung’s birthday.
One of them invited him over to their living quarters. There, Lee saw “about 20 people living together and in one space. So, four-to-six people living in one room, and then the living room they made it like an office – all the computers, all in the living room.”
They showed him what they were producing: mobile phone games that they were selling to South Korea and Japan through brokers, making $1m per year.
Although North Korean security officials kept a close eye on them, life for these young men was still relatively free.
“It’s still restricted, but compared to North Korea, they have much freedom so that they can access the internet and then they can watch some movies,” Lee says.
After about eight years in Dalian, Park Jin-hyok appears to have been anxious to return to Pyongyang. In a 2011 email intercepted by the FBI, he mentions wanting to marry his fiancee. But it would be a few more years before he was allowed to do this.
The FBI says his superiors had another mission for him: a cyber-attack on one of the world’s largest entertainment companies – Sony Pictures Entertainment in Los Angeles, California. Hollywood.
In 2013, Sony Pictures announced the making of a new movie starring Seth Rogen and James Franco that would be set in North Korea.
It’s about a talk show host, played by Franco, and his producer, played by Rogen. They go to North Korea to interview Kim Jong-un, and are persuaded by the CIA to assassinate him.
North Korea threatened retaliatory action against the US if Sony Pictures Entertainment released the film, and in November 2014 an email was sent to company bosses from hackers calling themselves the Guardians of Peace, threatening to do “great damage”.
Three days later a horror-film image of a blood-red skeleton with fangs and glaring eyes appeared on employees’ computer screens. The hackers had made good on their threats. Executives’ salaries, confidential internal emails, and details of as-yet unreleased films were leaked online – and the company’s activities ground to a halt as its computers were disabled by the hackers’ viruses. Staff couldn’t swipe passes to enter their offices or use printers. For a full six weeks a coffee shop on the MGM lot, the HQ of Sony Pictures Entertainment, was unable to take credit cards.
Sony had initially pressed ahead with plans to release The Interview in the usual way, but these were hastily cancelled when the hackers threatened physical violence. Mainstream cinema chains said they wouldn’t show the film, so it was released only digitally and in some independent cinemas.
But the Sony attack, it turns out, may have been a dry run for an even more ambitious hack – the 2016 bank heist in Bangladesh.
Bangladesh is still trying to recover the rest of its stolen money – around $65m. Its national bank is taking legal action against dozens of people and institutions, including RCBC bank, which denies breaching any rules.
As skilful as the hacking of Bangladesh Bank was, just how pleased would the Pyongyang regime have been with the end result? After all, the plot started out as a billion-dollar heist, and the eventual haul would have been only in the tens of millions. Hundreds of millions of dollars had been lost as the thieves had navigated the global banking system, and tens of millions more as they paid off middlemen. In future, according to US authorities, North Korea would find a way to avoid this attrition.
In May 2017, the WannaCry ransomware outbreak spread like wildfire, scrambling victims’ files and charging them a ransom of several hundred dollars to retrieve their data, paid using the virtual currency Bitcoin. In the UK, the National Health Service was particularly badly hit; accident and emergency departments were affected, and urgent cancer appointments had to be rescheduled.
As investigators from the UK’s National Crime Agency delved into the code, working with the FBI, they found striking similarities with the viruses used to hack into Bangladesh Bank and Sony Pictures Entertainment, and the FBI eventually added this attack to the charges against Park Jin-hyok. If the FBI’s allegations are correct, it shows North Korea’s cyber army had now embraced cryptocurrency – a vital leap forward because this high-tech new form of money largely bypasses the traditional banking system – and could therefore avoid costly overheads, such as pay-offs to middlemen.
WannaCry was just the start. In the ensuing years, tech security firms have attributed many more cryptocurrency attacks to North Korea. They claim the country’s hackers have targeted exchanges where cryptocurrencies like Bitcoin are swapped for traditional currencies. Added together, some estimates put the thefts from these exchanges at more than $2bn.
And the allegations keep coming. In February the US Department of Justice charged two other North Koreans, whom they claim are also members of the Lazarus Group and are linked to a money-laundering network stretching from Canada to Nigeria.
Computer hacking, global money laundering, cutting edge cryptocurrency thefts… If the allegations against North Korea are true, then it appears many people have underestimated the country’s technical skill and the danger it presents.
But this also paints a disturbing picture of the dynamics of power in our increasingly connected world, and our vulnerability to what security experts call “asymmetric threat” – the ability of a smaller adversary to exercise power in novel ways that make it a far bigger threat than its size would indicate.
Investigators have uncovered how a tiny, desperately poor nation can silently reach into the email inboxes and bank accounts of the rich and powerful thousands of miles away. They can exploit that access to wreak havoc on their victims’ economic and professional lives, and drag their reputations through the mud. This is the new front line in a global battleground: a murky nexus of crime, espionage and nation-state power-mongering. And it’s growing fast.
Geoff White is the author of Crime Dot Com: From Viruses to Vote Rigging, How Hacking Went Global. Jean H Lee opened Associated Press’s Pyongyang bureau in 2012; she is now a senior fellow at the Wilson Center in Washington DC.
