JAKARTA The bombers that attacked two luxury hotels in Indonesia's capital on Friday checked into one of their targets a couple of days before, posing as paying guests to crack tough security cordons usually in place.
Eight people were killed and dozens wounded when two bombs exploded within minutes of each other at the JW Marriott and Ritz-Carlton hotels in the heart of Jakarta's business district.
After an incident-free four years following a spate of deadly bombings blamed on the al-Qaeda-linked Jemaah Islamiah (JI) group, Friday's attacks have shaken faith in the effectiveness of security at hotels and other possible targets.
It took years for Bali to recover from a deadly 2002 attack on its main tourist strip that killed 202 people, mostly foreigners.
Police said the Marriott device was planted by people who had checked in as guests and had probably assembled the device in their room.
"Room 1808 had become their post since the 15th," National police chief General Bambang Hendarso Danuri told a news conference.
While he wouldn't immediately draw a connection to JI, Danuri said the bombs were made in the same way as an unexploded device found recently in Central Java.
Local media said that bomb was found in a house thought to be owned by the father-in-law of Noordin Top, a senior JI leader who remains at large.
Although police have not commented on it, local news channel TVOne showed closed-circuit television (CCTV) footage they said showed the Ritz-Carlton bomber entering the hotel lobby wearing a baseball cap and pulling a wheelie-bag.
Police Chief Danuri said both blasts were the work of suicide bombers, but it was unclear how many people were involved.
"From the crime scene we found two suicide bombers," he said, and then hinted at the grisly task that awaited forensic experts piecing together the crime scene.
"The face of the one at the Ritz-Carlton is intact, while at the JW Marriott, even though the skull was blown off, we can still use the face skin for reconstruction."
Questions will be asked how the bombers managed to get explosives and detonators past security checks that were believed to be among the most stringent in the country.
"It is basically like going into an airport," Marriott global security chief Alan Orlob, who was staying at the Jakarta hotel at the time of the blast, told CNN.
"There are things we can and will do in the wake of this."