Since the Aug 17 blast at the Erawan shrine there has been no shortage of misstatements and missteps from the authorities. But the arrest of a key suspect on Saturday afternoon marked real success and a potential breakthrough in the nation's worst-ever bomb attack.
For that success to be effectively exploited, however, it is important the security services recognise squarely that the Erawan atrocity was the not the fumbling revenge of a locally-based criminal gang facing a police "crackdown", but rather a well-planned and technically sophisticated international terrorist operation.
All the more striking for the fact it appears to have been organised at remarkable speed, the scale of the attack has effectively propelled the threat to Thailand's security, along with the response necessary to counter it, into the modern globalised era.
- EDITORIAL: Yes, it was terrorism
There can be no doubt that on Bangkok's Black Monday terrorist planners envisaged two mass-casualty attacks, not one, and they were intended to be broadly simultaneous. The first struck the Erawan shrine killing 20 and wounding over 130. The target of the second was not the bottom of a canal at Sathon pier or even the pier itself but somewhere else on the Chao Phraya river that would have doubled the carnage.
CCTV footage from the pier on Monday night provides telling clues as to what probably happened. Curiously it was not released by the police soon after the explosion the next day, but leaked to the media only several days later.
The footage shows an "Asian-looking" man in a blue shirt carrying a bag containing the bomb arriving at the pedestrian bridge over the canal to the ferry pier around 7.20pm -- 24 minutes after the blast at the shrine. Standing against the railing, he hesitates on the bridge for two-and-a-half minutes and makes two phone calls. His problem was almost certainly the same as that facing thousands of other Bangkok commuters every day: he was running late.
Had his target been the pier as has been widely suggested he needed only to walk a further 30 metres over the bridge, leave the bomb under a bench amid waiting passengers and walk away to detonate it remotely. Instead he waited until the bridge was clear and pushed the bomb with his foot into the canal where it exploded harmlessly around 1.30pm the next day.
So what was the target that brought the bomber to Sathon pier? Short of a confession from the suspect now in custody it is difficult to be sure, but it is likely to have been a reasonably short boat-ride away and unlikely to have been another pier, an empty temple or an international hotel with in-house security. The weight of probability falls heavily on the Asiatique night market, a crowded riverside complex of restaurants and handicraft shops popular with east Asian, and mainly Chinese, tourists. Asiatique is a 10-minute ferry ride from Sathon pier with a shuttle service transporting tourists directly to the complex free of charge.
For those disembarking on and before Aug 17 there were no bag checks. Currently, soldiers rather than private security guards are conducting thorough searches of all bags both at the ferry dock and the road entrance to the complex on Charoen Krung Road.
If Asiatique was the intended second target it is easy to understand the bomber's hesitation and the decision -- taken either in consultation with his handler or on his own initiative -- to abort the mission. By the time he reached the complex it would have been at least 7.40pm; and by the time he had planted the bomb and exited onto Charoen Krung Road, probably 7.55pm -- a full hour after the Erawan blast.
By then news of the attack on TV and smartphones would have reached local staff at Asiatique if not many tourists. The risk for a lone male lugging a bag and looking to plant a second bomb was increasing by the minute.
There is one striking inference to be drawn from the aborting of the second attack, a serious setback to the overall operation. Despite the evident professionalism in the planning and targeting and assembling of two sophisticated bombs, the execution of both attacks was clumsier, mainly because it relied on operatives with apparently little or no local knowledge, both of whom needed to be in frequent touch with a handler.
It has been established that the Erawan bomber spoke no Thai and apparently little English and needed to have his post-attack destination -- "Lumpini park"-- written for his taxi driver on a piece of paper.
The second bomber was running late either because he lost his way as he approached the pier from North Sathon Road (where he was also caught on CCTV stopping to make a phone call); or because he failed to make allowance for Bangkok traffic.
Both men were almost certainly relatively new arrivals in town, suggesting they travelled from abroad to carry out the bombings. My own hypothesis is they represented the sharp end of what appears to have been a hybrid or "joint venture" operation. Such an operation would have been driven by the anger of foreign-based "ideological" extremists directed against both China and Thailand over the plight of the Uighurs in western China and Bangkok's July deportation of refugees back to China, which may perhaps have included one or more important figures in the Uighur underground.
A tourist writes a message of condolence on a board at Suvarnabhumi airport for the victims of the Erawan shrine bombing.
But attacks would also have hinged critically on in-country support from a locally-based organised crime group with a financial interest in facilitating the movement of Uighur refugees. Basic operational security would demand that both groups be of the same ethnicity -- evidently Turkic -- and share the same broad hatreds, even if for different reasons.
A critical part of that local support infrastructure was taken down by police last Saturday when a man of Turkic ethnicity -- maybe a Turkish citizen, maybe not -- was detained with a large cache of bomb-making equipment and over 200 fake or doctored Turkish passports.
The passports were undoubtedly intended to be used by Uighur refugees moving through Thailand into Malaysia, the preferred jump-off point for onward travel to Turkey. In short, the rented rooms on the eastern edge of the city represented both a bomb-making factory and a people-smuggling safe-house.
The fact that nearly two weeks after the Erawan blast and aborted riverside attack the explosives were still being stored and a suspect was still in residence is clearly ominous, suggesting further attacks were in the pipeline. While the police raid has successfully pre-empted any immediate danger, follow-on investigations and arrests will be critical in working out the full reach of a complex trans-national network which stretches from China, through Southeast Asia to Turkey.
Longer term, the Erawan tragedy throws up two key lessons for Thai policy-makers. The first relates to the danger of hybrid attacks in which ideologically-driven terrorist groups, possibly with little or no visibility, can ally with and piggy-back off criminal networks with the experience and connections to arrange cross-border travel, the renting of apartments and local sourcing of weapons and explosives.
It follows that traditional cosy accommodations between corrupt officials -- including even senior officers in the security services -- and "common criminals" now represent a potentially critical threat to national security and need to be dealt with accordingly.
Secondly, the illusion that the attack on Aug 17 was somehow not "real" terrorism is both short-sighted and, insofar as it fosters further complacency, extremely dangerous.
In the coming years Thailand, like many other countries in an interconnected world, will face terrorist threats which its security and intelligence services need to understand and pre-empt. That response should involve more effective policing at home, targeted, pro-active intelligence-gathering overseas, and stepped-up liaison with foreign services particularly in Southeast Asia and the Middle East. The firmest foundation for a vibrant and successful tourist industry is action, not denial.
Anthony Davis is a security consultant and analyst with IHS-Jane's.