– BBC News
“The best way to predict the future is to create it.” — Peter Drucker
By Prof. Asoka S.Seneviratne
Introduction
Sri Lanka has never been without industrial policy. For decades, successive governments have attempted, in different forms, to promote manufacturing, protect domestic industries, attract foreign investment, develop exports, create employment and move the economy towards higher value-added production. Yet the country has struggled to transform these individual initiatives into a sustained process of industrial upgrading.
This raises a fundamental question: why has Sri Lanka found it so difficult to convert industrial policy into industrial transformation?
A recent International Monetary Fund working paper provides a particularly useful framework for examining this question. Rather than viewing industrial policy simply as a collection of subsidies, tariffs, tax concessions or government programmes, the IMF paper focuses on the institutional capacity required to make industrial policy work. Its central framework is the “4A” model: Ambition-Agency, Autonomy, Accountability and Adaptability.
This framework provides an opportunity to look at Sri Lanka’s industrial experience through a different lens.
The deeper issue is whether the institutions implementing those policies possessed the characteristics required to learn, coordinate, discipline, experiment, and adapt.
This question has become particularly important today.
Sri Lanka has spent the past several years dealing with an extraordinary economic crisis. Macroeconomic stabilisation, fiscal consolidation, debt restructuring, reserve accumulation and monetary discipline have been necessary foundations for recovery. But stability is not the same thing as transformation.
The next stage must therefore be different.
Sri Lanka now needs to move from stabilising the economy to transforming its productive capacity. This is why the 2027 Budget should not be regarded merely as another annual exercise in taxation and expenditure. It should become a Budget for Economic Transformation, with industrial policy at its centre.
The IMF’s 4A framework helps explain both Sri Lanka’s past difficulties and what institutional changes may be required for the future.
Sri Lanka’s Industrial Policy Has a Long History — But Not a Continuous Transformation
Sri Lanka’s industrial-policy experience can broadly be understood through several different phases.
Before 1977, the country followed a strongly interventionist development model. (i) Import substitution, (ii) quantitative restrictions, (iii) state enterprises, (iv) licensing, and (v) protection were used to encourage domestic production and reduce dependence on imports.
The objective was understandable: build domestic productive capacity. But protection alone does not necessarily create international competitiveness.
An industry can survive behind tariff walls without becoming productive enough to compete internationally. Domestic firms may acquire production capacity while remaining dependent on imported technology, protected markets and administrative support.
The economic liberalisation that began in 1977 represented a major change. Sri Lanka moved towards greater openness, private investment, export orientation and integration with international markets.
This created important successes.
The development of the apparel industry is perhaps the clearest example. Export-oriented manufacturing, foreign investment, the free-trade-zone model and integration into global production networks created employment and foreign-exchange earnings.
Yet another question emerged: why did this success not generate a much broader transformation of Sri Lanka’s industrial structure?
The country developed internationally competitive pockets of production, but industrial diversification remained limited. Manufacturing did not generate the scale of technological upgrading seen in some successful East Asian economies such as S. Korea & Japan.
The lesson is therefore not simply that protection failed and liberalisation succeeded. That would be too simplistic.
The more important lesson is that neither protection nor liberalisation, by themselves, constitute an industrial strategy.
Successful industrialisation requires institutions capable of (i) identifying opportunities, (ii) coordinating investment, (iii) encouraging technological upgrading, (iv) demanding performance and (v) changing policies when they do not work.
That brings Sri Lanka directly to the IMF’s 4A framework.
Ambition and Agency: Does Sri Lanka Know What It Wants to Become?
The first question for an industrial policy is not how much money the Government should spend. It is: what kind of economy does Sri Lanka want to become?
Ambition means having a clear development objective. Agency means having an institution capable of translating that ambition into coordinated action. Sri Lanka has often had ambitious policy statements.
There have been plans for export development, industrialization, investment promotion, technology development, regional industrialization and value-added production. More recently, the government has articulated objectives to raise manufacturing’s contribution to GDP, increase merchandise exports and strengthen industrial competitiveness.
The National Export Development Plan 2026–2030, for example, places export expansion, diversification and integration into global value chains at the centre of the country’s trade strategy, with a stated ambition of total exports of US$36 billion by 2030, including US$28 billion in merchandise exports.
The Ministry of Industry has separately set a target of increasing manufacturing’s contribution to GDP from 16.4% in 2024 to 20% by 2030 and merchandise exports from US$12.7 billion to US$28 billion.
These are significant ambitions.
But ambition becomes meaningful only when accompanied by agency.
The IMF’s argument is important here. Successful industrial policy requires a leading institution capable of accumulating sector-specific knowledge, learning from markets, coordinating policies and continuously experimenting with different approaches. This is precisely where Sri Lanka’s institutional fragmentation becomes important.
Industrial development involves finance, trade, taxation, energy, ports, customs, skills, land, technology, infrastructure, research and development and foreign investment. If each ministry and agency operates independently, an industrial strategy can become a collection of disconnected programmes.
Sri Lanka therefore needs more than another policy document.
It needs an institutional agency capable of implementing the policy.
