More than a month after the 17 July 2009 hotel bombings in Jakarta, Noordin Moham­med Top remains at large, but his network is proving to be larger and more sophisticated than previously thought. Not only was it responsible for coordinated bombings at two luxury hotels in the heart of Jakarta’s business district, but it also was apparently contemplating a car bomb attack on President Yudhoyono’s residence. As more information comes to light, it looks increasingly likely that Noordin sought and received Middle Eastern funding. While the extent of foreign involvement this time around remains unclear, recruitment in Indonesia has proved disturbingly easy. The salafi jihadi ideology that legitimises attacks on the U.S. and its allies, and Muslims who associate with them, remains confined to a tiny fringe, but that fringe includes disaffected factions of many different radical groups and impressionable youths with no history of violence.

Many elements of Noor­din’s support base are familiar. Although he broke away from the Jemaah Islamiyah (JI) organisation around 2004, Noordin retains an inner circle of JI militants who have been with him for the last four or five years. He can rely on many more, including teachers at JI schools and their students, to provide hiding places or logistical aid as needed. He has made repeated attempts to tap into the leadership of jihadi groups, not just JI but smaller organisations as well. In some cases, militant jihadis who want more action than their leaders may seek him out, rather than vice versa. He often manages to bring in a few family members and neighbours of those who hide him. The more systematic recruitment of foot soldiers seems to be done more by the inner circle than by Noordin himself. They recruit new youths as needed through study sessions in local mosques, or pick up young men radicalised through earlier exposure to jihadi preachers but then left behind when those preachers move on or are arrested. In every one of his operations, the suicide bombers were identified first by Noordin’s lieutenants and only afterwards met the man himself.

There are new ele­ments and new faces in the July attacks. One family has emerged as pivotal, both to the execution of the 17 July plot and other planned attacks, as well as to the contacts with the Middle East. Two brothers, Syaifudin Jaelani and Mohamed Syahrir are on the police wanted list as members of Noordin’s team. One of their sisters married the man who brought the bomb into the Ritz-Carlton and who died in a police siege in Temanggung, Central Java, on 8 August. The other sister was briefly married to a man who booked the Marriott room used by the bombers and whose arrest broke the case open for the police. The network of this one family extends from Yemen, where Syaifudin studied for four years, to Indonesia’s national airline, Garuda, where Mohamed Syahrir worked as a technician. Noordin may still be the commander, but he has some exceedingly well-connected lieutenants who made their debut in the hotel bombings.

Un­covering Noordin’s network is not a question of tracking down a closed group with a defined membership. It seems to be a loosely organised, almost ad hoc collection of people, largely but not exclusively on Java, that can easily adapt to arrests or deaths of members. It relies on friends, friends of friends, families and co-workers, with each person involved a potential recruiter of others.

This briefing ex­amines the linkages among the people Noordin drew on for the 17 July attacks in an effort to understand his support base. It is focused on the local network, mostly on Java, not on the overseas links, as those were still being uncovered as this went to press. It is not about the ongoing police investigation and does not draw on any privileged information from the men arrested since 17 July. It is necessarily an interim study, using the known pieces of the puzzle to help explain why Noordin and his network have not only survived in Indonesia, but in some senses thrived. It is based on press reports and interviews conducted in connection with the current investigation, and extensive reading of documents collected for previous Crisis Group reports.

Jakarta/Brussels, 27 August 2009