25 years after 9/11, spy agencies face old lessons and new threats

MalBot · September 11, 2026, 2:35pm

As Air Force One returned to Washington, D.C. on the night of Sept. 11, 2001, Michael Morell looked out a window and saw an F-16 off the aircraft’s wingtip. Beyond it, the Pentagon was still smoldering.

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

Morell, then-President George W. Bush’s intelligence briefer, had spent the day answering the president’s questions and relaying intelligence as the country tried to understand the attacks that had hit the Pentagon and the World Trade Center in New York City. A quarter-century later, that view from the window remains one of his most vivid memories.

At the National Security Agency, Rick Ledgett recalled colleagues weeping in the hallways as the agency shifted into crisis mode. Within a month, it had transferred 3,000 analysts to counterterrorism work, he said.

“Personally, it was shattering,” Ledgett, who later served as NSA deputy director, told Nextgov/FCW in an email, adding that he “saw people step up and perform in ways they hadn’t before.”

The response to the worst terrorist attack in modern history would forever transform the government they served. The efforts involved reorganizing intelligence agencies, expanding surveillance powers and drawing spies deeper into a global campaign to capture or kill suspected terrorists. It also produced longstanding debates over torture policies, targeted killings, mass surveillance, prolonged wars and disputes over presidential power that became inseparable from efforts made to keep Americans safe from another catastrophe.

Twenty-five years later, former officials describe a country better prepared to disrupt terrorist organizations, but facing a broader mix of threats from foreign governments, hackers and extremists able to reach Americans online.

“I think we’re much safer than we were on September 10, 2001, from the threat of terrorism,” Morell, who later served as CIA deputy director and acting director, told Nextgov/FCW in an interview. But threats from nation-states like China or Russia, he said, are the most significant the country has faced since the Cold War.

The<a href=“National Commission on Terrorist Attacks Upon the United States”> 9/11 Commission</a> — chartered by Congress and the White House in late 2002 to present a full accounting of the attacks and response — described in its final report failures spanning imagination, policy, capabilities and management. Agencies held pieces of information that did not come together, and domestic defenses were not effectively mobilized despite mounting warnings about al Qaeda.

Just over a month before the attacks, Morell briefed Bush on a landmark intelligence report titled<a href=“The President's Daily Brief”> “Bin Ladin Determined To Strike in US”</a> that flagged “patterns of suspicious activity in this country” consistent with preparations for hijackings and other attacks. He told Nextgov/FCW it outlined al Qaeda’s intent to attack the country but did not specifically identify when, where or how a specific plot would unfold.

Getting agencies to work together

The transformation that followed 9/11 sought to make cooperation a standing responsibility. Congress created the Office of the Director of National Intelligence in late 2004, establishing a lead unit responsible for integrating intelligence across agencies that collect data from human informants, satellite imagery, intercepted phone calls and other clandestine sources. The Department of Homeland Security was also <a href=“Homeland Security has not consolidated terrorist watch lists - Government Executive”>stood up</a> in late 2002 to drive domestic defense efforts.

The expansion also deepened agencies’ reliance on contractors. After years of workforce drawdowns following the Cold War, the federal government turned to private companies to meet demands for intelligence collection, analysis and technology support, according to a 2015 report from the <a href=“The Intelligence Community and Its Use of Contractors: Congressional Oversight Issues - EveryCRSReport.com”>Congressional Research Service</a>. Today, they play a ubiquitous, outsized role in America’s national security missions.

Lauren Goldman, a former official in ODNI’s Cyber Threat Intelligence Integration Center and National Intelligence Council, recalled a major shift in the basic expectations that governed intelligence-sharing across government and the private sector.

“The burden became on why you shouldn’t share versus why you should share,” she said. That culture has permeated many categories of today’s national security landscape, especially cybersecurity.

ODNI sought to help ensure information reached people who needed it, including officials who might otherwise have been left outside an agency’s reporting channels, Goldman said. Because the office does not collect intelligence itself, it can assess reporting without the same institutional or cultural attachment to a particular collection method, she added.

James Clapper, who served as director of national intelligence for more than six years under the Obama administration, said that coordination requires a “full-time champion.” Under pre-9/11 arrangements, the CIA director also headed the intelligence community, but agency demands often consumed the attention needed for that broader role, he said.

Clapper said the DNI position was created to coordinate intelligence agencies but was not given full authority over them. Entities like the State Department or the Pentagon, for instance, retained control of their own intelligence shops. Still, the DNI could influence their priorities through oversight of intelligence funding and a direct advisory role to the president, he said.