The proposed Industry Transformation and Innovation Authority is potentially relevant to this institutional question. The Government has been working towards consolidating existing industrial and enterprise-development institutions into a more integrated authority.
But establishing an institution is only the beginning.
The real test will be whether it has the authority, expertise and institutional independence to coordinate policy across government and to learn from the private sector and international markets.
Autonomy: Industrial Policy Must Serve the Economy, Not Individual Interests
The second “A” is autonomy.
This is one of the most important lessons for Sri Lanka.
Industrial policy necessarily involves government intervention. But intervention can produce two very different outcomes.
In one case, government works with firms to solve genuine coordination failures, develop infrastructure, promote technology, and enter new markets.
In another, policies become instruments for protecting inefficient firms, distributing privileges or maintaining politically connected interests.
The difference is institutional.
Autonomy does not mean that policymakers should operate without democratic accountability. It means that an industrial-policy institution must have sufficient professional independence to make decisions based on economic evidence rather than short-term pressure from individual firms or interest groups.
Sri Lanka’s historical experience demonstrates why this matters.
Protection can sometimes be necessary during the early development of an industry. But protection without performance requirements can become permanent.
The crucial question should therefore be: What does an industry have to achieve in return for government support?
If a firm receives assistance, should it increase exports?
Should productivity rise?
Should local value addition increase?
Should technology be transferred?
Should workers acquire new skills?
Should the firm penetrate new markets?
Should the support expire after a defined period?
These are not merely technical questions. They determine whether industrial policy becomes a mechanism for productive transformation or permanent protection.
A future Sri Lankan industrial policy should therefore be conditional, transparent and measurable.
Government support should not be regarded as an entitlement.
It should be regarded as an investment by the nation in productive capacity.
Accountability: Industrial Policy Must Be Judged by Results
The third “A” — accountability — may be the most important lesson of all.
Sri Lanka has historically produced numerous plans, institutions and incentives. But the country has not always maintained a sufficiently rigorous mechanism for asking whether those interventions actually delivered the intended results.
An industrial policy should therefore establish measurable performance indicators from the beginning.
The question should not be:
How much did the Government allocate?
The question should be:
What economic transformation resulted from the allocation?
This changes the entire philosophy of policymaking.
For example, an industrial programme should be judged by whether it increases:
productivity;
exports;
investment;
technological capability;
domestic value addition;
skilled employment;
research and development;
foreign-exchange earnings; and
real household incomes.
This approach is directly connected to the broader argument I have made about Sri Lanka’s 2027 Budget.
The success of Budget 2027 should not be judged solely by revenue collection or expenditure control. Those are important instruments of fiscal management. But the ultimate test must be whether public policy increases the economy’s productive capacity. A country cannot tax its way into prosperity.
Nor can it borrow its way into prosperity. Nor can monetary stability by itself create a productive economy.
The sustainable answer must ultimately be higher productivity, greater investment, stronger exports and higher real incomes.
This is why industrial policy belongs at the heart of the transformation agenda.
Adaptability: Sri Lanka Must Learn from What Does Not Work
The fourth “A” is adaptability.
This may be the most difficult characteristic for a government bureaucracy.
Industrial development takes place in an uncertain world. Technologies change. Consumer preferences change. Global supply chains change. Trade agreements change. Energy prices change. Artificial intelligence is changing production itself.
A policy that was appropriate ten years ago may be completely inappropriate today.
Therefore, successful industrial policy cannot be a five-year document that remains unchanged regardless of circumstances.
It must be a learning system. If a programme fails, government should be able to modify it. If an industry does not become competitive after receiving support, assistance should be reconsidered. If a new technology creates an opportunity, policy should respond quickly.
If a global value chain becomes accessible to Sri Lankan firms, infrastructure and skills policy should adjust accordingly. This is where the IMF’s institutional approach becomes particularly relevant.
The IMF paper argues that successful industrial-policy institutions accumulate knowledge through continuous experimentation and feedback from markets. Sri Lanka needs precisely such a mechanism.
The private sector should not simply be treated as a recipient of government policy. It should become an important source of information about international markets, technology, production costs, skills shortages and emerging opportunities.
Government, in turn, must retain the capacity to distinguish between genuine information and requests for permanent protection.
That is the institutional challenge.
From Industrial Policy to Economic Transformation: The 2027 Budget Test
This brings Sri Lanka to the most important question.
What should industrial policy achieve in the next stage of Sri Lanka’s economic development?
The answer cannot simply be to increase the number of factories.
Sri Lanka needs a transformation in the quality and productivity of production.
This means moving from relatively low-value production towards higher-value manufacturing and services; from imported technology towards greater domestic technological capability; from fragmented small enterprises towards globally connected SMEs; and from dependence on a narrow range of exports towards diversified and sophisticated export production.
The Government’s own 2026 Budget has recognised the importance of productivity, innovation, private-sector investment, export diversification and global value-chain integration, while setting an objective of sustained growth above 7% within the next few years.
The challenge is now implementation. This is where Budget 2027 becomes critical. The Budget should connect macroeconomic stability with a coherent national transformation programme.
The first mission should be raising productivity.
