By Dulanjaya Mahagamage
A deadly clash at Sri Lanka’s overcrowded Negombo Prison on July 5, 2026, has killed 28 including 8 prison officers, and injured over 100. The government of Sri Lanka and law enforcement agencies have contained the violence at the prison-offline, but they are struggling with containment of online violence. The incident shows how systemic information gaps during a high-stakes emergency can accelerate the spread of disinformation which also preemptively discredit certain journalists who bring the truth to the public. Even worse, a government’s failure to get ahead of such online harms can turn a local emergency into a nationwide crisis of public trust
Anatomizing the Information Vacuum
Disinformation actors rarely operate in isolation; they exploit the information gaps that emerge during fast-moving crises. When unexpected events occur, the public instinctively seeks timely, accurate, and credible information to understand what has happened, why it happened, who is involved, and what to expect next. If official communication is delayed, fragmented, or too vague, uncertainty creates space for rumours, speculation, and false narratives to spread.
During the initial stages of the Negombo prison riot, official communication from the Department of Prisons and Justice Minister Harshana Nanayakkara was limited and infrequent, and it focused mainly on broad updates rather than detailed situational information. At the same time, communication around the prison itself was restricted, limiting access to real-time information for journalists and anxious family members gathered outside the facility. This information vacuum created six critical gaps that audiences tried to fill, giving disinformation and misleading narratives fertile ground to spread.
What is happening?
The current status of the prison, including the scale of the riot, the areas affected, and whether the situation is under control.
Why is this happening?
The underlying causes of the violence were later identified as a deadly turf war triggered by inmates leaking information about an illicit drug-trafficking network linked to organized crime figures.
Who is involved?
The main actors involved include rival inmate factions, prison officers, security personnel, and any external criminal networks connected to the incident.
What is the government’s response?
The actions taken by authorities, including the deployment of the Police Special Task Force (STF), the Sri Lanka Army, Air Force surveillance drones, and other emergency measures to restore order.
What are the casualties?
Verified information on fatalities and injuries, including the identities and conditions of prison officers, inmates, and any other affected individuals.
What happens next?
The immediate and longer-term consequences, including prisoner transfers, investigations, enhanced security measures, and reforms aimed at preventing similar incidents.
Because official channels left these core questions unanswered for hours, the digital public space saw a sharp rise in user-generated content, speculative reporting, and deliberate fabrications.
The Dynamics of Sri Lanka’s Digital Architecture
To understand why disinformation spreads so quickly during domestic crises, it is necessary to examine the structure of Sri Lanka’s digital space. With an active social media user base of around 9 million, the country has a highly concentrated and interdependent online network.
Unlike in larger countries, where digital communities are often fragmented by geography, language, or algorithmic echo chambers, Sri Lanka’s online information ecosystem is tightly connected. As a result, a single viral post can quickly gain visibility across multiple platforms and communities, driven by high levels of engagement and interaction.
During past crises, such as Cyclone Ditwah, user-generated content helped fill communication gaps left by delayed official updates. Although much of this citizen reporting was well intentioned, it created a pattern in which many users became accustomed to relying on peer-to-peer information shared through social media rather than waiting for institutional communication. During the Negombo prison riot, that pattern became a major vulnerability. In a climate of uncertainty and emotional distress, users were more likely to share information quickly than to verify it carefully, creating ideal conditions for disinformation actors to amplify false or misleading narratives before credible information became available.
Sophisticated Weaponization: Fabricated Authorities and Templates
As the crisis intensified on July 6, 2026, the information landscape changed significantly. Disinformation actors moved beyond unverified text-based rumours and began using more coordinated multimedia manipulation techniques. In a rapidly evolving emergency, plain text posts on social media platforms such as Facebook often carry limited trust. Recognizing this, malicious actors tried to create the appearance of institutional credibility.
They exploited the digital identities of trusted public figures, systemic critics, and spiritual leaders, embedding false content within cloned media templates to bypass the public’s natural scepticism. This works through cognitive capture: in a high-stress crisis, people face greater informational overload and become more likely to rely on visual cues such as a familiar news channel logo, a particular font, or the official portrait of a government minister to judge whether information is real.
By exploiting these visual shortcuts, disinformation creators turned the public’s urgent search for clarity into a tool for viral amplification.
- State Actors: Disinformation creators produced fake press statements and graphics featuring Justice Minister Harshana Nanayakkara and Cabinet Minister Nalinda Jayatissa. These fabricated materials contained false statements and invented political conspiracies related to the riots. By using the names of the very ministers responsible for the state response, the actors created confusion and made it difficult for ordinary citizens to distinguish authentic directives from digital forgeries.
A false statement attributed to Justice Minister Harshana Nanayakkara claimed that he was not responsible for the incident and that there were officials to handle the situation. The ITN news template was used.
- Religious and Civil Actors: Within the sensitive socio-political climate of Negombo, a region with a significant Christian population and lasting trauma from the 2019 Easter Sunday attacks, disinformation actors deliberately introduced religious elements. False quotes attributed to figures such as Rev. Fr. Cyril Gamini were circulated, claiming that the CID was behind the riots. This tactic was designed to shift the crisis from a prison administration failure into a potentially explosive communal issue.
A false statement attributed to Rev. Fr. Cyril Gamini Fernando questioned whether the CID was behind the prison riot and used the ITN news template.
- Investigative Journalist: Another deeply troubling tactic involved weaponizing the credibility of independent journalists. Journalists such as Kasun Pussewella, known for exposing state corruption and covering past prison disturbances including the 2012 Welikada riot and the 2020 Mahara unrest, had their names attached to false breaking news reports. Because the public recognizes this journalist as a critic of state narratives, disinformation actors exploited that credibility to make outrageous fabrications appear legitimate.
A false statement attributed to investigative journalist Kasun Pussewella claimed that the government had the right to suppress riots in prisons, using the Lanka Truth news template.
- Crisis Management Lessons for the Modern Era: The aftermath of the Negombo prison riot offers important lessons for how states must manage information during emergencies. When the government remains silent, it gives up control of the narrative and allows falsehoods to shape public understanding.
To prevent the dangerous spread of disinformation in future crises, institutional communication strategies must change:
Establish an information buffer zone
The government should create a continuous information center at the perimeter of any crisis to provide verified updates, even if those updates are only procedural.
Pre-empt the six essential gaps
Institutional spokespeople should structure communications around the six core public concerns: what happened, why it happened, who is involved, what the government is doing, what the casualties are, and what happens next.
Proactive template verification
Mainstream media organizations and state ministries should use digital watermarks or cryptographic verification tags on official graphics so users can quickly check whether a circulating image or statement is authentic.
Empower independent journalism
Instead of treating investigative reporters and civil advocates as adversaries, crisis managers should treat independent journalism as a stabilizing force. Giving reputable journalists verified and transparent access is one of the fastest ways to counter malicious fabrications.
While heavily armed security forces eventually contained the physical violence in Negombo Prison, the digital fallout from the crisis persisted for weeks. In today’s hyper-connected world, a crisis is never fully resolved until its information environment is stabilised as well. Until institutions learn to address informational gaps with real-time transparency and credible communication, they will remain vulnerable to the unpredictable power of digital disinformation.
Dulanjaya Mahagamage is a digital rights researcher and communications professional with over five years of experience in social media analytics, trust and safety, digital governance, and policy analysis. He is currently Lead Researcher at Factum.
Factum is an Asia Pacific-focused think tank/consultancy on Diplomacy, Tech-Plomacy, Digital and Energy Futures accessible via www.factum.lk.
The views expressed here are the author’s own and do not necessarily reflect the organization’s.
