Case 1

1
Case 1 Jemaah Islamiyah Network
EvolutionGlobal Jihadist Database ProjectScott
Atran - P.I.Marc Sageman - P.I.Justin Magouirk
- Principal Case ArchitectKen Ward
ConsultantDominick Wright and Darcy Noricks -
Contributors
2
Jemaah Islamiyah (JI) Overview

• JI was formed in 1993 by Abdullah Sungkar (548)
  and Abu Bakar Baasyir (10) after Sungkar split
  with the leadership of Darul Islam
• Sungkar and Baasyir had been leaders in Darul
  Islam, a jihadist movement in Indonesia, since
  the 1970s
• Sungkar set JI up as a hierarchical organization
  with regional heads (mantiqi) reporting to the
  leader (amir)
• Sungkar (548) was the central figure and the
  source of vision, inspiration, and direction for
  JI
• Sungkar (548) died in 1999 leaving a leadership
  void
• Sungkars long-time confidant, Baasyir (10), was
  expected to successfully lead the organization
• Baasyir (10) took over as amir, but proved to be
  an extremely weak leader

3
JI Overview (cont.)

• Unlike the centralized Sungkar (548) era, the
  organization split into two fractious groups
  under Baasyir (10)
• Moderate majority wing led by
• 574, the head of Mantiqi II (Indonesia)
• 234 and 92, heads of Mantiqi III (Philippines)
• 592, head of Mantiqi IV (Australia)
• Radical minority wing led by
• Hambali (520), the head of Mantiqi I
• Zulkarnaen (244), the head of military affairs
  for JI
• Baasyir (10), who was unwilling to provide the
  vision for the organization, initially sided with
  Hambali (520)
• Hambali (520) radicalized the organization
  through his pursuit of violent activities and his
  connections with al Qaeda

4
JI Overview (cont.)

• Hambalis militant minority was responsible for
  all of JIs terrorist attacks from 2000-2003
• With Hambali in hiding in Thailand in 2003 (and
  later under arrest in August 2003), Noordin Top
  (261) took over the informal role of attack
  leader for the radical fringe of the organization
• To illustrate the evolution of the network over
  time, we will focus on changes in the JI
  leadership
• At pivotal points in time, we will drill down
  into the networks of the militant minority, which
  implemented all of the attacks

5
Social Network Graph Background

• Node size is based on individual reputations.
  Reputations are based on an algorithm that
  evaluates
• Organizational role (Mantiqi leadership, key
  Afghanistan and Philippines trainer, bomb expert,
  pesantren teacher at key JI school, etc)
• Attack activity (participation and role on JI
  bombing operations)
• Larger nodes are more central to the JI attack
  network
• Node color is based on the most important tie
  group to which the individual belongs. Tie groups
  are explained in the legend for each graph
• Many individuals belong to multiple tie groups
  (i.e. a jihadist trained in Afghanistan, attended
  the JI school Lukmanul Hakiem, attended the JI
  school Ngruki, etc)
• In such cases, the individual is assigned the
  most important tie group for the entire period
  (1985 - 2006)

6
Social Network Graph Background

• Arrests are signified by a box around the node in
  question
• Depictions of arrests occur in the period
  following the event
• Deaths are signified by a plus sign ()
• Depictions of deaths occur in the period
  following the event
• Tie thickness and color reflect the strength of
  the tie between two individuals
• Thin red lines represent acquaintances and
  in-laws
• Medium blue lines represent friends, non-nuclear
  relatives, and individuals that have met on
  operations
• Thick black lines represent nuclear family
  members