“I do think there’s a need for an overall champion of collaboration and integration,” Clapper told Nextgov/FCW. His remarks come as the Trump administration has sought to <a href=“ODNI deputy director pushed out amid Pulte cuts - Nextgov/FCW”>shrink ODNI’s workforce</a> and consolidate its functions, on grounds that the office has become bloated and duplicates work performed elsewhere in the intelligence community.

Ledgett credited ODNI with promoting cooperation, as well as running the National Counterterrorism Center and other hubs. But he said it had struggled to take power from individual agencies, particularly the CIA, and secure the president’s attention.

Morell said the CIA knew al Qaeda wanted to attack the United States but failed to uncover the 9/11 plot. He blamed that failure largely on a shortage of resources to gather intelligence, rather than agencies failing to share what they knew. That view differs in emphasis from the commission’s account, which identified missed opportunities to share or act on information.

Clapper said mistaken assessments about Iraq’s weapons of mass destruction programs also reshaped how spy agencies worked. The Bush administration <a href=“https://www.mcclatchydc.com/news/special-reports/iraq-intelligence/article24433474.html”>cited those assessments</a> in making its case for its 2003 invasion. Clapper, who has involvement in a <a href=“A Tale of Two Intelligence Estimates | Carnegie Endowment for International Peace”>key flawed assessment</a> of Iraq’s WMDs, said the failure pushed agencies to scrutinize their sources and challenge assumptions more rigorously. U.S. analysts, in particular, had relied heavily on an <a href=“Curveball: How US was duped by Iraqi fantasist looking to topple Saddam | Curveball | The Guardian”>Iraqi informant</a> whose claims came through German intelligence, without direct access to question him.

The limits of intelligence powers

Global surveillance became one of the defining disputes of the post-9/11 era. The NSA’s bulk collection of <a href=“NSA collecting phone records of millions of Verizon customers daily | US national security | The Guardian”>domestic telephone records</a>, exposed in Edward Snowden’s 2013 disclosures, drew scrutiny over both its intrusions into Americans’ lives and its value as a counterterrorism tool.

In 2014, the Privacy and Civil Liberties Oversight Board<a href=“Report on the Telephone Records Program Conducted Under Section 215 of the USA Patriot Act and on the Operations of the Foreign Intelligence Surveillance Court - GOVPUB-PREX29-PURL-gpo45397 | Content Details | GovInfo”> recommended</a> ending that collection program, and a federal appeals court <a href=“https://law.justia.com/cases/federal/appellate-courts/ca2/14-42/14-42-2015-05-07.html?utm_source=chatgpt.com”>ruled in 2015</a> that it exceeded what Congress had authorized under Section 215 of the Patriot Act. But other surveillance programs exposed by Snowden — including those operating under the contentious <a href=“A key spying power will sunset on Friday — here’s why - Nextgov/FCW”>Section 702 authority</a> — have remained central to U.S. intelligence-gathering.

Ledgett, who led the NSA’s assessment of the damage from Snowden’s disclosures, defended the post-9/11 surveillance effort as “legal and authorized,” though he noted the intelligence community could have done better at public relations.

The incident forever changed how lawmakers and journalists examine spy agencies’ collection activities and whether Americans’ privacy is adequately protected. Contemporary mass surveillance debates have taken on new forms, including spy agencies’<a href=“Spy agencies must craft safeguards for using sensitive commercial data, ODNI says - Nextgov/FCW”> purchases of sensitive data</a> from commercial brokers and police use of <a href=“Flock's AI search tool for police officers has been reverse engineered — here's what it shows | TechRadar”>artificial intelligence-powered tools</a> to search vast networks of information about people’s movements and activities.

The CIA’s <a href=“Psychologists' $81M Torture Contract Exposes CIA's 'Remarkably Broad' Acquisition Authorities - Government Executive”>detention, interrogation and torture practices</a> produced another reckoning. The Senate Intelligence Committee’s 2014 investigation <a href=“https://www.intelligence.senate.gov/wp-content/uploads/2024/08/sites-default-filesations-crpt-113srpt288.pdf”>concluded</a> that the agency’s coercive interrogation techniques were ineffective in obtaining intelligence or cooperation and that the CIA impeded oversight and misrepresented aspects of the program.

Morell, who has previously disputed the Senate report’s conclusions, argued that responsibility also belonged to the president and other authorizing officials, and he rejected the idea that the agencies had acted entirely on their own.

Asked whether the country went too far in its broader response in the War on Terror, Morell said that “as a nation, we overreacted,” pointing mainly to the Iraq War and the length of the war in Afghanistan.

