Indonesia’s Online Militant Networks Test Counterterrorism Efforts

Raids expose a dispersed network linked through virtual meetings

Indonesia’s counterterrorism police have arrested 11 people across six provinces in an operation that investigators say disrupted a dispersed network linked to online recruitment, propaganda and militant training. The arrests show how extremist groups can continue to organise across the country even after years of enforcement have weakened larger organisations.

Special Detachment 88, known as Densus 88, said the operation began on October 2 and covered West Java, Central Java, Central Sulawesi, South Sulawesi, Riau and North Maluku. The suspects, aged 22 to 52, are believed to have links to Daulah Islamiyah and other terrorist networks. The term Daulah Islamiyah is commonly used for local factions aligned with Islamic State ideology.

Densus 88 spokesman Mayndra Eka Wardhana said investigators found connections between suspects in different regions, including through online meetings used for indoctrination, network consolidation and training. Authorities allege that the suspects had varied roles, including recruitment in person and through social media, propaganda distribution and preparation for terrorist activity.

Investigators also reported indications that some suspects took part in physical training and shooting exercises. Police have not publicly disclosed where the training occurred, whether weapons were seized, or evidence of a specific planned attack. Searches, evidence reviews and questioning of witnesses and suspects are continuing.

The arrests underscore a shift in how small extremist cells can communicate. Digital platforms allow people in distant provinces to build connections without travelling to a shared meeting place. Online contact can support recruitment and ideological instruction, while in-person activity may still be used for practical training. The public details released so far do not establish how far this alleged network had advanced toward an attack.

What investigators say about the suspects

Densus 88 identified the suspects by initials as HN, 43; SM, also known as NM, 52; HA, 45; YDKAP, 22; S, 49; A, 32; CG, 29; J, 36; MF, 37; AF, 26; and MW, 42. The operation’s province-by-province breakdown has not been fully disclosed.

One arrest drew questions from the suspect’s family. YDKAP was detained in Surakarta, Central Java, on the evening of October 1. His family said they learned of the arrest when officers arrived with a warrant the following morning. A family representative said they had not been told what conduct was alleged or what role the young man was suspected of playing, and called for his rights and the presumption of innocence to be respected.

Those concerns do not resolve the allegations, which remain under investigation. They do highlight the importance of clear legal procedures and access to information for families during counterterrorism cases. Police have said their inquiries are continuing, and have not publicly provided further details about the individual suspects’ alleged conduct.

Smaller cells remain difficult to detect

Indonesia has experienced a sustained decline in terrorist attacks. The last known attack was a December 2022 suicide bombing at a police station in Bandung that killed one officer and wounded 10 others. National Counter-Terrorism Agency chief Eddy Hartono said authorities had thwarted about 28 planned attacks over the subsequent four years.

Security analysts caution that an absence of attacks does not mean extremist networks have disappeared. Years of arrests and disruption have weakened major groups, but fragmentation can leave smaller cells with fewer visible links to established organisations. Such groups may be less capable of mounting a coordinated attack, yet harder to identify because they operate with limited structure and communicate through changing digital channels.

Alif Satria, a research fellow at the International Centre for Political Violence and Terrorism Research, has described counterterrorism as involving more than the arrest of people preparing to carry out violence. Disrupting the wider network of recruiters, propagandists and trainers can also limit a group’s ability to sustain its activities. The latest case reflects that approach: police say they targeted alleged recruitment and coordination as well as training.

Indonesia’s 2018 revision of its terrorism law widened the scope for law enforcement to intervene during preparation and planning, rather than waiting for an attack to occur. Such powers can enable earlier disruption, while making careful evidence review and respect for due process especially important.

Digital recruitment reaches beyond established groups

The arrests come amid wider concern about online pathways into violent extremism, particularly for young people. Indonesian authorities have warned that social media, online games and encrypted messaging can be used to spread extremist material or draw individuals into closed communities. In a previous case, Densus 88 arrested suspects accused of recruiting children through social media, online games and encrypted messaging.

