case 1 – jemaah islamiyah network evolution global jihadist database project scott atran - p.i....

Case 1 – Jemaah Islamiyah Network Evolution

Global Jihadist Database Project

Scott Atran - P.I.Marc Sageman - P.I.

Justin Magouirk - Principal Case ArchitectKen Ward – Consultant

Dominick’ Wright and Darcy Noricks - Contributors

Jemaah Islamiyah (JI) Overview• JI was formed in 1993 by Abdullah Sungkar (548) and

Abu Bakar Ba’asyir (10) after Sungkar split with the leadership of Darul Islam• Sungkar and Ba’asyir had been leaders in Darul Islam, a

jihadist movement in Indonesia, since the 1970s• Sungkar set JI up as a hierarchical organization with regional

heads (mantiqi) reporting to the leader (amir)• Sungkar (548) was the central figure and the source of

vision, inspiration, and direction for JI• Sungkar (548) died in 1999 leaving a leadership void

• Sungkar’s long-time confidant, Ba’asyir (10), was expected to successfully lead the organization

• Ba’asyir (10) took over as amir, but proved to be an extremely weak leader

JI Overview (cont.)• Unlike the centralized Sungkar (548) era, the

organization split into two fractious groups under Ba’asyir (10)• Moderate majority wing led by:

• 574, the head of Mantiqi II (Indonesia)• 234 and 92, heads of Mantiqi III (Philippines)• 592, head of Mantiqi IV (Australia)

• Radical minority wing led by:• Hambali (520), the head of Mantiqi I• Zulkarnaen (244), the head of military affairs for JI

• Ba’asyir (10), who was unwilling to provide the vision for the organization, initially sided with Hambali (520)

• Hambali (520) radicalized the organization through his pursuit of violent activities and his connections with al Qaeda

JI Overview (cont.)• Hambali’s militant minority was responsible for

all of JI’s terrorist attacks from 2000-2003• With Hambali in hiding in Thailand in 2003 (and

later under arrest in August 2003), Noordin Top (261) took over the informal role of attack leader for the radical fringe of the organization

• To illustrate the evolution of the network over time, we will focus on changes in the JI leadership• At pivotal points in time, we will “drill down” into the

networks of the militant minority, which implemented all of the attacks

Social Network Graph Background• Node size is based on individual reputations. Reputations

are based on an algorithm that evaluates:• Organizational role (Mantiqi leadership, key Afghanistan and

Philippines trainer, bomb expert, pesantren teacher at key JI school, etc)

• Attack activity (participation and role on JI bombing operations)• Larger nodes are more central to the JI attack network• Node color is based on the most important tie group to

which the individual belongs. Tie groups are explained in the legend for each graph• Many individuals belong to multiple tie groups (i.e. a jihadist

trained in Afghanistan, attended the JI school Lukmanul Hakiem, attended the JI school Ngruki, etc)

• In such cases, the individual is assigned the most important tie group for the entire period (1985 - 2006)

Social Network Graph Background• Arrests are signified by a box around the node in question

• Depictions of arrests occur in the period following the event• Deaths are signified by a plus sign (+)

• Depictions of deaths occur in the period following the event• Tie thickness and color reflect the strength of the tie

between two individuals • Thin red lines represent acquaintances and in-laws• Medium blue lines represent friends, non-nuclear relatives, and

individuals that have met on operations• Thick black lines represent nuclear family members

1985-1989: Leadership Network Evolution• Sungkar (548) and Ba’asyir (10) are leaders in Darul Islam• Zulkarnaen (244) and 180 attend Sungkar (548) and Ba’asyir’s (10)

flagship madrassah, Pesantren al-Mukmin (Ngruki) in the 1970s and 1980s respectively• The Ngruki school is one of the founding pillars of JI• 180 becomes Sungkar’s (548) driver