7
1985-1989 Leadership Network Evolution

• Sungkar (548) and Baasyir (10) are leaders in
  Darul Islam
• Zulkarnaen (244) and 180 attend Sungkar (548) and
  Baasyirs (10) flagship madrassah, Pesantren
  al-Mukmin (Ngruki) in the 1970s and 1980s
  respectively
• The Ngruki school is one of the founding pillars
  of JI
• 180 becomes Sungkars (548) driver
• 592 meets Sungkar (548) and Baasyir (10) in
  Indonesia
• Sungkar (548), Baasyir (10), 574, and Hambali
  (520) form an exile community in Malaysia after
  the two leaders flee Indonesian authorities in
  1985
• 368 meets Sungkar (548), Baasyir (10), and
  Mukhlas (26) in Malaysia
• Sungkar (548), Baasyir (10), and 574 recruit a
  first generation of Afghanistan training
  volunteers
• The majority of initial connections are formed
  here - 26, 92, 154, 198, 234, 244, 245, 250, 262,
  520
• Afghanistan training is one of the founding
  pillars of JI

8
1985-1989 Leadership Network Evolution
9
1990-1994 Leadership Network Evolution

• JI is formed in 1993 by Abdullah Sungkar (548)
  and Abu Bakar Baasyir (10) after Sungkar split
  with the leadership of Darul Islam
• First documented ties between Hambali (520) and
  al Qaeda core (650)
• 234, 92, and 250 set up a JI training camp in the
  Philippines at Zulkarnaens (244) request
• Mukhlas (26) founds Lukmanul Hakiem, the most
  important JI madrassah in exile in Malaysia, at
  the request of Sungkar (548) and Baasyir (10)
• Lukmanul Hakiem is one of the founding pillars of
  JI
• 592 accompanies Sungkar (548) and Baasyir (10)
  on a recruitment trip to Australia

10
1990-1994 Leadership Network Evolution
11
1995-1999 Leadership Network Evolution

• Pesantren Lukmanul Hakiem in Malaysia becomes the
  center of radical activity for JI
• Sungkar (548), Baasyir (10), Mukhlas (26), 245,
  358, Noordin Top (261), and Hambali (520) live or
  commute there on a regular basis
• Zulkarnaen (244) and 198 visit often
• JI leadership ties are strengthened
• Sungkar (548) Amir
• Baasyir (10) Deputy Amir
• Hambali (520) Mantiqi I
• 574 Mantiqi II
• 92 Mantiqi III
• 592 Mantiqi IV
• Mukhlas (26) Head of Lukmanul Hakiem, Central
  Command
• Zulkarnaen (244) Central Command
• 154, 234, Zulkarnaen (244), 245, 250 Lead
  trainers for the organization
• 368 Treasurer for Mantiqi I (de facto treasurer
  for JI)

12
1995-1999 Leadership Network Evolution

• Sungkar (548), Baasyir (10), and Zulkarnaen
  (244) formalize strong ties with the al Qaeda
  core (650)
• Sungkar (548) and Baasyirs (10) ties are based
  on a letter from Sungkar / Baasyir to Darul
  Islam commanders stating that they are the
  representatives of Bin Laden in Southeast Asia
  (August 3, 1998)
• Zulkarnaens (244) ties are based on his tenure
  as lead trainer in Afghanistan
• Hambali (520) strengthens ties with al Qaeda core
  (650)
• Hambali (520) brokers a trip to Afghanistan for
  368
• 368 outlines one of the Singapore terrorist plots
  for the al Qaeda core (650)
• 368 and Hambali (520) strengthen their ties
  through their Mantiqi I leadership roles
• 368 acts as a liaison for Hambali for the
  Singapore cell
• Noordin Top (261) and 358 enter the network
• Sungkar (548) remains the dominant JI figure with
  unquestioned authority until his death in 1999

13
1995-1999 Leadership Network Evolution
14
2000 Leadership Network Evolution

• The death of Sungkar (548) and the weak
  leadership of Baasyir (10) results in multiple
  centers of power within JI
• Hambali (520) rises to prominence based on his
  ties and funding with al Qaeda (650)
• Mukhlas (26) becomes prominent as the de facto
  leader of Lukmanul Hakiem and as one of the few
  legitimate Islamic scholars within JI
• Faiz Bafana (368) rises to prominence as
  Hambalis (520) key aid and treasurer of JI
• First documented ties between Mukhlas (26) and al
  Qaeda core (650)

