After 9/11, America Built a Fortress. Now the Threat Is Hiding in Plain Sight

On the morning of Sept. 11, 2001, Javed Ali passed the Pentagon while driving to his job in northern Virginia.

About 30 minutes later, American Airlines Flight 77 crashed into the military headquarters.

From his Falls Church office, Ali watched smoke billow from the Pentagon. Just one year later, in a striking reflection of how profoundly America had been transformed, he entered the still-damaged building as an employee in the Defense Intelligence Agency’s counterterrorism office.

“It was a very eerie and odd and surreal moment in my career,” Ali told News Media.

Ali’s work later carried him from the DIA to the newly formed Department of Homeland Security and then the FBI. The roles gave him a firsthand view of the sweeping national security system the United States built after the deadliest foreign attack ever carried out on American soil.

A quarter-century later, that post-9/11 security structure reflects a notable paradox.

By one of the most important benchmarks, the system created after 9/11 has made a comparable attack vastly more difficult. The United States has not endured another terrorist strike close to the scale or sophistication of 9/11, which killed 2,977 people. American intelligence and military campaigns dismantled much of the al Qaeda network behind the plot. New agencies, expanded surveillance powers, watchlists and intelligence-sharing systems were established to prevent another extremist group from exploiting the same gaps in U.S. defenses. The 2026 U.S. intelligence community assessment said counterterrorism operations have weakened al Qaeda and ISIS, limiting their ability to rapidly rebuild leadership ranks and prepare large-scale attacks on the U.S. homeland.

Yet defeating the threat America faced in 2001 did not end terrorism. Instead, it helped reshape the danger.

Today’s most difficult threats increasingly involve individuals radicalized online, small cells with little warning signature, foreign terrorist organizations seeking to inspire attacks from afar, and an expanding layer of cyber and state-sponsored threats capable of reaching deep inside the United States without hijacking an airplane.

The question 25 years after 9/11, therefore, is not simply whether Americans are safer.

They are safer from one kind of attack — while increasingly exposed to others.

Building a security state after 9/11

The scale of the American response was extraordinary.

Just over two months after the attacks, President George W. Bush signed legislation creating the Transportation Security Administration. TSA says its creation amounted to the largest civilian undertaking in U.S. government history at the time, with the federal government rapidly assuming responsibility for airport passenger and baggage screening.

The following year, Congress created the Department of Homeland Security, combining all or part of 22 federal agencies and offices. DHS began operating in March 2003 and today employs more than 260,000 people across missions ranging from border and aviation security to cybersecurity, intelligence and emergency response.

The changes went far beyond new agencies.

The 9/11 Commission found that the pre-attack breakdown was deeper than the familiar failure to “connect the dots.” Responsibility had been scattered across agencies, information was not consistently shared, and no single entity was empowered to integrate intelligence and drive joint action across the foreign-domestic divide. The commission concluded that “responsibility and accountability were diffuse.”

Washington spent the next two decades trying to close those gaps.

Brown University’s Costs of War project estimates that post-9/11 wars and related obligations have cost roughly $8 trillion. It estimates that more than $1.1 trillion has been spent on homeland security efforts to prevent and counterterrorism inside the United States since DHS was created.

Al Qaeda didn’t disappear overnight

Ali said it can be easy, with 25 years of hindsight, to forget how persistent the original threat remained.

Even after the United States invaded Afghanistan, killed or captured senior al Qaeda figures and put the organization under extraordinary pressure, the group continued attempting to find ways back into the homeland.

During Ali’s years at DHS, he said officials repeatedly confronted plots involving al Qaeda and its affiliates, including a 2006 plot originating in Britain to bomb transatlantic airliners traveling to North America.

The threat then evolved again.

Usama bin Laden was killed by U.S. forces in Pakistan in May 2011. But rather than marking the end of the era of jihadist terrorism, the following years produced a new and in some ways more difficult challenge.

ISIS grew out of al Qaeda in Iraq, expanded rapidly amid the wars in Iraq and Syria and declared a self-described caliphate in June 2014. At its height, the group controlled vast territory and millions of people in Iraq and Syria while encouraging or directing attacks far beyond its borders. The State Department reported that ISIS had emerged from al Qaeda in Iraq and expanded dramatically during 2013 and 2014.

For U.S. counterterrorism officials, Ali said, the center of gravity increasingly shifted from identifying trained operatives sent by an organized group to finding individuals who might be radicalizing inside Western countries.

Then came another shift: attacks by lone offenders across different ideologies, often with no direct operational relationship to an organization overseas.

“Mostly lone actors, lone offenders, not tied to groups overseas, not traveling overseas, and not being directed by people overseas,” said Ali, now an associate professor of practice at the University of Michigan’s Ford School of Public Policy.

The terrorist organization became a phone screen

The transformation is now reflected in the government’s own threat assessments.

