Why the terrorists won 9/11

Let's talk about the two-trillion-dollar elephant in the room: the security response to 9/11. Terrorism, at its core, isn't violence for violence's sake; it's about disruption. The immediate tragedy is devastating, but the broader impact is psychological and societal. Terrorists seek to alter how people live, and in that sense, 9/11 succeeded, not only because of the horrific loss of life, but because the response fundamentally changed the way we experience air travel and perceive security.

In security engineering, there's a simple but powerful concept known as the CIA triad:

• Confidentiality: Keeping things secret.
• Integrity: Preventing things from being altered.
• Availability: Ensuring reliable access.

Usually, security professionals compromise on availability first. That means you sacrifice ease of access or usability to protect confidentiality and integrity. Applied to the 9/11 attacks, the asset needing protection wasn't just passenger safety, but specifically the cockpit itself.

So what happened?

Hijackers carried knives (at the time, knives up to three inches were permitted) onto four commercial aircraft. They used these knives to take control of the cockpits, crashing two planes into the World Trade Centre towers, another into the Pentagon, and the fourth, intended for the White House, was heroically diverted into a field by courageous passengers.

In response, the entire aviation industry implemented dramatic and visible changes. Heightened passenger screening became the norm, expensive, intrusive, and highly visible, but largely ineffective. Even today, audits reveal that airport security routinely misses a significant proportion of potential threats. Meanwhile, reinforced cockpit doors, introduced after the attacks, effectively eliminated mid-flight hijacking as a viable threat.

But here's the kicker: despite cockpit doors effectively solving the original security vulnerability, we've maintained, and even expanded, burdensome, disruptive, and essentially theatrical security measures. Why?

Security Theatre

Because many organisations, and particularly governments, tend toward visibly demonstrative security measures, they often favour appearance over effectiveness. They want to be seen "doing something," and in the case of aviation, "something" meant intrusive security checks, cumbersome policies, endless certification processes, and costly auditing programs, all generating the illusion of security while providing minimal genuine improvement.

This isn't just an aviation problem; it's systemic. Policies alone achieve nothing without effective mechanisms to enforce them. And mechanisms are meaningless without thoughtful policies guiding their design. Yet, too often, organisations choose superficial measures because they offer immediate comfort, they "feel secure." And thus, security theatre is born.

What should we have done differently?

Effective security begins with asking three simple questions:

1. What exactly are we protecting? (In this case, the cockpit.)
2. Why are we protecting it? (To prevent hijacking.)
3. What happens if we fail to protect it? (Loss of life, psychological trauma, societal disruption.)

Had this thinking been followed immediately after 9/11, the emphasis would have remained squarely on securing cockpits. Resources could have been effectively allocated, minimising disruption, and focusing effort where it mattered most, rather than draining billions into systems that inconvenience millions daily with questionable gains.

The uncomfortable truth

By allowing terrorism to fundamentally alter how we approach security, reactively, visibly, and inefficiently, the terrorists, in a sense, won. The overreaction, the misallocation of resources, and the continued inconvenience to passengers demonstrate exactly how terrorism achieves its fundamental objective: disruption.

As a rather clever person recently said to me, "Anyone who enjoys writing security policies shouldn't be allowed to." Policies without pragmatism serve no one. Effective security requires holistic thinking. It demands an honest assessment of threats, consequences, and proportionality. Without that, all we have is theatre, and that's precisely why the terrorists of 9/11 achieved far more than they ever intended.