Counterterrorism Used to Be About Borders. Now It’s About Bandwidth.
On Thursday, September 17, I joined Bill Lundun on The Wake Up Call on KPNW 1120 AM and 93.7 FM out of Eugene, Oregon. The question on the table: 25 years after 9/11, is the Department of Homeland Security still doing the job Congress built it to do?
Congress built DHS in 2002 out of 22 agencies with one mission. Stop the attack, harden the target, recover fast. The debate now is whether immigration enforcement has pulled the department away from that mission. My answer on air was that the debate misses the bigger shift. The threat changed shape, and the burden of catching it moved closer to home.
Two things can be true
Earlier this month two former DHS secretaries, Michael Chertoff and Jeh Johnson, said in a joint NBC News interview that the department needs a reset. Chertoff served under President Bush. Johnson served under President Obama. DHS answered that counterterrorism and immigration enforcement go hand in hand.
When secretaries appointed by both parties say the same thing, it is worth hearing. Enforcement also catches real threats. Both statements hold up. A department can enforce the law at the border and still resource the counterterrorism mission. The useful question is where the next attack will come from, and that question does not have a border answer.
What a watchlist number tells you
Border Patrol logged 385 terrorist watchlist encounters between ports of entry at the Southwest border from fiscal year 2021 through fiscal year 2024. The prior four years produced 11.
Read that number with care. Those are encounters, not unique people, and CBP notes that totals can count one person more than once. The watchlist is not a list of confirmed terrorists. CBP describes it as a dataset of known or suspected terrorists that now includes known affiliates of watchlisted individuals.
The number that should worry you isn't the 385 encounters we logged. It is the number nobody can count: people already inside the country, or people who crossed without a single flag on their record.
The threat changed shape
The 9/11 plot took 19 hijackers who entered the country on tourist, student, and business visas. It took years of planning, money, and travel.
A single person with a phone can move from grievance to target selection in weeks today. No team. No travel. Researchers call part of this "salad bar extremism," where a person pulls pieces from several ideologies and builds a private justification out of the mix.
Foreign groups still matter. Al-Qaeda and ISIS are rebuilding. My read, shared by many in the intelligence community, is that if they strike here, they will do it through people who already live here. The attackers are not swimming across our borders. They already live here, and the recruiting happens in group chats.
Counterterrorism used to be about borders. Now it's about bandwidth.
Grievance comes first
Bill asked whether foreign groups recruit people into their ideology or push people who already carry anger. The answer depends on the person, but the pattern starts the same way.
It starts with a grievance. A person believes a group, a government, or an institution wronged them or their family. Outside influence supplies the propaganda that feeds the grievance until the person decides someone has to pay. Whatever the ideology, the grievance drives it.
The data backs this up. The U.S. Secret Service National Threat Assessment Center studied 173 targeted attacks in public places from 2016 through 2020. Half of the attackers acted on grievances tied to personal, domestic, or workplace disputes. About three in four showed behavior that concerned people around them or made concerning statements before the attack.
That last finding is the whole argument. Attackers do not come out of nowhere. Someone saw something.
It won't be a federal agent who notices
A federal analyst will not see a teenager's posts shift from anger to planning. A parent might. A youth pastor might. So might a coach, a coworker, or the neighbor who hears a man talk about making someone pay.
The behaviors worth noticing:
Talk of revenge against a specific person, group, or institution.
A sudden interest in past attacks and the people who carried them out.
New fixation on weapons, tactics, or security at a particular location.
Withdrawal from family and friends, paired with new online communities the person keeps private.
Statements that hint at a plan.
If you see it, report it. In Texas, iWatchTexas takes reports online and through its app. The FBI takes tips at tips.fbi.gov. If a threat looks imminent, call 911.
What this means for churches, schools, and venues
Churches, schools, and event venues sit at the center of this problem. They gather people, they welcome strangers, and their staff know the members of their community better than any agency does.
That makes them the first line of detection, whether they planned for the role or not. Three questions every leadership team should answer this year:
Who receives a report of concerning behavior, and what happens next?
Does your staff know the warning signs, or the evacuation routes alone?
When did someone with a trained eye last walk your building and map how an attacker would approach it?
A threat and vulnerability assessment is one way to answer the third question. It looks at your site the way a hostile planner would and leaves you with a written plan you control.
PRO-tect Premier Investigations (TX DPS Class C License #C28696201) performs our assessments. PRO-tect is an affiliated firm in which our founder holds an ownership interest. Findings belong to the client, and the client may use them with any provider.
Thirteen Alpha Solutions LLC · TX DPS Class C License #C31017501
4364 Western Center Blvd #2105, Fort Worth, TX 76137
SDVOSB certified · TALI member · Insured and bonded