That requires investment in technology, automation, artificial intelligence, energy efficiency, logistics, digitalisation, research and development and workforce skills.
The second mission should be mobilising investment.
Macroeconomic stability is essential, but stability alone does not automatically produce investment. Sri Lanka needs predictable regulation, faster approvals, better infrastructure, deeper capital markets, stronger public-private partnerships and a genuine single-window investment mechanism.
The third mission should be improving living standards.
Industrial transformation is ultimately about people.
If productivity increases but real wages do not improve, if exports increase but employment quality does not improve, or if growth is concentrated without broader income gains, transformation remains incomplete.
The objective must therefore be an economy capable of generating higher productivity, higher real wages and higher household incomes. But this transformation cannot be meaningful to ordinary households if the cost of living continues to rise faster than their incomes. Keeping the cost of living manageable must therefore be a fundamental objective of economic policy, so that higher productivity and incomes translate into genuine improvements in living standards.
The above assertion is fundamentally important for policymakers.
Sri Lanka’s New Industrial Policy Must Be Different from the Old One
Sri Lanka should therefore avoid two extremes.
The first is a return to indiscriminate protectionism.
The second is the assumption that markets alone will automatically generate the industrial transformation the country needs.
The experience of successful Asian economies suggests a more sophisticated approach.
The state must create the conditions for private investment and competition, while actively addressing coordination failures that individual firms cannot solve alone.
That means infrastructure. It means reliable and competitively priced energy. It means efficient ports and logistics. It means modern customs systems. It means technical and vocational education linked directly to industry. It means research and development. It means access to finance for productive investment. It means export-market intelligence. It means integration into global value chains.
And it means institutions capable of continuously evaluating whether these interventions are actually working.
Sri Lanka’s geographical position provides an important opportunity. The country can combine manufacturing with logistics, maritime services, tourism, digital services, agriculture and knowledge-intensive exports.
But geography is an opportunity, not a strategy. A strategy requires institutions. That is why the 4A model is so relevant.
Sri Lanka needs ambition to define where it wants to go; agency to coordinate the journey; autonomy to prevent industrial policy from becoming captured by narrow interests; accountability to measure whether public support produces results; and adaptability to change course when circumstances change.
Stability Is the Foundation — Transformation Is the Destination
Sri Lanka’s economic crisis has taught the country a painful but important lesson: macroeconomic instability can destroy decades of development. The stabilisation process was therefore unavoidable.
Fiscal discipline, monetary stability, debt restructuring, reserve accumulation and stronger institutions provide the foundation upon which the next stage of development must be built.
But foundations are not buildings. Stability is necessary. It is not sufficient.
The next challenge is economic transformation.
This is why Sri Lanka’s industrial-policy debate should no longer be confined to the traditional question of whether the Government should intervene more or intervene less.
The more important question is:
Can Sri Lanka build institutions capable of making intervention smarter, more disciplined, more accountable and more adaptable?
The IMF’s 4A framework offers a valuable way of asking that question.
Sri Lanka’s historical experience suggests that industrial policy can create capacity without competitiveness, protection without productivity, and institutions without sufficient coordination. The experience also shows that openness can generate remarkable export successes without necessarily producing broad-based industrial diversification.
The lesson is therefore not to choose between the state and the market. It is to build a state that can work intelligently with competitive markets. That is the real challenge for Budget 2027.
Sri Lanka should not use the 2027 Budget simply to consolidate the achievements of stabilisation. It should use those achievements as the platform for the next stage — raising productivity, mobilising investment, diversifying exports, developing technology, upgrading skills and increasing real household incomes.
The country’s current industrial and export strategies already contain important ambitions. The National Export Development Plan seeks substantial expansion and diversification of exports, while the Government’s industrial strategy aims to raise manufacturing’s contribution to GDP and merchandise exports by 2030.
The decisive issue, however, will not be the targets themselves.
It will be institutional capacity to deliver them.
Sri Lanka therefore needs to move from an era of policies to an era of policy learning; from protection to performance; from isolated projects to coordinated transformation; and from short-term programmes to a sustained national productivity strategy.
The IMF’s 4A model provides a useful institutional lens.
Sri Lanka’s own experience provides the evidence. And Budget 2027 provides the opportunity.
The ultimate objective should be nothing less than a transformation from an economy that has repeatedly struggled to recover from crises into an economy capable of sustaining high productivity, competitive exports, productive investment and rising real living standards. That is the point at which stability becomes meaningful.
Stability should not be the destination of Sri Lanka’s economic journey. It should be the platform from which transformation begins.
As Peter Drucker reminds us, “The best way to predict the future is to create it.” For Sri Lanka, the time has come to create that future through a new generation of disciplined, accountable and adaptive industrial policy.
(The writer served as the Special Advisor to the President of Namibia from 2006 to 2012 and was a Senior Consultant with the UNDP for 20 years. He was a Senior Economist with the Central Bank of Sri Lanka (1972-1993). He can be reached via asoka.seneviratne@gmail.com.)