• 592 meets Sungkar (548) and Ba’asyir (10) in Indonesia• Sungkar (548), Ba’asyir (10), 574, and Hambali (520) form an exile

community in Malaysia after the two leaders flee Indonesian authorities in 1985

• 368 meets Sungkar (548), Ba’asyir (10), and Mukhlas (26) in Malaysia

• Sungkar (548), Ba’asyir (10), and 574 recruit a first generation of Afghanistan training volunteers• The majority of initial connections are formed here - 26, 92, 154, 198, 234,

244, 245, 250, 262, 520• Afghanistan training is one of the founding pillars of JI

1985-1989: Leadership Network Evolution

= Lukmanul Group

= Afghan Ties = Ngruki Ties

+ = Dead = Arrest

= al Qaeda Core

= Misc Other


• JI is formed in 1993 by Abdullah Sungkar (548) and Abu Bakar Ba’asyir (10) after Sungkar split with the leadership of Darul Islam

• First documented ties between Hambali (520) and al Qaeda core (650)

• 234, 92, and 250 set up a JI training camp in the Philippines at Zulkarnaen’s (244) request

• Mukhlas (26) founds Lukmanul Hakiem, the most important JI madrassah in exile in Malaysia, at the request of Sungkar (548) and Ba’asyir (10)• Lukmanul Hakiem is one of the founding pillars of JI

• 592 accompanies Sungkar (548) and Ba’asyir (10) on a recruitment trip to Australia


= Lukmanul Group


+ = Dead = Arrest

= al Qaeda Core

= Misc Other


• Pesantren Lukmanul Hakiem in Malaysia becomes the center of radical activity for JI• Sungkar (548), Ba’asyir (10), Mukhlas (26), 245, 358, Noordin Top

(261), and Hambali (520) live or commute there on a regular basis• Zulkarnaen (244) and 198 visit often

• JI leadership ties are strengthened• Sungkar (548) – Amir• Ba’asyir (10) – Deputy Amir• Hambali (520) – Mantiqi I• 574 – Mantiqi II• 92 – Mantiqi III• 592 – Mantiqi IV• Mukhlas (26) – Head of Lukmanul Hakiem, Central Command• Zulkarnaen (244) – Central Command• 154, 234, Zulkarnaen (244), 245, 250 – Lead trainers for the

organization• 368 – Treasurer for Mantiqi I (de facto treasurer for JI)


• Sungkar (548), Ba’asyir (10), and Zulkarnaen (244) formalize strong ties with the al Qaeda core (650)• Sungkar (548) and Ba’asyir’s (10) ties are based on a letter from

Sungkar / Ba’asyir to Darul Islam commanders stating that they are the representatives of Bin Laden in Southeast Asia (August 3, 1998)

• Zulkarnaen’s (244) ties are based on his tenure as lead trainer in Afghanistan

• Hambali (520) strengthens ties with al Qaeda core (650)• Hambali (520) brokers a trip to Afghanistan for 368

• 368 outlines one of the Singapore terrorist plots for the al Qaeda core (650)

• 368 and Hambali (520) strengthen their ties through their Mantiqi I leadership roles • 368 acts as a liaison for Hambali for the Singapore cell

• Noordin Top (261) and 358 enter the network• Sungkar (548) remains the dominant JI figure with

unquestioned authority until his death in 1999


= Lukmanul Group


+ = Dead = Arrest

= al Qaeda Core

= Misc Other

2000: Leadership Network Evolution

• The death of Sungkar (548) and the weak leadership of Ba’asyir (10) results in multiple centers of power within JI• Hambali (520) rises to prominence based on his ties

and funding with al Qaeda (650)• Mukhlas (26) becomes prominent as the de facto leader

of Lukmanul Hakiem and as one of the few legitimate Islamic scholars within JI

• Faiz Bafana (368) rises to prominence as Hambali’s (520) key aid and treasurer of JI

• First documented ties between Mukhlas (26) and al Qaeda core (650)


• The moderate majority faction of JI leadership (92, 234, 574, 592) is sidelined by Ba’asyir’s (10) decision to side with the militants led by Hambali (520)