15
2000 Leadership Network Evolution

• The moderate majority faction of JI leadership
  (92, 234, 574, 592) is sidelined by Baasyirs
  (10) decision to side with the militants led by
  Hambali (520)
• Hambali cultivates the Afghan training and
  Lukmanul Hakiem radical networks
• Hambali (520) directs three attacks within six
  months in the latter part of 2000
• Philippines Ambassador Residence Bombing in
  August 2000
• Christmas Eve Bombings in December 2000
• Rizal Day Bombings in December 2000

16
2000 Leadership Network Evolution
17
2000 Philippines Ambassador Residence Bombing
Network (Militant Minority)

• The Philippines Ambassador Residence (PAR)
  bombing is envisioned by Hambali as revenge for
  the Philippines governments decision to overrun
  the JI / MILF training camps, Camp Abu Bakar and
  Camp Hudaibiyah
• The PAR bombing network is cultivated by Hambali
  (520) from former Afghan trainees and Lukmanul
  Hakiem members
• Funding stems from Hambalis (520) connection
  with al Qaeda (650)
• The PAR bombing is approved by Baasyir (10) and
  planned by Hambali and his Mantiqi I aids
  Mukhlas (26), 368, and 584
• In what would become a standard operating
  procedure, Hambali (520) borrows Al-Ghozi
  (521), a Mantiqi III member to help lead the
  bombing

18
2000 Philippines Ambassador Residence Bombing
Network (Militant Minority)

• Hambali chooses two separate groups to implement
  the bombing
• The first group, consisting of 226 and future
  Bali bombers 27, 29, 167, 209, 522, constructs
  and delivers the bomb and the car that would be
  used for the bombing
• 29 buys the explosives from 587, a non-jihadist
  who was later arrested after the Bali I bombing
• The second group, consisting of 4, al-Ghozi
  (521), and 55, detonates the bomb
• The bombing occurs on August 1, 2000, injuring
  the ambassador and killing his security guard and
  an innocent bystander

19
2000 Philippines Ambassador Residence Bombing
Network (Militant Minority)
Lukmanul Group
Afghan Ties
Misc. Other
al Qaeda Core
20
2000 Christmas Eve Bombings Network (Militant
Minority)

• The Christmas Eve bombings involve perhaps JIs
  most ambitious operational planning. Envisioned
  by Hambali (520) and approved by Baasyir (10),
  the bombings were planned by Hambali and his
  hand-picked team of jihadists
• Imam Samudra (1), Mukhlas (26), 55, 368, 538, and
  584
• Hambali (520), Imam Samudra (1), 55, 336, and 538
  are in charge of the actual bombing teams
• Some bombing teams hit more than one city
• The teams strike 38 churches in 11 cities in
  Indonesia in an effort to foment conflict between
  Christians and Muslims
• Batam, Bekasi, Bandung, Ciamis, Jakarta, Mataram,
  Medan, Mojokerto, Pekanbaru, Pematang, and
  Siantar
• 19 people are killed and 120 injured
• The bombs are crude, often killing the jihadists
  who try to detonate them, including Hambalis
  friend 538
• Jihadists are spatially positioned in the graphs
  based on their bombing teams

21
2000 Christmas Eve Bombings Network (Militant
Minority)
Pekanbaru Group
Medan Group
Batam Group
Leadership Group
Ciamis Group
Sukabumi Group
Bandung Group
Jakarta Group
Mojokerto Group
Mataram Group
22
2000 Rizal Day Bombing Network(Militant
Minority)

• The Rizal Day bombing is a joint venture between
  JI and the MILF
• The origins of the bombing lay with Hambalis
  (520) direction to al-Ghozi (521) to buy
  explosives from the MILF. Al-Ghozi approaches his
  former Philippines training member, 513 about
  purchasing explosives
• 513 is willing to help but wants JI to help him
  implement an attack in the Philippines as revenge
  for the Philippines armys decision to overrun
  the MILF militant training camps
• Hambali (520) approves the bombing and provides
  funding through 368
• Al-Ghozi (521) and 513 successfully implement
  five simultaneous explosions in Manila on
  December 30, 2000, the Rizal Day holiday