Reference
:
IMF Working Paper
Institutions for Industrial Policy: The Foundation of Economic Development -Prepared by Reda Cherif, Fuad Hasanov, Gary Xie
March 2026
(Excerpted from Madame-Sir, the autobiography of Manel Abeysekera)
On my return home from Oxford, I felt I should look around for a job. The first offer I had was made by Mr. J.L.M. Fernando, the then Chairman of Air Ceylon, who urged me to apply for an Executive Post with the Airline. I was about to do so when my eye caught a notification in the Ceylon Daily News, reproducing a Gazette notice calling for applications for the Ceylon Overseas Service (COS). Reading down the lines, a particular requirement set me thinking. It was that a married woman must obtain special permission of the Public Service Commission to join the Service. This made me realize that women could apply for a Service which had hitherto been a male bastion because recruitment was through the Civil Service Minute and Examination in which, as I have said earlier, the word “Man” did not embrace “Woman”.
So I obtained my parents’ permission to apply. I believe that Mother gave hers not really expecting me to be selected [no mother likes a daughter to go out into the world] while Father gave his in the fervent hope that I would be selected as that would be the next best thing to following in his footsteps and being in his own Ceylon Civil Service which I could not, being a woman. I remembered the Indian Foreign Service joke about our Foreign Service and hoped I could prove them wrong! I also hoped to do what Dame Janet wanted me to do and do what my women Indian Foreign Service friends were doing.
What I learnt after I joined the COS was that Mr. S.W.R.D.Bandaranaike, when he became Prime Minister and Minister of Defence and External Affairs in 1956, wanted young people to join the COS for its own sake as he himself was extremely interested in foreign affairs and, as in his domestic policy, desired to steer a new course which he believed would be for the good of the country. He had already changed our foreign policy of following British norms and practice and established relations with Eastern Europe, China, Africa, Latin America and the other countries of the Non Aligned Movement.
I was first interviewed by a panel of three Permanent Secretaries of which the Chairman was the Secretary of the Ministry of Defence and External Affairs, Mr. Gunesena de Soyza, who was subsequently appointed High Commissioner to Britain and who had earlier accompanied Mrs. Bandaranaike to Oxford as recounted by me. The other two were Mr.Alvapillai and Mr. Shelton Fernando. They welcomed me as the first woman to be interviewed for the service.
I recall Mr. Alvapillai being rather inclined to think that, since my parents had taken me abroad as shown in my application, I had acquired a taste for travel and wanted to see the rest of the world through the COS. When he enquired if that was so, I rather cheekily said that if I did want to merely travel abroad more, [there were no Exchange Control restrictions on obtaining foreign exchange for travel then], I could do so at father’s cost and not run the risks and hazards of the COS to do so. Again, when I was asked whether, should they take me in and train me at government cost, what would be the case if I decided to get married and leave the Service, it really put my back up and was perhaps the first time I felt a feminist! My reply was that any man they recruited could also leave at will and that there was no stipulation in the conditions of the Service that a woman could not marry and remain in the Service and that the choice was left to me and whoever I married!
I feel that my candour perhaps got me in, thanks to the fairness of the panel which did not resent my frank responses. [Initially, the India Foreign Service had the requirement that female officers had to retire on marriage and my IFS friend from Somerville Mira Malik, who was quite brilliant, had to do so though not so my other friend Soonu Kapadia who may have married later after the rule was rescinded. I like to think that I saved my female colleagues from the fate that befell Mira.
Mr Shelton Fernando, who had been up at Oxford, asked me whether I had not been tempted to caricature some of my lecturers and I am not surprised he did so as many of them were ideal subjects but, as I told him, I did not have the talent for it! I was also asked some foreign affairs questions which were not difficult to answer. The Chairman, Mr. Soyza had subsequently told Father that he had not seen such fine certificates as my Somerville Principal and Tutors had given me, for a long time-no doubt that they would have gone a long way in getting me into the COS and I am deeply grateful to them.
Next came the Public Service Commission interview. But before it, Mr. Eardley Gunewardena, Secretary to the Commission had called (my brother) Lakshman as a friend, to enquire whether I was really serious about wanting to join the COS, because I was the only woman who had qualified for interview and it would be a waste of the Commission’s time if I was not really keen. Lakshman informed him that I was quite serious about it as I had got my parents’ approval to apply for the Service.
This interview was more formal and less formidable than the previous one by the three Permanent Secretaries and I was fortunate to pass it and qualify for appointment to the COS as the first woman to do so. The medical examination that followed included a VD test which Mother strongly felt was degrading for me and I recall Father explaining to her that it was a rule that had to be complied
with and was no reflection on me! In order to pacify her, he said he would accompany me to the clinic so that everyone would see that I was not going there in secret!
Although I was rather quiet with people I did not know and my male colleagues did not quite know what to make of this puduma satha, they soon found out that I could take quite a lot of teasing and also give as good as I got! So we got on famously especially my batch of seven “Samurai” and me, who had busted the male bastion and become the first woman in the COS.