• Hambali cultivates the Afghan training and Lukmanul Hakiem radical networks

• Hambali (520) directs three attacks within six months in the latter part of 2000• Philippines Ambassador Residence Bombing in August

2000• Christmas Eve Bombings in December 2000• Rizal Day Bombings in December 2000


= Lukmanul Group


+ = Dead = Arrest

= al Qaeda Core

= Misc Other

2000: Philippines Ambassador Residence Bombing Network (Militant Minority)• The Philippines Ambassador Residence (PAR) bombing

is envisioned by Hambali as revenge for the Philippines government’s decision to overrun the JI / MILF training camps, Camp Abu Bakar and Camp Hudaibiyah

• The PAR bombing network is cultivated by Hambali (520) from former Afghan trainees and Lukmanul Hakiem members

• Funding stems from Hambali’s (520) connection with al Qaeda (650)

• The PAR bombing is approved by Ba’asyir (10) and planned by Hambali and his Mantiqi I aids – Mukhlas (26), 368, and 584

• In what would become a standard operating procedure, Hambali (520) “borrows” Al-Ghozi (521), a Mantiqi III member to help lead the bombing

•Hambali chooses two separate groups to implement the bombing•The first group, consisting of 226 and future Bali

bombers 27, 29, 167, 209, 522, constructs and delivers the bomb and the car that would be used for the bombing• 29 buys the explosives from 587, a non-jihadist who was later

arrested after the Bali I bombing

•The second group, consisting of 4, al-Ghozi (521), and 55, detonates the bomb

• The bombing occurs on August 1, 2000, injuring the ambassador and killing his security guard and an innocent bystander

2000: Philippines Ambassador Residence Bombing Network (Militant Minority)

2000: Philippines Ambassador Residence Bombing Network (Militant Minority)

= Lukmanul Group

= Misc. Other = al Qaeda Core

= Afghan Ties

= Lukmanul Group

= Misc. Other = al Qaeda Core

= Afghan Ties

+ = Dead = Arrest

Leadership Group

Reconnaissance / Detonator Group

Material Sourcing / Bomb-making Group

2000: Christmas Eve Bombings Network (Militant Minority)

• The Christmas Eve bombings involve perhaps JI’s most ambitious operational planning. Envisioned by Hambali (520) and approved by Ba’asyir (10), the bombings were planned by Hambali and his hand-picked team of jihadists– Imam Samudra (1), Mukhlas (26), 55, 368, 538, and 584 – Hambali (520), Imam Samudra (1), 55, 336, and 538 are in charge of

the actual bombing teams• Some bombing teams hit more than one city

• The teams strike 38 churches in 11 cities in Indonesia in an effort to foment conflict between Christians and Muslims– Batam, Bekasi, Bandung, Ciamis, Jakarta, Mataram, Medan,

Mojokerto, Pekanbaru, Pematang, and Siantar• 19 people are killed and 120 injured

• The bombs are crude, often killing the jihadists who try to detonate them, including Hambali’s friend 538

• Jihadists are spatially positioned in the graphs based on their bombing teams

2000: Christmas Eve Bombings Network (Militant Minority)

+ = Dead

= Misc Other = Lukmanul = GAM

= al Qaeda Core = Ngruki Ties

= Afghan Ties

= Darul Islam

= Arrest

Batam Group

Pekanbaru Group

Jakarta Group

Mojokerto Group

Medan Group

Bandung Group

Ciamis Group

Leadership Group

Sukabumi Group

Mataram Group

2000: Rizal Day Bombing Network(Militant Minority)

• The Rizal Day bombing is a joint venture between JI and the MILF

• The origins of the bombing lay with Hambali’s (520) direction to al-Ghozi (521) to buy explosives from the MILF. Al-Ghozi approaches his former Philippines training member, 513 about purchasing explosives• 513 is willing to help but wants JI to help him implement an attack

in the Philippines as revenge for the Philippines army’s decision to overrun the MILF militant training camps

• Hambali (520) approves the bombing and provides funding through 368

• Al-Ghozi (521) and 513 successfully implement five simultaneous explosions in Manila on December 30, 2000, the Rizal Day holiday

