Terrorist Travel and the Visa Lessons the 9/11 Commission Laid Out

The most dangerous weapon the September 11 hijackers carried was a piece of paper. Not a knife, not a box cutter. A visa.

They did not tunnel under a fence. They went to American consulates, filled out forms, answered questions and were handed the right to enter. Then they came through airports, past inspectors, and some of them broke the terms of their stay in plain view. The lesson of that fact is not subtle, and it is one a free country finds hard to hold on to once the shock fades: the border is not only a line on a map. It is a series of checkpoints that begin in a foreign consulate and end in a federal database, and a failure anywhere along the line can be fatal.

What the Commission was and what it found

Congress and President Bush created the National Commission on Terrorist Attacks Upon the United States, known as the 9/11 Commission, in November 2002. It was a bipartisan panel of ten members, five from each party, chaired by Thomas Kean, a Republican and former governor of New Jersey, with Lee Hamilton, a Democrat and former congressman from Indiana, as vice chair. It issued its final report, The 9/11 Commission Report, on July 22, 2004. A month later its staff released a monograph titled 9/11 and Terrorist Travel, which examined one narrow question in detail: how the terrorists traveled.

The staff report's central claim can be put in a sentence the Commission used in the main report: "For terrorists, travel documents are as important as weapons." Terrorists, it explained, have to move in order to meet, train, plan, scout targets and enter the places they intend to attack. If you can stop them from moving, or catch them when they present a false identity, you can stop the plot before it begins.

That is an argument, and I think it is a correct one, that immigration enforcement belongs inside the counterterrorism toolkit and not beside it. The same officials who stamp passports and review visas are, whether they know it or not, part of the nation's defense.

The visas and the violations

Here is what the record shows. The nineteen hijackers were foreign nationals who entered the United States on temporary visas. The Commission's work documented a pattern of ordinary-looking travel that concealed extraordinary intent. I will state what I am sure of and leave out the details I am not.

The hijackers obtained visas at American consulates, all but one on visitor visas for tourism or business, and one pilot on a student visa. Some of them entered, left and returned. Two violated the terms of their stay, and one overstayed. In some cases, a hijacker who was admitted for one purpose acted on another. In the best-known example, two of the pilots had entered as visitors and then trained at flight schools, which called for a student status. The change of status had been approved months before the attacks, but the paperwork reached the flight school in March 2002, six months after them. That episode, which drew widespread public anger at the time, is one of the most-cited examples of how slow and paper-bound the system was.

The staff monograph also documented that the hijackers' passports carried indicators that, taken together and examined carefully, might have drawn attention: signs of manipulation in some, links to extremist groups in others. The trouble was that no one was examining them together. The inspectors who saw one passport did not know what the intelligence agencies knew about the traveler's associates. The consular officers who issued the visas did not have access to everything in the government's files. In the language the Commission used about the broader failure, the dots were there and were not connected.

I want to be fair to the officials who worked in that system. Most were doing what the system asked of them. The failures were failures of design: the lack of sharing, the lack of biometric checks, the absence of a way to track who had entered and who had left. That is the lesson, and it is why the reforms that followed focused on design.

The case that proves the point: Ahmed Ressam

The Commission also told the story of a plot that was stopped, and I find it more instructive than the one that was not.

On December 14, 1999, a man named Ahmed Ressam drove a car off a ferry at Port Angeles, Washington, on the way from Canada. He was heading, as it turned out, to Los Angeles, where he planned to bomb the international airport. A Customs inspector named Diana Dean noticed that he was acting nervously and sent him for secondary inspection. Officers found explosives and timing devices hidden in the car, and Ressam was arrested.

What stopped that attack was not a satellite or a wiretap. It was an alert inspector at a checkpoint who followed her instincts and referred a nervous traveler for a second look. The Commission drew the lesson that the border and port-of-entry system is a place where terrorists can be caught, and that the people staffing it should be trained, supported and given the tools to share what they learn. That is a conservative idea if ever there was one: the government's first duty is to protect, and the protection is done by real people at real posts.

Why a visa is a security document

The visa process is the first checkpoint, and it is the only one that happens before the traveler is on American soil. Under section 221 of the Immigration and Nationality Act, a consular officer decides whether to issue a visa. Under section 214(b), an applicant for a nonimmigrant visa is presumed to be an intending immigrant unless he shows otherwise, and the burden is on the applicant. A refusal at the consulate means that the traveler never arrives.

A visa is a promise by the traveler about what he intends to do. If he violates it, the government has a legal ground to remove him, and a record. The Commission's point was that these promises, and the records of their breach, are a form of information about the traveler, and the government was not using that information. Someone who overstays a visa or who does something different from what he said he would do is, in a small percentage of cases, a person to watch. The system did not look.

The reforms that followed

Congress and the executive branch acted. I will name the reforms I am confident about, with a plain sentence on each.

US-VISIT. In January 2004, the Department of Homeland Security began the United States Visitor and Immigrant Status Indicator Technology program, known as US-VISIT. It started at airports and seaports, where visitors' fingerprints were scanned and their photographs taken, and checked against watch lists. The idea was to confirm that the person arriving is the person who received the visa. The program was later folded into a different office within the department. Biometrics at entry were a direct answer to the Commission's finding that documents could be altered and identities borrowed.

The Intelligence Reform and Terrorism Prevention Act of 2004. Signed in December 2004, this law implemented many of the Commission's recommendations. It created the position of Director of National Intelligence and the National Counterterrorism Center, to connect what the agencies knew. It also directed the creation of a terrorist travel strategy and established the Human Smuggling and Trafficking Center, which brings together officials from several agencies to deal with the movement of people, including smuggling networks. That connection matters because the criminal infrastructure that moves migrants also moves other travelers. The commercial side of that world is described in How a Smuggling Network Prices a Border Crossing and Who Gets Paid.

