Indonesia-based JAD was also linked to 2018 church bombings in Surabaya and 2016 Jakarta attacks.

As Indonesia’s Chief Security Minister Wiranto continues to recover after emergency surgery at the main army hospital in Jakarta, investigators are trying to determine how two suspected members of the outlawed Jamaah Ansharut Daulah (JAD) evaded security and carried out the stabbing attack.

Budi Gunawan, the head of Indonesia’s top intelligence agency BIN, said on Friday the suspects – Syahril Alamsyah, also known as Abu Rara, and his 21-year-old wife Fitri Andriana were members of JAD, a homegrown Indonesian armed group linked to the Islamic State of Iraq and the Levant (ISIL or ISIS).

The same group carried out a series of church bombings and attacks in Surabaya in 2018 in which at least 23 people were killed, and a 2016 attack in Jakarta’s business district.

In July 2018, an Indonesian court ordered JAD to be disbanded.

Its leader, Aman Abdurrahman, was also sentenced to death for “masterminding” from his jail cell the 2016 attack in the Indonesian capital.

But the stabbing of Wiranto on Thursday suggests members are still proving they “have the enthusiasm” to carry out attacks, even though the ISIL has lost territory, and many of its members in Indonesia have been arrested, Sidney Jones, director of Institute for Policy Analysis of Conflict (IPAC), told Al Jazeera.

“I think that this sends a message,” she said. “That it’s still possible for one, not very well-trained couple, to decide maybe on their own, maybe without anyone else’s direction, to attack a senior official of the Indonesian government.”

“We may see other people inspired to do attacks on their own.”

According to CNN Indonesia, Wiranto was injured in his lower left abdomen. The director of the hospital, where he was first taken after the incident, told reporters that the minister’s blood pressure and pulse were “normal”, meaning “he did not suffer from internal bleeding”.

However, Wiranto was immediately airlifted to Jakarta’s Gatot Soebroto Army Hospital, where he reportedly underwent an emergency surgery.

Wiranto was taken to Jakarta by helicopter after he was attacked in Banten on Thursday [Weli Ayu Rejeki/Antara via Reuters]

Budi, the intelligence chief, told reporters on Thursday that JAD members, including the suspects in Wiranto’s attack, had been on law enforcement radar for at least three months.

The Jakarta Globe quoted Budi as saying that the main suspect, Syahril Alamsyah, had moved from the Jakarta suburb of Bekasi to Bogor in west Java. After divorcing his first wife, he moved again to the town of Pandeglang, where Wiranto’s stabbing took place.

The suspect reportedly received help from another JAD member, Abu Samsudin, when he moved to Pandeglang.

Dua orang, perempuan dan laki-laki diduga anggota teroris JAD menusuk Pak Wiranto dan 2 orang lainnya. Semoga Pak Wiranto dan 2 korban lainnya cepat sembuh. JAD yg merekrut 3 keluarga bomber bunuh diri di surabaya beberapa waktu lalu. #HancurkanTerorisme #HancurkanRadikalisme pic.twitter.com/C2jBm6aqbp — Fadjroel Rachman (@fadjroeL) October 11, 2019

‘Opportunistic’ attacks

Budi, however, conceded that it was difficult to know what each JAD member was planning to do, because they could be operating independently, or in small groups.

“They move [through] the cell system, and the cells are very small,” Budi said.

In the case of Wiranto’s attacker, Budi said that he was “definite” that the JAD group from Bekasi was involved.

The head of JAD in Bekasi also reportedly officiated the attacker’s marriage to his new wife, who was also arrested after Thursday’s attack.

“We have been monitoring this particular actor specifically,” Budi told reporters.

But he did not explain how the suspect evaded Wiranto’s security.

Sidney Jones of IPAC said that many of the JAD members’ actions were “very opportunistic”, and it could be that they found the chance when they learned of Wiranto’s visit to Pandeglang, about two and a half hours drive west of Jakarta.

Chief Inspector General Tomsi Tohir, police chief of Banten province, was quoted by news reports as saying that while security protocols had been followed “in accordance with standard procedures”, it was difficult to prevent Wiranto from interacting with the public, as the minister had insisted.

“Security had been arranged, but he was intent on greeting the waiting crowd. On his return, we also provided security, but he wanted to meet them, because there were many school children; some wanted to shake hands with him,” Tomsi was quoted as saying.

It was during this time that the suspect managed to get close enough to Wiranto to stab him.

Aside from Wiranto and the local police chief, a third person was also reportedly injured as the crowd tried to wrestle the suspect to the ground.

On Friday, a new video posted on social media showed the moment the attacker lunged at the security minister, hitting him at least twice before he was subdued by the crowd, while Wiranto fell forward.

With additional reporting by Febriana Firdaus in Indonesia