Briefings
The first “pep” talk we got was from the Permanent Secretary of the Ministry, Mr. Gunasena de Soyza. Something he said on that occasion has always remained with me. He informed us that we had been selected on certain criteria and for some special aptitude and individuality which the selectors had seen in us which they felt would be good for the Service. So he cautioned us that the Service did not expect us to become some kind of stereotype and that we should be ourselves and not think that even a cocktail party meant having a drink in one hand and making polite conversation alone they were intended to be avenues to make useful contacts, to engage in business where possible in a friendly, sociable way.
One of my batch mates’ name was Maurice Rabot and Mr. Soyza’s parting shot was: “I do not want the Rabots of the Service to become robots!” Anyway, I do not think that any of my batch mates could have ever become stereotypical diplomats as we were far too individualtistic for that! However, (my brother) Lakshman fondly called me a “diplomutt” and I do not think he would have called me that if I really were one; or rather I would like to think so!
Our next important briefing was by the Prime Minister and Minister of Defence and External Affairs himself, Mr. SWRD Bandaranaike. Before going to the Ministry that morning Father who had worked with the Premier as Commissioner of Local Government and later as Permanent Secretary when he was the Minister of Health and Local Government in the first Government at Independence under Premier Mr. D.S Senanayake as I have recounted, knowing him well, predicted that he would be in a bad frame of mind as he had placed senior members of the Federal Party, including Dr. E.M.V Naganathan, its Secretary, under house arrest and that it may impact on our meeting with him.
As we were about to enter the Premier’s Conference Room, my colleagues who had hitherto not politely stood aside for me as a woman now did so as they expected that then I would have to sit next to the Premier! But, when I entered the room and saw Mr. Soyza seated next to him I boldly walked up and sat next to Mr. Soyza causing one of my colleagues to have to sit next to the Premier!
How right Father was! The Premier made short shrift of us. Luckily he directed his question to my colleague seated on his left (where all of them had failed to manoeuver me!); he was asked to define his foreign policy and, before the poor man could stutter anything out, the Premier went on to the next and to the next! Finally, he sternly bade us read the recently published book on it and come back in a week’s time and we were only too glad to make our escape!
When the appointed day arrived, Father became the oracle again! This time he predicted that the Premier would be in a relaxed, expansive mood as the Federal Party members had been released and how right he was! As we walked in and sat down at the conference table, the Premier turned to Mr. Soyza and remarked: “Gunasena, I see you have taken a woman into the Service and that you are going to train them in foreign languages: I do hope the Tower of Babel will not become one of babble!” Everyone laughed including myself, suppressing the thought, “so much for gender equality and equity”, since my colleagues chattered as much as I did! His next remark was even more pointed: he asked Mr. Soyza “Who is the famous woman in international affairs with enormous fat legs?”
Of course it was Ms. Golda Meir, Foreign Minister of Israel at the time and later Prime Minister. Wasn’t I glad that my saree covered my own legs which I considered shapely “gams” in Hollywood jargon! I always thought that God had a sense of humour seeing that He had given me small hands and feet with what was in between being quite out of proportion! After Mother’s death as Father was heartbroken, he and I went on a trip to the Holy Land and, when we were in Israel [for which we had to have a separate passport so as not to have any evidence of it in the Arab countries], Father was invited to an Evening Reception by Foreign Minister Golda Meir to which I accompanied him where there were several dignitaries from Africa.
Each invitee was asked to stand to be introduced to the others and Father was introduced as the “Little Boy Scout from Ceylon”! But what fascinated me were her legs which were just as our Premier had described them! I also recall meeting Mr. Bandaranaike at a wedding reception and his speaking to me in French which he knew I would have learn to speak at Oxford for my Modern History course and my just getting away with it by replying that I was good at understanding French though not at speaking it. To my relief, he replied “Moi aussi”, meaning, ” Me too”!
Training
After these jokes, to my great relief, the Premier went on to discuss foreign affairs and his policy of non-alignment for Ceylon. These were the days of Sputniks and astronauts and the Premier had decided to give our batch [probably the first intake after he became Premier and Minister of Defence and External Affairs a really good training. In Parliament he stated that we should rise like Sputniks]. Perhaps he may have had ideas on how we should be placed as, except myself, all the others were over the normal maximum age for the joint Civil and Overseas Examination and maybe he thought we should be placed at a step higher than the first step of the Service depending on how we fared in our training. Be that as it may, we were assigned foreign languages and were to be sent to Oxford, Cambridge and London Universities to study them as well as diplomatic history, international relations, international law and other related subjects.
In my case, the assigning of a language and getting placement in a British University proved amusing. We were asked to indicate our first, second and third preferences from French, Italian, German, Russian and Chinese and I gave my choice as Chinese, Russian and German with an eye on being assigned to those countries, little knowing that logic did not always prevail in Foreign Services! I was first assigned German and then, for reasons unknown to me, I was assigned Italian. Now when the languages had first been assigned, the Foreign Ministry official entrusted with obtaining placements had got them and, when the languages were re-assigned, naturally re-assigned the names against the placements that had been obtained.
