It was social media chatter that gave him away. Changing his profile picture on the LINE messaging app to a banner pledging "Indonesian support and solidarity for ISIS" probably didn't help.
Had it not been for all that, Gigih Rahmat Dewa's plot to launch a rocket attack on the city-state of Singapore from a nearby Indonesian island might never have been uncovered.
Gigih, 31, and five accomplices were arrested on Batam island on Friday after an investigation that showed how much Indonesia's Islamist militants now rely on social media, including with a Syria-based Islamic State jihadi who allegedly directed them to stage attacks.
It also underlined how militants in the world's most populous Muslim nation, once tight-knit under the Jemaah Islamiah group and internally focused, are splintering into smaller gangs loosely linked to Islamic State with increasingly regional ambitions.
"The men in Batam seem to have been radicalized over social media, specifically using Facebook, rather than directly," said police spokesman Boy Rafli Amar.
"They have been in communication with Bahrum Naim in Syria. It looks like he sent funds and instructions to them," he added, referring to the suspected mastermind of the Singapore plot who left Indonesia in 2015 to join the frontlines of Islamic State.
Multi-ethnic Singapore, sandwiched between two large, Muslim-majority nations, has never seen a successful attack by Islamist militants. But the government of the wealthy island state has said repeatedly it is only a matter of time.
According to police, Gigih and his group had been instructed by their mentor in Syria to fire a rocket at Singapore's Marina Bay, a glitzy downtown waterfront area that hosts a Formula One Grand Prix and is home to a casino resort and office blocks.
Residents of Batam, 15 km (10 miles) south of Singapore, said they were dismayed to learn that the six local men, five of whom were local factory workers, were extremists.
Gigih, his wife and infant daughter lived in a modest one-story house in a row of many just like it. His Facebook account showed that he enjoyed cycling and hiking.
"We are shocked that a completely ordinary person like him can be like that, can be suspected of being involved in radicalism," said neighbor Rubiyati, who goes by one name.
Monalisa, a 23-year-old who attended Batam's state polytechnic institute at the same time as Gigih, described the IT student she knew until 2014 as a normal guy who was "positive, cheerful, humble and friendly with everyone".
She was, however, surprised in March of that year when Gigih changed his LINE group chat picture to a photo of a group of people holding up an Islamic State banner.
There was no preaching by hardline Islamists on campus and so it is unlikely he was radicalized there, she said.
"But what people do off campus or online is another matter."
Jakarta-based security analyst Sidney Jones said Naim, the Syria-based militant, appeared to be using virtually every available form of social media to reach as wide an audience as possible, making it difficult for counter-terrorist forces to track his followers.
"They may have gotten one cluster but there are probably many other clusters out there," she said.
In a blog post after the coordinated attacks on Paris last November, Naim urged his Indonesian audience to learn from that assault and explained how it was easy to move jihad from "guerrilla warfare" in Indonesia's equatorial jungles to a city.
Just last month Indonesian security forces killed their most-wanted militant, Santoso, who had been hiding in a jungle. But analysts say he posed a far smaller threat than the cells of Islamists quietly growing in urban areas of the main island, Java.
Kasiman, chief of the neighborhood association where Gigih lives in Batam, told Reuters the house had been under surveillance for about five months before Friday's raid.
Experts say a rocket attack on Singapore from a nearby island is feasible, but police found only a stash of bomb-making material, firearms and arrows during their search of the ringleader's home.
It could be that Indonesia's would-be jihadis are no more capable of sophisticated strikes than they were in January when a gun and bomb attack by four militants in the heart of the capital, Jakarta, was quickly snuffed out.
Last month a suicide bomber on a motorcycle tried to attack a police station in the city of Solo on Java island, but managed to kill only himself and wound a police officer.
According to police spokesman Amar, investigators had drawn connections between January's attack in Jakarta and the botched suicide bombing in Solo.
He said the Batam group had been acting as an agent for Indonesians who wanted to go and fight with Islamic State in Syria and Iraq, and for militants from China's ethnic Uighur Muslim minority who wanted to enter Indonesia.
But it was Facebook posts that gave them the breakthrough on the plot to hit Singapore.
"Their terrorist action plans were in Facebook," he said, without giving detail. "They didn't announce it but they were discussing it - communicating on social media between all the members."