Congress Just Admitted A Key 9/11 Security Gap Remains

Twenty-five years after the September 11 attacks, the United States still has not fully implemented one of the border-security reforms recommended by the 9/11 Commission.

That’s according to a bipartisan review released this week by the House Permanent Select Committee on Intelligence, which found that the Commission’s call for a biometric entry-exit screening system to be created “as quickly as possible” is still incomplete.

Air exit is considered nearly complete, according to the committee. Sea exit remains incomplete, as does biometric land exit at both the northern and southern borders. Even biometric exit at the southern border is listed as incomplete and relies in part on re-entry data.

The finding matters because the ability to determine whether a foreign traveler had actually left the United States was one of the problems exposed during the investigation into the 9/11 plot.

Nawaf al-Hazmi entered the United States in January 2000 after attending an al-Qaeda meeting in Kuala Lumpur with Khalid al-Mihdhar. Both men later lived in California. By August 2001, U.S. authorities had finally begun trying to locate them. On August 22, immigration officials told investigators that Mihdhar had entered the United States again on July 4. They also found no record showing that Hazmi had left after entering the country in January 2000.

Investigators assumed he had probably departed with Mihdhar the previous year. He had not.

Hazmi was still in the United States, and on September 11 he and Mihdhar hijacked American Airlines Flight 77 and crashed it into the Pentagon.

A Gap 9/11 Exposed

The 9/11 Commission later found that Hazmi had overstayed his authorized stay by nine months. Another hijacker, Satam al-Suqami, had overstayed by four months. Neither violation was detected or acted upon before the attacks.

The problem went well beyond two visa overstays. The Commission found that travel documents and travel patterns might have given authorities an opportunity to intercept between four and 15 of the 19 hijackers. Information existed across intelligence, immigration, and travel systems, but too often it was not connected or acted upon in time.

One of the Commission’s recommendations was straightforward: the Department of Homeland Security (DHS), with support from Congress, should complete a biometric entry-exit screening system “as quickly as possible.” The goal was not simply to know who entered the country. It was to connect a person’s identity to travel records and know when that person left. That recommendation came in 2004.

Much of the system envisioned by the Commission has since been built. Biometric screening is now complete for air entry, sea entry, and pedestrian land entry, according to the House report. U.S. Customs and Border Protection (CBP) says facial biometrics are used for entry at all international airports and for international departures at 57 airports.

The technology can compare a traveler standing at a checkpoint or departure gate against government-held passport, visa, or previous-entry photographs. That provides something a name and passport number alone cannot: biometric confirmation that the person associated with the travel record is actually the person entering or leaving.

The system is already producing results. In an August 2026 final rule, DHS said facial biometric matching at exit had confirmed more than 516,000 overstays between June 2017 and October 2025. The same filing said CBP had intercepted more than 2,200 impostors using facial biometrics at airports and pedestrian land crossings.

Those numbers are not evidence that hundreds of thousands of terrorists are moving through the country, and they should not be treated that way. They do show why confirming identity and departure has value.

The question is why the system still does not cover every way someone can leave the United States.

Exit Is the Hard Part

The United States has never operated a comprehensive immigration exit-control system.

International travelers can leave through airline gates spread across an airport, while land borders create a much larger infrastructure problem. Thousands of vehicles can move toward Canada or Mexico each day, and collecting biometrics from the people inside them without creating major backups is very different from photographing someone standing at an airport inspection booth.

That helps explain the delay. It does not explain all of it. Congress first directed the federal government to create an automated entry-exit system in 1996, five years before the deadly terror attacks. The system Congress envisioned did not exist when Hazmi and Suqami overstayed their authorized stays, a point the 9/11 Commission later made explicitly.

Congress and successive administrations have returned to the issue repeatedly since then. New laws required integrated arrival and departure databases, biometric technology, and greater interoperability with law enforcement systems. In 2017, President Donald Trump directed DHS to expedite the biometric entry-exit system recommended by the 9/11 Commission.

A major change came last year. In October 2025, DHS finalized a rule allowing photographs to be required from noncitizens entering and departing the United States and removing earlier limits that had confined some biometric exit collection to pilot programs and specific ports. The rule took effect in December.

The legal authority, however, did not mean the system suddenly existed everywhere. In that same 2025 rule, CBP said it was still determining the best approach for biometric exit at sea and land borders, as well as for private aircraft. The agency had not completed cost-benefit analyses for several of those environments because it was still deciding how the systems would actually work.

CBP estimated that a biometric entry-exit system could be fully implemented at commercial airports and seaports within another three to five years. For vehicles and other land-border exits, the agency said it would continue studying and testing possible solutions.

That is where the timing becomes difficult to ignore. The entry-exit requirement began in 1996. The 9/11 Commission called for a biometric system in 2004. More than two decades later, CBP was still determining how parts of it should work.

Finishing the System

The House Intelligence Committee is now calling for a more complete approach. Its new report recommends that foreign nationals pass through control points when both entering and departing the United States. At land borders, the committee says the system should, as much as practical, direct departing foreign nationals through points where CBP can collect biometrics.

That would be a much bigger undertaking than adding more facial-recognition cameras at airport gates. Some land crossings would likely require changes in traffic patterns, infrastructure, and staffing. It would also require money.

DHS raised that issue again just weeks before the House report was released. In an August 2026 final rule dealing with the 9-11 Response and Biometric Entry-Exit Fee, the department said inadequate funding threatened both existing biometric operations and continued implementation of entry and exit programs. The statutory fee currently supporting part of that work is itself scheduled to expire in September 2027 unless Congress extends it.

That last part deserves attention because the next phase is not simply about collecting more photographs. A biometric system can confirm who someone is. It cannot tell a border officer that the person is connected to al-Qaeda, ISIS, a foreign intelligence service, or another threat unless the intelligence needed to make that connection has already been collected, shared, and entered into the systems used for screening.

The House Intelligence Committee makes that point directly. It warns that screening and vetting are heavily dependent on foreign intelligence collection. If information about a terrorist suspect does not exist in the relevant databases, even a perfectly functioning biometric system has very little to match against.

That is an important distinction. A completed biometric exit system would not have prevented 9/11 by itself. The attacks involved failures in intelligence collection, information sharing, watchlisting, and analysis that went far beyond immigration records. But the inability to reliably determine whether certain people were still inside the United States was one of those failures.

By August 2001, U.S. authorities had finally uncovered information showing that Hazmi had traveled to Los Angeles and that Mihdhar had recently returned to the United States. Both men were added to the TIPOFF watchlist on August 24. A lead was eventually sent to the FBI’s New York field office on August 28, but it was marked “Routine,” which gave the office 30 days to respond. The lead was sent just 14 days before September 11, and the search came far too late.

The United States has changed dramatically since then. Intelligence sharing improved, watchlisting expanded, aviation security was rebuilt, and border screening became far more sophisticated where those systems were actually implemented. The new House Intelligence Committee review credits those reforms with helping prevent another attack on the scale of 9/11 so far.

But its report also shows that one of the more basic recommendations remains unfinished. The government is far better today at knowing who enters the United States. The next step is finishing the system that tells us, with the same confidence, who left.