23
2000 Rizal Day Bombing NetworkMilitant Minority
Lukmanul Group
Afghanistan Training
24
2001 Leadership Network Evolution

• 234 takes over the Mantiqi III leadership from 92
• 245, 250, 262 rise to prominence within the JI
  leadership structure
• Hambali (520) flees Indonesia after the Christmas
  Eve bombings
• Hambali (520) directs church bombings through
  Imam Samudra (1) and the Singapore terror plots
  through 368 and al-Ghozi (521)
• Baasyir (10) approves all of the 2001 plots and
  bombings
• The 2001 Singapore terror plots are foiled by
  Singapore authorities

25
2001 Leadership Network Evolution
26
2001 HKBP / Santa Ana Bombing Network(Militant
Minority)

• The HKBP / Santa Ana church bombings are a
  continuation of Hambalis strategy of bombing
  churches to foment conflict between Christians
  and Muslims
• Imam Samudra (1) directs a six-person cell that
  includes Christmas Eve and PAR bomber, 55
• Funding occurs through 368, the treasurer of
  Mantiqi I
• The cell simultaneously hits the Santa Ana
  Catholic church and the HKBP Protestant church on
  July 22nd

27
2001 HKBP / Santa Ana Bombing Network (Militant
Minority)
28
2001 Atrium Mall Bombing Network(Militant
Minority)

• The Atrium Mall bombing is a continuation of
  Hambalis strategy of fomenting conflict between
  Christians and Muslims
• The target is a group of charismatic Christian
  worshippers on the upper floor of the Atrium Mall
• Imam Samudra (1) directs a five-person cell. The
  cell is the same as the HKBP / Santa Ana
  bombings, minus one jihadist, 547
• Funding occurs through 368, the treasurer of
  Mantiqi I
• The bomb prematurely explodes, injuring 196
• 196 is immediately captured and his leg amputated
  
• 55, who took part in the Christmas Eve bombings,
  PAR bombing, and the HKBP / Santa Ana Church
  bombings, is arrested

29
2001 Atrium Mall Bombing Network(Militant
Minority)
30
2002 Leadership Network Evolution

• After the United States attack on Afghanistan,
  connections between the al Qaeda core (650) and
  Zulkarnaen (244) and Mukhlas (26) are severed
• Hambali (520) continues to work through Khalid
  Sheikh Mohammed
• 368, the treasurer for Mantiqi I, is arrested in
  late 2001 after the Singapore terror plots are
  foiled
• 358 takes over responsibility for JI finances
• Hambali (520) calls a meeting of his Mantiqi I
  followers and redirects their focus to soft
  targets
• Top (261) is charged with creating a proposal for
  al Qaeda funding
• 358 is charged with handling the transfer of
  funds
• Mukhlas (26) is charged with directing the bombing

31
2002 Leadership Network Evolution

• Because much of the Mantiqi I leadership
  structure is dispersed and in hiding after the
  2000 bombings, the Mantiqi I leader, Mukhlas
  (26), turns to the Mantiqi II administrative
  structure for help
• Mukhlas (26) works through the militant
  Zulkarnaen (244), rather than the Mantiqi II
  moderate leadership led by 574
• 574 quits his Mantiqi II leadership post in
  protest of Baasyirs (10) weak leadership
• 262 takes over the Mantiqi II leadership
• 198 ascends to the post of caretaker amir when
  Baasyir (10) is arrested after the Bali I bombing

32
2002 Leadership Network Evolution
33
2002 Bali Bombing Network (Militant Minority)

• The Bali I bombing is the culmination of a series
  of events
• Death of JIs founder, Abdullah Sungkar
• Weak leadership of Baasyir (10)
• Establishment of Lukmanul Hakiem as the center of
  JI radicalism in Malaysia
• Rise of the militant minority within the ranks of
  JI
• Hambali (520) orders the bombing from Thailand,
  dispatching his small group of radical followers
  to carry out his orders
• The director of the operation, Mukhlas (26)
  bypasses the moderate Mantiqi II leadership and
  plans the bombing through the Central Command
  Military Affairs chief, Zulkarnaen (244)