Intelligence agencies also helped identify and track suspected terrorists for controversial targeted killings, including those carried out through U.S. drone strikes. The <a href=“Humanitarian Groups Say It Is Time For Obama to Acknowledge More Civilian Deaths in Drone Strikes - Government Executive”>debate</a> reached American citizenship itself when the government targeted Anwar al-Awlaki, an American and al Qaeda operative, in a lethal strike. Defending the action in 2013, then-President Barack Obama <a href=“Remarks by the President at the National Defense University | whitehouse.gov”>argued</a> that citizenship could not shield an operative plotting attacks when capture was not feasible.

Today, drones have become a <a href=“How Ukraine won the first great robot war - Defense One”>battlefield mainstay</a> in Russia’s war against Ukraine, and Western militaries are studying how to build, deploy and counter them. Weapons that drew scrutiny for their role in U.S. counterterrorism operations are now also held up as examples of military innovation, with NATO <a href=“Drones – Lessons from Ukraine | NATO Video”>learning directly</a> from Ukrainian drone operators. But questions about whom they kill and how they are used persist, as the United Nations documents their growing <a href=“https://www.reuters.com/world/europe/drones-become-most-common-cause-death-civilians-ukraine-war-un-says-2025-02-11/”>toll on civilians</a>.

The fight over intelligence powers also became increasingly partisan. President Donald Trump’s disputes with intelligence officials over Russia’s interference in the 2016 election helped fuel his accusations that agencies were being used against him. A bipartisan <a href=“https://embed.documentcloud.org/documents/6844148-Report-Volume4/”>Senate investigation</a> upheld the intelligence community’s finding that Moscow sought to help him win. But allegations of political “weaponization” became a <a href=“Ending The Weaponization Of The Federal Government – The White House”>recurring theme</a> in Trump’s criticism of intelligence and law enforcement agencies.

A changing threat landscape

Intelligence agencies now face a wider range of threats, including foreign hackers with access to fast-evolving AI tools.

Morell said the United States learned how to degrade terrorist organizations by denying them safe havens where they could train, raise money and prepare attacks. But the growing reach of digital networks has created other ways to threaten the U.S. without physically entering it.

Goldman pointed to critical infrastructure, where connected systems can allow the effects of an intrusion to spread beyond a single building or city, as a target of such threats. Hardening airports and other physical targets has value, she said, but does not eliminate vulnerabilities created by that cyber interconnectedness.

State-backed hacking illustrates the stakes. About six years ago, Russian cyber operatives<a href=“The Hack Roundup: White House Sanctions Russia over SolarWinds - Nextgov/FCW”> compromised SolarWinds software</a> as part of an espionage campaign that infiltrated multiple federal agencies and some 100 private companies. China-linked<a href=“US agencies assessed Chinese telecom hackers likely hit data center and residential internet providers - Nextgov/FCW”> Salt Typhoon hackers</a> later penetrated major telecommunications networks, targeting senior officials’ communications and accessing systems used for court-authorized wiretaps. And another Chinese campaign,<a href=“Chinese hackers embedded in U.S. networks for years, pre-positioning for future attacks, IC warns - Nextgov/FCW”> Volt Typhoon</a>, embedded hackers in American critical infrastructure, with U.S. officials warning that the access could enable disruption during a future conflict.

Terrorist groups have also found new ways to spread propaganda and reach potential recruits online. The Digital Citizens Alliance and cybersecurity firm risk3sixty recently examined 25 piracy-based internet television services and <a href=“https://hostile-signals.digitalcitizensalliance.org/”>identified</a> terrorist-linked broadcasters on 17 of them. Hezbollah’s Al-Manar satellite television station appeared on all 17, according to their analysis.

Some terrorism-prevention measures have also lapsed. A Sept. 8 Government Accountability Office <a href=“https://www.gao.gov/products/gao-26-108127”>report</a> found that the 2023 expiration of the Chemical Facility Anti-Terrorism Standards program ended continuous screening of roughly 500,000 people for possible terrorist ties. The program covered about 3,200 high-risk chemical facilities, whose owners cannot independently access federal terrorist watchlist information.

As officials who lived through 9/11 reflect on their time in government, they want the next generation to remember how warnings were missed and what it took to get agencies working together.

Goldman said analysts need to keep questioning their conclusions, examining blind spots and sharing information, despite the demands of daily work. Clapper emphasized the difficulty of persuading policymakers to act on a danger the public has not yet experienced.

Ledgett expressed confidence in those who will take their place.

“Everyone eventually retires, and organizations continue,” he said. “The next generation steps up and delivers when needed.”

The U.S. is skilled at responding once a crisis arrives, but has struggled to prepare before it does, Morell said.

“Becoming a nation, a White House, a Congress, an American people that is proactive in preventing things — preventing bad things — is much better than only being reactive to them,” he said.

Article Link: 25 years after 9/11, spy agencies face old lessons and new threats - Nextgov/FCW