The REAL ID Act of 2005. Enacted in 2005, this act set minimum security standards for state-issued driver's licenses and identification cards that federal agencies would accept for official purposes, such as boarding a commercial aircraft. The Commission had recommended that the federal government set standards for the issuance of sources of identification, such as driver's licenses, because the hijackers had obtained American identification documents, in some cases from state offices, which helped them move freely and board aircraft. The act has been controversial, with objections from states on cost and from some conservatives on privacy and federalism, and its implementation was delayed repeatedly. The underlying idea, that a license should be issued only after the applicant's identity and lawful presence are verified, is sound.

Entry-exit. The Commission and Congress both called for a system that tracks not only who enters but who leaves, so that the government knows who has overstayed. A law from 1996 had already required such a system, and the demand was repeated after 2001. The biometric entry side advanced. The exit side has been slower, and I will say more on that below.

The steelman: security theater and civil liberties

The critics of these measures have a case worth hearing, from both left and right.

One, biometric collection and database linkage increase the government's power over every traveler, and the power can be misused. A conservative who distrusts concentrated federal power has reason to want limits on what is collected and how long it is kept.

Two, the visa process burdens legitimate travelers, students, scholars and businesspeople, and some of them will go elsewhere. The cost of delays and refusals is real.

Three, much of the post-2001 apparatus has been criticized as expensive and of uncertain value. A system that screens millions of people to find a handful may produce many false alarms.

Four, a government that focuses on visas may miss threats that do not involve visas, such as citizens radicalized at home, or those who enter by other routes.

These are fair points, and I will answer them directly. The first is answered by limits written into statute, which is how a free people handles any government power: collect what is necessary, retain it for a defined period, and punish misuse. The second is real but small compared to the harm of a failure, and the answer is to make the process fast and predictable, not to weaken it. The third is a reason to audit, not to abandon. The fourth is true and incomplete: no single tool stops every threat, and a layered defense is built from many. A visa check is a layer. It is not the whole wall.

Why the work is unfinished

Here the argument turns from history to the present, and I want to stay on the ground I am sure of.

The Commission's recommendations were not all carried out, and some of those that were have been implemented unevenly. Three gaps stand out.

1. Exit tracking. For years the country has admitted that it has a better idea of who has entered than of who has left. Without a reliable record of departures, the government cannot identify visa overstays at scale, and overstays are one of the paths by which a person who entered lawfully becomes unlawfully present. The Commission's concern about people who violate their terms is directly connected to this gap. I will not cite figures on overstays, because the numbers vary by year and source, and I would ask you to check the Department of Homeland Security's published reports.

1. Information sharing. Much was done to connect agencies, but the problem of getting the right fact to the right officer at the right time is a standing one. It is a management problem, and it is never finished.

1. Identity standards. The REAL ID Act set standards that took many years to take effect. A country that sets a security standard in 2005 and phases it in over most of two decades has treated the lesson as less urgent than the Commission did.

There is also a lesson about how the visa program interacts with other parts of the immigration system. Temporary protected status, parole and similar programs, which are covered in Temporary Protected Status and the Problem of Temporary That Never Ends, raise the same question of who is in the country and on what terms, and the same need for reliable records. And the broader policy of controlling who may enter, including the president's authority under section 212(f) of the Immigration and Nationality Act, is examined in Trump v. Hawaii and the Broad Power Congress Gave Presidents in Section 212.

The constitutional dimension

The Constitution's preamble lists among the purposes of the government to "provide for the common defence." Article I, section 8, gives Congress the power to establish a rule of naturalization and to regulate commerce with foreign nations, and the Supreme Court has long held that the power to admit and exclude foreigners is an incident of national sovereignty. The Chinese Exclusion Case (1889) is the classic statement, and it is discussed in The Chinese Exclusion Case and How the Court Found a Sovereign Power to Exclude. A nation that has the sovereign power to decide who enters has the sovereign duty to use that power with care.

In Federalist No. 3, titled "Concerning Dangers from Foreign Force and Influence," John Jay argued that the safety of the people from such dangers is among the most important objects of government. The visa system is where that safety is exercised in peacetime, one traveler at a time. A conservative who believes in limited government should insist that this is one of the things government is for.

The Fourth Amendment still applies, and so do the limits on what the government may collect. But the Founders understood that a government with no power to defend the country is no government. They set limits on the power; they did not deny it.

What a citizen should take from this

The Commission's lesson is practical. It does not ask you to fear every traveler. It asks you to expect your government to do four things well: issue visas carefully, share what it knows, record who arrives and who leaves, and verify identity before it issues documents that can be used to move freely. None of that requires giving up a freedom. All of it requires paying attention, and funding the people who do the work.

The case in brief

1. The 9/11 Commission, created in 2002 and reporting July 22, 2004, and its staff monograph 9/11 and Terrorist Travel showed that the hijackers entered on visas, two violated their terms and travel documents are as important to terrorists as weapons.
2. The Ressam arrest at Port Angeles in December 1999 shows that a trained inspector at a checkpoint can stop an attack, so border and visa systems belong inside counterterrorism.
3. Reforms followed: biometric entry checks under US-VISIT in 2004, the Intelligence Reform and Terrorism Prevention Act of 2004 and the REAL ID Act of 2005.
4. Civil-liberties objections are fair and are answered by statutory limits on collection, retention and misuse, not by dropping the checks.
5. The work is unfinished in exit tracking, information sharing and identity standards, and a government whose first duty is the common defence should finish it.

What you can do: Look up whether your state's driver's license meets REAL ID standards, read your state motor vehicle agency's explanation, and ask your representative what the status of a biometric exit system is.