2000: Rizal Day Bombing NetworkMilitant Minority

= Lukmanul Group

= Afghanistan Training

2001: Leadership Network Evolution• 234 takes over the Mantiqi III leadership from 92• 245, 250, 262 rise to prominence within the JI

leadership structure• Hambali (520) flees Indonesia after the Christmas

Eve bombings• Hambali (520) directs church bombings through

Imam Samudra (1) and the Singapore terror plots through 368 and al-Ghozi (521)• Ba’asyir (10) approves all of the 2001 plots and

bombings• The 2001 Singapore terror plots are foiled by

Singapore authorities


= Lukmanul Group


+ = Dead = Arrest

= al Qaeda Core

= Misc Other

2001: HKBP / Santa Ana Bombing Network(Militant Minority)

• The HKBP / Santa Ana church bombings are a continuation of Hambali’s strategy of bombing churches to foment conflict between Christians and Muslims

• Imam Samudra (1) directs a six-person cell that includes Christmas Eve and PAR bomber, 55

• Funding occurs through 368, the treasurer of Mantiqi I

• The cell simultaneously hits the Santa Ana Catholic church and the HKBP Protestant church on July 22nd

2001: HKBP / Santa Ana Bombing Network (Militant Minority)

= Lukmanul Group

= Ngruki Pesantren

= al Qaeda Core

= Afghan Ties

= Misc. Other

2001: Atrium Mall Bombing Network(Militant Minority)

• The Atrium Mall bombing is a continuation of Hambali’s strategy of fomenting conflict between Christians and Muslims

• The target is a group of charismatic Christian worshippers on the upper floor of the Atrium Mall

• Imam Samudra (1) directs a five-person cell. The cell is the same as the HKBP / Santa Ana bombings, minus one jihadist, 547

• Funding occurs through 368, the treasurer of Mantiqi I• The bomb prematurely explodes, injuring 196

• 196 is immediately captured and his leg amputated • 55, who took part in the Christmas Eve bombings, PAR

bombing, and the HKBP / Santa Ana Church bombings, is arrested

2001: Atrium Mall Bombing Network(Militant Minority)

= Lukmanul Group

= Ngruki Pesantren

= al Qaeda Core

= Afghan Ties

= Misc. Other

2002: Leadership Network Evolution• After the United States attack on Afghanistan, connections

between the al Qaeda core (650) and Zulkarnaen (244) and Mukhlas (26) are severed• Hambali (520) continues to work through Khalid Sheikh

Mohammed

• 368, the treasurer for Mantiqi I, is arrested in late 2001 after the Singapore terror plots are foiled• 358 takes over responsibility for JI finances

• Hambali (520) calls a meeting of his Mantiqi I followers and redirects their focus to soft targets • Top (261) is charged with creating a proposal for al Qaeda

funding• 358 is charged with handling the transfer of funds• Mukhlas (26) is charged with directing the bombing


• Because much of the Mantiqi I leadership structure is dispersed and in hiding after the 2000 bombings, the Mantiqi I leader, Mukhlas (26), turns to the Mantiqi II administrative structure for help• Mukhlas (26) works through the militant Zulkarnaen (244),

rather than the Mantiqi II moderate leadership led by 574

• 574 quits his Mantiqi II leadership post in protest of Ba’asyir’s (10) weak leadership• 262 takes over the Mantiqi II leadership

• 198 ascends to the post of caretaker amir when Ba’asyir (10) is arrested after the Bali I bombing


= Lukmanul Group


+ = Dead = Arrest

= al Qaeda Core

= Misc Other

2002 Bali Bombing Network (Militant Minority)

• The Bali I bombing is the culmination of a series of events • Death of JI’s founder, Abdullah Sungkar • Weak leadership of Ba’asyir (10)• Establishment of Lukmanul Hakiem as the center of JI

radicalism in Malaysia• Rise of the militant minority within the ranks of JI

• Hambali (520) orders the bombing from Thailand, dispatching his small group of radical followers to carry out his orders