I was assigned Balliol College, Oxford, which the poor man was unaware was a men’s College [Oxford and Cambridge Colleges became co-ed comparatively recently] My batch mate Mahen Vaithianathan [son of Sir Kanthiah Vaithianathan, the first Permanent Secretary of the Ministry of Defence and External Affairs] who had been a year senior to me at Balliol and who had a puckish sense of humour, had taken the letter addressed to me as I happened to be on leave when they were handed out and, with great amusement, handed it to me the next day. It said, in typical “officialese” that I “should proceed to Balliol College, Oxford to study Italian”.
Equally amused as he, I took the letter to my senior colleague in charge of Overseas assignments, Arthur Basnayake of the first batch of officers and, with a very straight face, told him that I could not possibly “proceed to Balliol” although I would love to do so as Balliol had some showers as opposed to the rather unhygienic, traditional “English bathtubs”. Arthur was quite puzzled and asked me why not, especially as I had been at Oxford already.
My reply was that that was precisely why not and laughingly explained that Balliol would not have me as I was a woman! He laughed heartily and in a confidential whisper told me not to tell the press and of course I did not! The Ministry then quickly made amends and looked for a place and found one at New Hall [since -2008 re-named Murray Edwards College after its distinguished Founder President Dame Rosemary Murray – under whom I was privileged to be an alumnae – and the Refounders who made the endowment for its expansion]. I was delighted at not only having the joy of being at Cambridge but also because it was renowned for its School of Modern Languages. So I “proceeded to New Hall” to enter the Michaelmas [autumn] Term for one academic year.
Before we went abroad to our respective Colleges at the Universities of London, Oxford and Cambridge, we were sent to some of the important Government Departments relevant to our work such as Immigration and Emigration, Commerce, Tourism et al to orient us to their work and their relevance to our own work. Unfortunately, we were not able to go out into the provinces to be oriented to Kachcheri work as civil strife had broken out over the Tamil language issue. In the Ministry, our superb Consellor of training was the witty Glannie Peries who, I believe, was a Civil Servant who “manned” the Ministry before specific recruitment was made to it but preferred to continue in the foreign service. He imparted to us the finer points of foreign affairs including conduct at cocktail parties to which he had us invited for the purpose.
by Nilantha Ilangamuwa
They came. They ruined. They handed us back to the same old enemies. This is how a war supposedly fought for security can end, with a country left carrying the consequences long after the soldiers who invaded it have gone.
Twenty-five years after September 11, 2001, the American-led wars in Afghanistan and Iraq offer a record of military intervention that is impossible to separate from the destruction of institutions, displacement, sectarian violence and the weakening of societies that were supposedly being protected. Brown University’s Costs of War project estimates that the post-9/11 wars produced between 4.5 million and 4.7 million direct and indirect deaths and that more than 38 million people were displaced. Iraq remains the clearest example of how quickly the promise of security can become a prolonged political and human disaster.
The 2003 invasion was justified through the claim that Saddam Hussein possessed weapons of mass destruction and represented an urgent danger. The weapons were not found. The Iraq Survey Group did not discover an active Iraqi WMD stockpile, while later official investigations exposed serious failures in the intelligence used to support the pre-war case. Saddam’s dictatorship and previous use of chemical weapons were real. What collapsed was the proposition that Iraq possessed the active WMD capability used to justify invasion. Yet the war went ahead, and once it did, the United States faced the far more difficult question of what would replace the state it had destroyed.
The occupation did not simply remove Saddam Hussein and preserve Iraq’s governmental machinery. Coalition Provisional Authority Order No. 1 imposed sweeping de-Ba’athification, while Order No. 2 dissolved the Iraqi military and other state institutions. These were occupation decisions, not inevitable consequences of removing Saddam. The dissolution of the army was especially consequential. Hundreds of thousands of trained personnel suddenly lost employment, authority and their place in the new state. Not all had been committed Ba’athists. Many had joined the army as a profession. Removing the institution therefore did not remove military knowledge or political grievances. It scattered them into a country already filled with weapons, uncertainty and anger.
Former soldiers, Ba’athists, nationalists, Islamists, criminals and foreign jihadists became part of an expanding insurgency. Sunni resistance and al-Qaeda in Iraq grew amid the disorder, while sectarian militias expanded. The bombing of the al-Askari shrine in Samarra in 2006 helped unleash an extraordinary escalation of Sunni-Shia violence, turning Baghdad into a city of checkpoints, kidnappings, assassinations and death squads. The occupation had dismantled one of the state’s principal instruments of order without possessing a credible substitute.
The United States changed strategy. The 2007 surge, the Sunni Awakening and changes in military tactics reduced violence, but they did not create a durable political settlement. Sunni tribes that had fought al-Qaeda alongside American forces later felt marginalized by the government in Baghdad, creating grievances that were among the conditions exploited by the organization that evolved into Islamic State. It would be simplistic to say that America directly created ISIS. Its rise also depended on the Syrian civil war, the collapse of Syrian state authority, sectarian politics and decisions by Iraqi and Syrian actors. But the chain linking the 2003 invasion, the destruction of Iraqi institutions, the insurgency, al-Qaeda in Iraq and the later rise of Islamic State is part of the documented history of the organization. The irony is brutal. America invaded partly in the name of preventing terrorism, fought an insurgency that produced al-Qaeda in Iraq, later returned to fight the organization that emerged from that movement, and ultimately fought Islamic State in a country whose political order its own invasion had helped destroy.