Authorities have also raised concerns about online true crime communities, which focus on real violent crimes and their perpetrators. These spaces are distinct from groups with a clear political or religious programme, but exposure to violent material and the search for belonging can make some young people vulnerable to further recruitment. The scale and nature of that risk require careful assessment rather than assuming that participation in such a community proves support for terrorism.

Digital networks also create challenges for investigators. Groups can move between platforms, use encrypted communications and connect people across provincial boundaries. At the same time, an online meeting or extremist post alone does not show that a person has agreed to commit violence. Authorities must establish individual conduct and intent through evidence, not association alone.

Indonesia’s militant history shapes the response

The operation follows years of pressure on organisations that once had stronger leadership and territorial reach. Jemaah Islamiyah, the al-Qaeda-linked group responsible for the 2002 Bali bombings, announced its dissolution in 2024 after years of state pressure. Analysts have said that the group’s disbanding is a major change, though it does not mean every former member has abandoned extremist beliefs or that all networks have vanished.

Authorities have also weakened Jamaah Ansharut Daulah, an Islamic State-aligned network linked to deadly attacks, including the 2018 Surabaya church bombings. Densus 88 arrested eight suspected JAD members in Central Sulawesi earlier this year, in a separate case involving alleged online propaganda.

Central Sulawesi carries a particular history. Poso was affected by communal conflict from 1998 to 2001, followed by years of militant violence. The Islamic State-linked East Indonesia Mujahideen operated in the region and used remote forests and plantations as places to hide and organise. Its leader, Santoso, was killed in 2016, and the group’s remaining members were pursued by security forces.

The arrests of three suspects in Central Sulawesi have therefore unsettled residents who had come to associate recent years with greater stability. The province’s past does not establish that the current suspects belong to the former group or share its methods. It does help explain why new reports of suspected networks can revive concerns among communities that have experienced violence and prolonged security operations.

Prevention combines enforcement and reintegration

Indonesia’s counterterrorism strategy also includes rehabilitation and social support for people leaving extremist groups or prison. Densus 88 has held programmes with former Jemaah Islamiyah members, local governments and religious leaders to encourage disengagement from violence and support community reintegration. Officials and researchers say these measures complement enforcement by addressing the conditions that can allow networks to rebuild.

Criminologist Tegar Bimantoro has argued that long-term prevention depends partly on economic reintegration. Former prisoners who struggle to find work or meet basic needs may face added pressure as they return to their communities. Support with employment, family needs and schooling can help make reintegration more durable, though it cannot replace monitoring where there is credible evidence of renewed activity.

Researchers have estimated that a minority of people who completed deradicalisation programmes in Indonesia later reoffended. The estimate points to the need for continuing assessment, but it should not be treated as a prediction about any individual. Effective programmes must account for different personal circumstances and distinguish people who have left violence behind from those who remain active.

The arrests also come amid concerns about terrorist financing. Indonesia’s Financial Transaction Reports and Analysis Centre has identified public fundraising through digital platforms, misuse of non-profit organisations and self-funding as risks. Following money flows can help investigators understand how networks operate, while financial scrutiny must also be based on evidence and avoid treating ordinary charitable activity as suspicious by itself.

Security gains face a changing threat

Indonesia’s recent record reflects sustained action against organised networks, public prevention work and efforts to rehabilitate former members. The current case suggests that some supporters may be attempting to reconnect across regions through online channels. It does not, on the information publicly released, demonstrate a resurgent organisation or an imminent attack.

The practical challenge is to maintain early detection while protecting civil liberties and community trust. Investigators must establish what each suspect is alleged to have done, and courts must assess the evidence. At the same time, cooperation with local governments, families and community organisations can help identify recruitment risks and support people at risk before they become involved in violence.

The Bottom Line

• Densus 88 arrested 11 terrorism suspects in six Indonesian provinces beginning October 2.
• Police allege links to Daulah Islamiyah and other networks, including online recruitment, propaganda and training.
• Investigators reported virtual meetings and possible physical and shooting exercises, but have not disclosed evidence of a specific planned attack.
• Indonesia has had no known terrorist attack since the December 2022 Bandung police station bombing.
• Authorities face the dual task of disrupting extremist activity and supporting lawful, community-based prevention and reintegration.