• The director of the operation, Mukhlas (26) bypasses the moderate Mantiqi II leadership and plans the bombing through the Central Command Military Affairs chief, Zulkarnaen (244)

2002 Bali Bombing Network(Militant Minority)

• Mukhlas (26) chooses Imam Samudra (1), one of the most violent and radical members of JI, to carry out the bombing

• Samudra recruits the most radical JI members, the majority of which have already taken part in previous bombings – 27, 29, 127, 167, 202, 209, 249, 265, 522

• Samudra is also cultivating a small group of Darul Islam members as potential suicide bombers, including the eventual suicide bomber, 524


• In mid-August, Zulkarnaen (244), Mukhlas (26), and Imam Samudra (1) convene a meeting at 81’s house that is attended by the majority of the bombing participants• The plans for the Bali bombing are announced and roles

are delegated• 27, 167, 202, 265, 522 mix and build the bomb with

the guidance of Azhari Husin (249) • 127 handles all logistical issues • Samudra (1) is only able to convince one of his DI

protégées, 524, to become a suicide bomber • 522 is forced to recruit one of his own protégées, 588,

to be the second suicide bomber


• On October 12th, 524 and 588 detonate the bombs at Paddy’s Bar and Sari Club, killing 202 people and injuring another 209

• The Bali bombing is implemented by a militant minority of JI, with no input from the majority of the organization, including high-level leadership• In the October Markaziyah (Central Command) meeting

shortly after the Bali bombing, there is no discussion of the bombing

• 234, head of Mantiqi III, asked Zulkarnaen (244) at this meeting who had carried out the bombing. He is told that it is “none of his business”

2002 Bali Bombing Network

= Serang Group = Lukmanul Group

= Ngruki Ties = Misc. Other = al Qaeda Core

= Afghan Ties

+ = Dead = Arrest

Serang Group

2003: Leadership Network Evolution• The first round of Bali I bombing arrests weaken the leadership

structure• Ba’asyir (10), Mukhlas (26), and 358 are arrested in late 2002

• 245 and 250 are promoted to the JI Central Command • In his final act, Hambali (520) arranges for al Qaeda funding of

the Marriott bombing• Because Hambali (520) is on-the-run (and eventually captured),

Noordin Top (261) gains stature within the organization as a developing strategist

• There is no longer coordination from JI leadership for attacks• 262 plans an attack on the Bank Central Asia Plot in Jakarta (foiled by

police) at the same time that Top (261) plans the Marriott bombing• Zulkarnaen (244) and 92 create a JI special forces group

• The two do not get along (Zulkarnaen is from the militant group and 92 is from the moderate group of JI)

• 180 takes over the leadership of Mantiqi I • 198 continues his role as caretaker Amir


= Lukmanul Group


+ = Dead = Arrest

= al Qaeda Core

= Misc Other

2003 Marriott Bombing Network(Militant Minority)

• Hambali is still in hiding in Thailand during the initial preparations for the bombing, but remains in communication with JI’s chief bomb-maker, Azhari (249)– Hambali promises to send money for the operation, eventually using

his brother (66) to funnel money from al Qaeda (650)

• Noordin Top (261) serves as the chief strategist and Azhari (249) serves as the field commander for the bombing– This would be the first of three partnerships between Azhari (249)

and Top (261)

• The bombing starts in earnest when 200 contacts Noordin Top (261) about leftover explosives from the Christmas Eve bombing– Top has 129 and 200 coordinate a group of JI members to move the

bombing materials including 54, 127, 151, 166, 173, 530


• In May 2003, 200 robs a bank in Medan to help fund the bombing

• The Marriott bombing differs slightly from previous bombings in that there is a wave of arrests before the bombing actually takes place– 127, 129, 166, 200 are all arrested from late April to