The human cost extended beyond battlefields. On November 19, 2005, after a US Marine was killed by a roadside bomb at Haditha, Marines killed 24 Iraqi civilians, including women and children. The initial account did not accurately describe what had happened, and subsequent investigations produced criminal proceedings with varying outcomes. Abu Ghraib exposed an even wider crisis of detention, abuse and accountability. Photographs of prisoners being humiliated became symbols of an occupation that claimed to be constructing a democratic order.
Reconstruction brought another contradiction. The Coalition Provisional Authority controlled approximately $23 billion in Iraqi revenues and assets between May 2003 and June 2004, while the United States separately appropriated billions for reconstruction and security. The evidence does not support the crude claim that America simply stole Iraq’s oil, but the occupying authority exercised extraordinary control over a sovereign country’s finances while its institutions were being rebuilt. A huge contracting system followed, involving construction, logistics, security and maintenance, with oversight struggling to keep pace with enormous spending. The result was an economy dependent on oil and foreign-supported reconstruction. The World Bank estimates that in 2025 oil represented about 53 per cent of real GDP, 88 per cent of government revenue and 91 per cent of merchandise exports.
The consequences reached far beyond government accounts. The World Bank puts Iraqi unemployment at about 15.5 per cent in 2025 and identifies youth employment as a major structural challenge, while women remain dramatically underrepresented in the labour force. UNICEF says close to 3.2 million Iraqi school-age children are out of school and links the educational crisis to decades of conflict and under-investment. More than one million Iraqis remained internally displaced years after the territorial defeat of Islamic State.
The fact, however, is that Saddam’s Iraq had been a hostile barrier to Iranian regional influence. Its destruction removed that barrier, allowing political parties, religious networks and armed groups connected to Iran to become deeply embedded in the post-Saddam system. Some militias that fought American forces eventually became part of Iraq’s political and security architecture. Washington therefore removed an enemy of Iran and spent years confronting forces that benefited from the new order.
Here one cannot forget the irony in Afghanistan, the chokepoint of Bush-era war on terror policy, although its history is not identical to Iraq’s. America entered Afghanistan in 2001 to destroy al-Qaeda and remove the Taliban, remained for 20 years, built and armed Afghan security forces and spent enormous sums attempting to construct a new political order, only to withdraw in 2021 as the Taliban rapidly returned to power. In 2026, more than 2.6 million Afghan girls remain excluded from secondary education, while humanitarian agencies continue to report severe poverty and child malnutrition. Military force can achieve battlefield objectives. American forces defeated Saddam’s army within weeks, helped destroy Islamic State’s territorial caliphate and inflicted major losses on armed groups. The deeper failure was the inability to translate battlefield victories into political orders capable of surviving without foreign military power.
Iraq today is not the Iraq of 2006. Its government functions, cities have been rebuilt, its security forces have fought ISIS, and millions of Iraqis have rebuilt their lives. That resilience belongs to Iraqis themselves. But the dead cannot return, the displaced cannot recover the years they lost, children cannot reclaim the childhoods they spent amid violence, and institutions dismantled in 2003 cannot simply be restored to what they were before the invasion. The weapons that made the invasion supposedly urgent were not found. The urgency became war, the war became occupation, the occupation helped produce insurgency, and the insurgency helped produce another generation of extremists. The American military left, but the consequences remained. And after more than two decades, after the deaths of thousands and the destruction of a political order Washington claimed it could replace, American boots came off Iraqi soil last week, not as the triumphant conclusion of a successful mission, but as the final, deeply disgraceful image of a war whose consequences Iraqis will carry long after the last American soldier has gone.
Debris found from plane that went missing off US coast
Construction of Jet A-1 Aviation fuel pipeline and new oil tank complex at Muthurajawela begins under President’s patronage
Landslide Early Warnings issued to the Districts of Kandy, Kegalle, Matale and Ratnapura
No handshakes and a delayed ceremony as India beat Pakistan at Asian Games
Showers or thundershowers will occur in most parts of the island after 1.00 p.m
Lanka enters new phase of prosecutions as hurdles clear
‘Dates have the highest sugar content to fight Coronavirus’
Sunday Island 27 December – Headlines
#SundayIsland 17th December – Headlines
Sunday Island – 28th March
Sunday Island Headlines – 21 March
Sunday Island – 21st February – Headlines
-
News6 days agoPolice remove Thileepan statue in Jaffna
-
Features6 days agoThe 22nd Amendment, constitutional recovery and illiberal slippage
-
Features6 days agoOf foreigners as CEOs of Lankan ventures
-
Latest News4 days agoGold winner Tharanga gets brand-new Honda Vezel from SLAAJ
-
News6 days agoSajith rejects Jt. Opp. protest sabotage claim; SJB TU chief demands remedial action
-
Features4 days agoWhy Sri Lanka needs an Inclusive Civic Nationalism – urgently
-
News3 days agoUS-assisted ‘Ice’ detection: NPC to examine IGP’s move to transfer drug-busting team
-
Features5 days agoThailand’s biggest new global star …