The 2026 Annual Threat Assessment from the Office of the Director of National Intelligence said setbacks to the ability of Islamist terrorist groups to conduct “large-scale complex attacks” have pushed them toward information operations and propaganda designed to inspire or enable people in or with access to Western countries.

The assessment said there were at least three Islamist terrorist attacks in the United States in 2025 and that law enforcement disrupted at least 15 U.S.-based Islamist terrorist plotters that year. Roughly half of those disrupted plotters had some online contact with Islamist terrorists or were inspired by foreign terrorist organizations, according to the assessment.

The vulnerability was demonstrated on New Year’s Day 2025, when Shamsud-Din Jabbar, a U.S. citizen from Texas, drove a pickup truck into a crowd on Bourbon Street in New Orleans, killing 14 people. The FBI described the attack as an act of terrorism and said Jabbar had become increasingly isolated before adopting extremist views.

In the days after that attack, the FBI said lone actors and small cells who radicalize online had posed the greatest terrorism threat to the homeland in recent years precisely because they can be so difficult to detect and disrupt.

That presents almost the inverse of the 9/11 problem.

The 9/11 plot required 19 hijackers, overseas leadership, financing, international travel, flight training and years of planning. The challenge for investigators was collecting pieces of information held across different agencies and assembling them quickly enough.

A lone actor may offer far fewer pieces to collect in the first place.

Ali said many recent attackers or alleged plotters had not previously come onto the radar of the FBI or local law enforcement, leaving authorities with the extraordinarily difficult task of identifying people who may not commit an obvious crime until they move toward violence.

“So yes, we are safer from a certain type of threat,” Ali said, “but again, we are not immune from terrorism, and other types of threats are much more difficult to identify or stop.”

A security system built for yesterday?

That changing threat has also fueled a broader debate over whether the institutions created after 9/11 became too large, too expensive or too focused on the dangers of the previous era.

Morgan Murphy, who served as press secretary to the secretary of Defense during the first Trump administration and later worked in the Trump White House, argues that Washington built too much bureaucracy around the 9/11 threat while other vulnerabilities grew.

“TSA agents still pat down grandma and gum up travel while Beijing wires our living rooms with cheap TVs and selfie sticks through the supply chain handed to them by Clinton, Bush, Obama and Biden,” Murphy said. “We spent two decades frisking American passengers while our adversaries plugged themselves into our homes and businesses.”

“The genius of America after Pearl Harbor was that we built to fight. After 9/11, we built to process,” Murphy told News Media, “Real security means sovereignty at home and lethality abroad — a sealed border, an untangled supply chain, and enemies who fear us.”

Theo Wold, who served as acting assistant attorney general in the Justice Department’s Office of Legal Policy and as deputy assistant to the president for domestic policy during the first Trump administration, offered a similar critique, arguing that post-9/11 Washington relied too heavily on large bureaucracies, expansive government authorities and wars in the Middle East.

“George W. Bush and the D.C. governing elite responded to 9/11 the way their politics demanded: create large, unwieldy bureaucracy, push for special legal authorities with limited oversight and activate ground wars in the Middle East,” Wold told News Media.

“Those wars didn’t make us safer, the legal authorities were wielded against Americans, and the bureaucracy is full of waste and has proven nearly unworkable,” he said.

Wold argued that the lesson from the past quarter-century should be a more narrowly targeted national-security model.

“Now we know better. Americans are safest when we are nimble and focus ruthlessly on targeting real enemies,” he said.

The next threat may not look like 9/11

 The challenge now extends beyond terrorism.

The 2026 intelligence assessment warns that China, Russia, Iran, North Korea and non-state ransomware groups continue seeking access to U.S. government networks and private critical infrastructure for espionage, financial gain and possible future disruption. It also warns that artificial intelligence is accelerating cyber capabilities and that several state adversaries are developing missile systems capable of threatening the homeland.

The security landscape that began with al Qaeda operatives training to fly passenger jets has therefore expanded into something far less geographically defined: terrorist propaganda transmitted to an individual’s phone, malicious code inserted into a computer network, attacks on critical infrastructure and state adversaries capable of reaching Americans from thousands of miles away.

For Ali, however, the evolution of the threat should not lead Washington to conclude that the original threat has vanished.

One of the central lessons of the years before Sept. 11, he said, was that emerging terrorist organizations have to be confronted before they have the time and space to develop operational capability.

“When these terrorist threats start to emerge, whether it’s overseas or here, you have to put pressure on them before they gather momentum to carry out operations,” Ali said.

The danger, he argued, would be allowing counterterrorism to fall so far down Washington’s list of priorities that the country begins recreating the complacency that existed before 9/11.

“Terrorism as a tactic is probably never going to be defeated,” Ali said.

Twenty-five years after he watched smoke rise from the Pentagon, Ali’s answer to whether America is safer reflects the contradiction at the heart of the post-9/11 era.

The United States built a massive system to prevent the next 9/11.

It appears to have made another 9/11 far harder to execute.

The harder question now is whether that system can recognize the attack that doesn’t look anything like it.