"The Marriott and Ritz-Carlton, which are located next door to each other, were reputed to have tight security, in part because of the previous hotel attack six years ago. Metal detectors were stationed at the entrances, while at the Marriott vehicles were not allowed to pull up to the lobby. On occasion, security guards opened the luggage of entering guests. But the terrorists were able to somehow evade the security measures by smuggling in bomb materials. On Saturday, a police spokesman said that one bag carrying the July 17 bomb materials had set off a metal detector but that security guards let it through after the owner said it was just a laptop computer. Spotty enforcement, it appears, is just as common as stringent checks at Jakarta hotels. Just hours after the Friday morning bombings, for instance, another luxury hotel in Jakarta performed a cursory check of an approaching taxi, not even bothering to use a metal-detector wand or mirror to check the underside of the car. A bomb-sniffing dog was on-site but was snoozing beside the security checkpoint."(Time)
A report from Jawa Pos indicated that there were 4 bombs. Two exploded, one was defused and the law enforcement is still trying ot find the last one. The law enforcement were aware of the existence of these four bombs since last May but they were not able to track the bombs in time. (This explained a series of anti-terror raids in the past 4 weeks)
They found out about these bombs thanks to terrorist cells they uncovered two months ago in Sumatra .