34
2002 Bali Bombing Network(Militant Minority)

• Mukhlas (26) chooses Imam Samudra (1), one of the
  most violent and radical members of JI, to carry
  out the bombing
• Samudra recruits the most radical JI members, the
  majority of which have already taken part in
  previous bombings 27, 29, 127, 167, 202, 209,
  249, 265, 522
• Samudra is also cultivating a small group of
  Darul Islam members as potential suicide bombers,
  including the eventual suicide bomber, 524

35
2002 Bali Bombing Network(Militant Minority)

• In mid-August, Zulkarnaen (244), Mukhlas (26),
  and Imam Samudra (1) convene a meeting at 81s
  house that is attended by the majority of the
  bombing participants
• The plans for the Bali bombing are announced and
  roles are delegated
• 27, 167, 202, 265, 522 mix and build the bomb
  with the guidance of Azhari Husin (249)
• 127 handles all logistical issues
• Samudra (1) is only able to convince one of his
  DI protégées, 524, to become a suicide bomber
• 522 is forced to recruit one of his own
  protégées, 588, to be the second suicide bomber

36
2002 Bali Bombing Network(Militant Minority)

• On October 12th, 524 and 588 detonate the bombs
  at Paddys Bar and Sari Club, killing 202 people
  and injuring another 209
• The Bali bombing is implemented by a militant
  minority of JI, with no input from the majority
  of the organization, including high-level
  leadership
• In the October Markaziyah (Central Command)
  meeting shortly after the Bali bombing, there is
  no discussion of the bombing
• 234, head of Mantiqi III, asked Zulkarnaen (244)
  at this meeting who had carried out the bombing.
  He is told that it is none of his business

37
2002 Bali Bombing Network
Serang Group
38
2003 Leadership Network Evolution

• The first round of Bali I bombing arrests weaken
  the leadership structure
• Baasyir (10), Mukhlas (26), and 358 are arrested
  in late 2002
• 245 and 250 are promoted to the JI Central
  Command
• In his final act, Hambali (520) arranges for al
  Qaeda funding of the Marriott bombing
• Because Hambali (520) is on-the-run (and
  eventually captured), Noordin Top (261) gains
  stature within the organization as a developing
  strategist
• There is no longer coordination from JI
  leadership for attacks
• 262 plans an attack on the Bank Central Asia Plot
  in Jakarta (foiled by police) at the same time
  that Top (261) plans the Marriott bombing
• Zulkarnaen (244) and 92 create a JI special
  forces group
• The two do not get along (Zulkarnaen is from the
  militant group and 92 is from the moderate group
  of JI)
• 180 takes over the leadership of Mantiqi I
• 198 continues his role as caretaker Amir

39
2003 Leadership Network Evolution
40
2003 Marriott Bombing Network(Militant Minority)

• Hambali is still in hiding in Thailand during the
  initial preparations for the bombing, but remains
  in communication with JIs chief bomb-maker,
  Azhari (249)
• Hambali promises to send money for the operation,
  eventually using his brother (66) to funnel money
  from al Qaeda (650)
• Noordin Top (261) serves as the chief strategist
  and Azhari (249) serves as the field commander
  for the bombing
• This would be the first of three partnerships
  between Azhari (249) and Top (261)
• The bombing starts in earnest when 200 contacts
  Noordin Top (261) about leftover explosives from
  the Christmas Eve bombing
• Top has 129 and 200 coordinate a group of JI
  members to move the bombing materials including
  54, 127, 151, 166, 173, 530

41
2003 Marriott Bombing Network(Militant Minority)