August 2003• 245 and 250, both members of the JI Central

Command, meet with the core bombers before and after the bombing

• The bombing occurs on August 5, killing 12 people and injuring 150

• 324, the suicide bomber, dies during the operation


= Lukmanul Group

= Afghan Ties = Misc Other

= Ngruki Ties

+ = Dead = Arrest

= al Qaeda Core

Bomb Material Movers


• Hambali (520) is arrested in August 2003, terminating all known links with the al Qaeda core

• 234 is arrested in 2003 and jailed for 10 months• Upon release in 2004 he repudiates JI and loses all contacts

• 92 is arrested in 2003 in the wake of the police crack down on the JI special forces unit

• 198, the caretaker emir, is arrested in 2003 for his role in hiding Bali bombers after the operation

• Noordin Top (261) takes over the informal role of attack leader for the radical wing of JI• With the help of Azhari Husin, Top (261) directs the

bombing of the Australian Embassy


= Lukmanul Group


+ = Dead = Arrest

= al Qaeda Core

= Misc Other

2004 Australian Embassy Bombing Network(Militant Minority)

• The Australian Embassy is the first JI bombing led entirely by Top (261), without funding from Hambali (520)

• Azhari (249) again serves as the second-in-command– This is the second of three bombings that Top (261)

and Azhari (249) lead• The Australian Embassy bombing involves an

extensive network of jihadists that are not part of JI– This results from Top’s (261) direct appeals to Ring

Banten and Kompak, two jihadist organizations in Indonesia


• The Australian Embassy network results from several key introductions across multiple different groups – 243, an instructor at the radical, madrassah-style university

an-Nur, introduces his students 117, 183, 203 to Noordin Top (261)

– 203 then introduces Top to 99• Top recruits 99 to the network • 99 immediately sets up a training camp to train the bombers that

would take part in the operation– Top has his assistant 117 meet with 204, the assistant of

Kompak leader 9, to obtain explosives for the operation • 9 agrees and Top (261) has a source of explosive materials

– 250, the Central Command member who had met with Azhari (249) and Top (261) before and after the Marriott bombing, and the Mantiqi I leader, 180, provide explosives


• The Australian Embassy operation suffers a series of arrests before the bombing is ever implemented– 117, 175, 180, 183, 203, 206, 243 are arrested between

June and August 2004• The Australian Embassy bombing occurs on

September 9, killing 11 and wounding approximately 140 people – 577, the suicide bomber, dies in the operation


= Lukmanul Group

= Kompak Group = Afghan Ties

= Ngruki Ties

+ = Dead = Arrest

= Misc Other

= an-Nur Group = Ring Banten Group

An-Nur Group

Accommodations Group

Ring Banten Group

Kompak Group

Core Bombing Group

2005: Leadership Network Evolution• 154 is arrested in June 2004• 180 is arrested in June 2004 in the wave of

Australian Embassy bombing arrests• 358 is released from Malaysian detention

• No resumption of ties as he is monitored by Malaysian authorities and barred from contact with former jihadists

• 198 is released from jail and reconnects with former contacts• 198 does not ascend to his former position of caretaker emir

• Top (261) continues his role as the attack leader for the militant minority of JI• Top (261) and Azhari successfully direct their third bombing

together – the 2005 Bali II bombings• Azhari Husin is killed in a police raids following the bombing in late

2005


= Lukmanul Group


+ = Dead = Arrest

= al Qaeda Core

= Misc Other

2006: Leadership Network Evolution• Ba’asyir (10) is released from prison and resumes

his prior contacts• 368 is released from Malaysian detention

– No resumption of ties as he is monitored by Malaysian authorities and barred from contact with former jihadists

• There are rumors that 245 has taken over as Amir, although this has not been substantiated

• 245 and 250 are clearly the link between the JI Central Command and Noordin Top’s (261) attack networks


= Lukmanul Group


+ = Dead = Arrest

= al Qaeda Core

= Misc Other

case 1 – jemaah islamiyah network evolution global jihadist database project scott atran - p.i....

Documents

ji sungkar

ji baasyir

ji leadership

key ji school

organization baasyir

ji school ngruki

ji attack network node

head of mantiqi