Twin hotel suicide bombings in Indonesia exposed new security weaknesses in an industry increasingly in the cross-hairs of terrorists – and pointed to evolving tactics by the militants. By posing as guests and then checking into one of the hotels with explosives that were then assembled into bombs in the privacy of a room, the terrorists who struck on Friday were apparently able to evade the metal detectors and vehicle checks put in place to ward off attackers. Expensive X-ray machines, devices that detect explosives and intrusive searches of guest luggage may be the only way to stop a repeat attack, but they come at a price: making properties that are supposed to be welcoming to weary travelers feel like prisons. “The authorities are not opposed to this, because they worry about the effect of the attacks, but hotel authorities and the tourist industry is a bit reluctant because they don't want the hotels to look like bunkers,” said Paul Wilkinson, director of the Center for the Study of Terrorism and Political Violence at the University of St Andrews in Scotland. “But I think the more attacks we have of this kind, the more hotels will have to think about improving the protection.” The suicide blasts in restaurants at the J.W. Marriott and Ritz-Carlton hotels in the heart of the capital, Jakarta, were the first in Indonesia in four years, showing the tenacity of terrorists despite a widely praised crackdown in recent years. They came nine days after the re-election of a US-friendly president in the world's most populous Muslim-majority nation. Suspicion has already fallen on the Jemaah Islamiyah terror network and its allies – especially Noordin Top, a Malaysian engineer who heads a particularly violent offshoot of the group. The Australian Strategic Policy Institute said in a paper released Thursday that tensions in Jemaah Islamiyah's leadership and the release of former members from prison “raise the possibility that splinter factions might now seek to re-energize the movement through violent attacks” against Western targets. It said, however, the possibility remained low. At its peak, Jemaah Islamiyah was believed to have a network of several hundred members across Malaysia, Indonesia, the Philippines, Thailand and Australia. In 2003, members of the group attacked the Marriott in Jakarta with a car bomb that a suicide bomber drove close to the lobby and detonated, killing 12 people. Militants have carried out at least seven other major attacks on hotels around the world since then, killing more than 380 people and wounding hundreds more. Hotels are targeted because they are often high-profile Western symbols and are gathering places for foreigners. The first Marriott blast – a year after 202 people, mostly foreigners, were killed in attacks on restaurants on the tourist island of Bali – led to tightened security measures at hotels, offices and shopping malls in Jakarta. As they are in Pakistan and other countries with a history of terrorist attacks, cars are searched before they get close to the lobby and guests either walk through a metal detector or are checked with a wand. But even if those measures are carried out strictly, smuggling in bomb-making components and explosives in luggage would likely get around them, said Jakarta-based security consultant Ken Conboy. Militants in Pakistan and Afghanistan responded to greater physical security by launching coordinated attacks: one group attacks the perimeter security with a suicide blast or small-arms attack, while another follows and attempts to strike the hotel. In November, militants laid siege to the Taj Mahal hotel in the Indian city of Mumbai for three days. Some reports suggested they possibly stayed at the hotel before to learn its floor plan. “People around the world can look at what others do and mirror them, they can analyze, and then they can create a copycat attack,” said defense analyst Paul Beaver, former editor at Jane's Defense Weekly and an adviser to the British Parliament on security matters.