• In May 2003, 200 robs a bank in Medan to help
  fund the bombing
• The Marriott bombing differs slightly from
  previous bombings in that there is a wave of
  arrests before the bombing actually takes place
• 127, 129, 166, 200 are all arrested from late
  April to August 2003
• 245 and 250, both members of the JI Central
  Command, meet with the core bombers before and
  after the bombing
• The bombing occurs on August 5, killing 12 people
  and injuring 150
• 324, the suicide bomber, dies during the operation

42
2003 Marriott Bombing Network(Militant Minority)
Bomb Material Movers
43
2004 Leadership Network Evolution

• Hambali (520) is arrested in August 2003,
  terminating all known links with the al Qaeda
  core
• 234 is arrested in 2003 and jailed for 10 months
• Upon release in 2004 he repudiates JI and loses
  all contacts
• 92 is arrested in 2003 in the wake of the police
  crack down on the JI special forces unit
• 198, the caretaker emir, is arrested in 2003 for
  his role in hiding Bali bombers after the
  operation
• Noordin Top (261) takes over the informal role of
  attack leader for the radical wing of JI
• With the help of Azhari Husin, Top (261) directs
  the bombing of the Australian Embassy

44
2004 Leadership Network Evolution
45
2004 Australian Embassy Bombing Network(Militant
Minority)

• The Australian Embassy is the first JI bombing
  led entirely by Top (261), without funding from
  Hambali (520)
• Azhari (249) again serves as the
  second-in-command
• This is the second of three bombings that Top
  (261) and Azhari (249) lead
• The Australian Embassy bombing involves an
  extensive network of jihadists that are not part
  of JI
• This results from Tops (261) direct appeals to
  Ring Banten and Kompak, two jihadist
  organizations in Indonesia

46
2004 Australian Embassy Bombing Network(Militant
Minority)

• The Australian Embassy network results from
  several key introductions across multiple
  different groups
• 243, an instructor at the radical,
  madrassah-style university an-Nur, introduces his
  students 117, 183, 203 to Noordin Top (261)
• 203 then introduces Top to 99
• Top recruits 99 to the network
• 99 immediately sets up a training camp to train
  the bombers that would take part in the operation
• Top has his assistant 117 meet with 204, the
  assistant of Kompak leader 9, to obtain
  explosives for the operation
• 9 agrees and Top (261) has a source of explosive
  materials
• 250, the Central Command member who had met with
  Azhari (249) and Top (261) before and after the
  Marriott bombing, and the Mantiqi I leader, 180,
  provide explosives

47
2004 Australian Embassy Bombing Network(Militant
Minority)

• The Australian Embassy operation suffers a series
  of arrests before the bombing is ever implemented
• 117, 175, 180, 183, 203, 206, 243 are arrested
  between June and August 2004
• The Australian Embassy bombing occurs on
  September 9, killing 11 and wounding
  approximately 140 people
• 577, the suicide bomber, dies in the operation

48
2004 Australian Embassy Bombing Network(Militant
Minority)
49
2005 Leadership Network Evolution

• 154 is arrested in June 2004
• 180 is arrested in June 2004 in the wave of
  Australian Embassy bombing arrests
• 358 is released from Malaysian detention
• No resumption of ties as he is monitored by
  Malaysian authorities and barred from contact
  with former jihadists
• 198 is released from jail and reconnects with
  former contacts
• 198 does not ascend to his former position of
  caretaker emir
• Top (261) continues his role as the attack leader
  for the militant minority of JI
• Top (261) and Azhari successfully direct their
  third bombing together the 2005 Bali II
  bombings
• Azhari Husin is killed in a police raids
  following the bombing in late 2005

50
2005 Leadership Network Evolution
51
2006 Leadership Network Evolution

• Baasyir (10) is released from prison and resumes
  his prior contacts
• 368 is released from Malaysian detention
• No resumption of ties as he is monitored by
  Malaysian authorities and barred from contact
  with former jihadists
• There are rumors that 245 has taken over as Amir,
  although this has not been substantiated
• 245 and 250 are clearly the link between the JI
  Central Command and Noordin Tops (261) attack
  networks

52
2006 Leadership Network Evolution