Saturday marks the 20th anniversary of the 9/11 terror attacks that led to a turning point in the security profession and the beginning of America's longest war in Afghanistan.

On the morning of 11 September 2001, 19 al Qaeda militants boarded four U.S. commercial flights bound for the West Coast and used box cutters they were allowed to take through airport security to hijack the flights once in the air. The hijackers then flew two of the planes into the World Trade Center towers in New York City, and one of the planes into the Pentagon in Washington, D.C.

Crew members and passengers overtook the hijackers of the fourth plane, bringing it down in Pennsylvania before it could crash into its intended target—which remains unknown. Many suspect that the hijackers intended to fly it into the U.S. Capitol or the White House, the home of the U.S. president.

More than 430 companies conducted business in the World Trade Center’s two towers, with an estimated 50,000 people working there on an average day and 140,000 people passing through as visitors. Hijackers flew the first plane into the North Tower at 8:46 a.m.; the second plane flew into the South Tower at 9:03 a.m. Some people were able to evacuate the towers as New York City firefighters arrived on the scene to assist with the evacuation and control the fires caused by the crashes. The South Tower collapsed at 9:59 a.m., followed shortly by the North Tower at 10:15 a.m.

Following the towers’ collapse, first responders began a massive search and rescue mission in an attempt to locate survivors. Fred Endrikat, a member of the Urban Search and Rescue Team dispatched by the U.S. Federal Emergency Management Agency (FEMA), was one of the individuals involved in the effort and shared his recollections of the response in a FEMA blog post. 

“I had deployed a number of times to different disasters that were primarily weather related,” Endrikat said. “This one was different because of the type of incident that it was, but also I think, on a personal note, it was very different because a number of the people that were later determined to be lost at the World Trade Center were NYC firefighters who were personal friends of mine…so I was responding to an incident where I personally knew some of the victims.”

The maritime sector also began one of the largest mass evacuations ever conducted when 150 commercial vessels transported 500,000 people out of the disaster zone of lower Manhattan to New Jersey and Brooklyn.

“Nearly half a million people are vacated by boat, in a spontaneous, completely non-orchestrated effort,” said Jessica DuLong, author of Saved at the Seawall: Stories from the September 11 Boat Lift, in an interview with Smithsonian magazine. “Individual mariners working together, individual boat crews doing what they can do. It was orderly, in most cases, but it was not organized.”

Meanwhile in the Washington, D.C., area, American Airlines Flight 77 crashed into the Pentagon—the headquarters of the U.S. Department of Defense—at 9:37 a.m. A section of the outer ring of the five-sided building collapsed at 10:15 a.m. as first responders worked to control the flames and evacuate people inside. The White House, the U.S. Capitol, and multiple other U.S. government buildings were evacuated as a precautionary measure.

At 10:03 a.m., Flight 93 crashed near Shanksville, Pennsylvania, after passengers and crew stormed the cockpit to attempt to retake control of the aircraft. All 40 passengers and crew members died. The airplane was merely 20 minutes flying time from Washington, D.C.

The U.S. Federal Aviation Administration (FAA) issued an unprecedented order that grounded all commercial flights in the United States. U.S. Vice President Dick Cheney also authorized the U.S. military to shoot down any flight that did not comply with the FAA order. This meant that they only plane in the air was Air Force One, carrying U.S. President George W. Bush across the United States before addressing the nation at 8:30 p.m. that a search was underway for “those who are behind these evil acts.”

Following his return to Washington and subsequent strategy meetings with military leaders, Bush—with Congressional approval—would authorize U.S. forces to invade Afghanistan, push out the Taliban government that had allowed al Qaeda to use the nation as a base of operations, and attempt to reform the country to ultimately hand over control of the nation to a democratic Afghan government. With the withdrawal of U.S. troops this summer and the subsequent takeover by the Taliban, that effort failed.

The 9/11 attacks killed 2,996 people and injured approximately 25,000 others in the deadliest terror attack in U.S. history. Of those killed were 403 first responders, making it the largest loss of life of U.S. first responders in a single incident. Twenty years later, many of the survivors of the New York City attacks are now dealing with health problems related to the dust they inhaled after the towers’ collapse. 

The attacks drastically changed everyday people’s relationship with security departments, overhauling aviation security for airports and passengers and placing new emphasis on the need to train for evacuations, like those conducted by ASIS member Richard Rescorla, CPP, whose regular evacuation drills helped save 2,687 Morgan Stanley employees working at the World Trade Center on 9/11. 

“Rescorla taught Morgan Stanley employees to save themselves,” wrote Amanda Ripley in her book The Unthinkable: Who Survives when Disaster Strikes—And Why. “It’s a lesson that had become, somehow, rare and precious. When the tower collapsed, only thirteen Morgan Stanley colleagues—including Rescorla and four of his security officers—were inside. The other 2,687 were safe.”

The attacks also had a transformative effect on security risk management, says James Wood, head of security solutions at International SOS. 

"The risk of terrorism had come directly into business operations, impacting employees as it never had before," he explains. "Duty of care came to the fore with regards to security risks, both from a legislation perspective and the growing responsibility for corporates. The C-suite and boards of organizations recognized the risk, to their people and their business, and that they were sometimes even able to be held personally liable for employee safety and security. It became critical to be able to know where employees were at any given time."

Measures taken after the attacks also provided security departments and local law enforcement with billions of dollars to enhance security training and technologies. The U.S. Department of Homeland Security has awarded more than $36 billion in preparedness grant funding to prevent, protect against, respond to, and recover from threats or acts of terrorism since 2003. 

Following the attacks, the U.S. government also underwent major changes. Bush created the 9/11 Commission in 2002 to conduct a full investigation into how the attacks were planned, carried out, and gaps and failures that allowed them to succeed. It released its public report in 2004.

In the introduction, commission members Thomas H. Kean and Lee H. Hamilton wrote that the United States was “unprepared” due to a failure of “policy, management, capability, and—above all—a failure of imagination.” 

“We recognize that we have the benefit of hindsight. And since the plotters were flexible and resourceful, we cannot know whether any single step or series of steps would have defeated them,” Kean and Hamilton explained. “What we can say with confidence is that none of the measures adopted by the U.S. government before 9/11 disturbed or even delayed the progress of the al Qaeda plot.”

Scott Stewart, vice president of intelligence of Torchstone Global, echoes those sentiments. Stewart, who was the lead diplomatic security service special agent assigned to the 1993 World Trade Center bombing investigation, says that the lasting lesson of 9/11 for security practitioners is that threat actors can be agile, adaptive, and creative.

“If they are given time to observe, test, and probe static security measures and procedures, they will be able to identify vulnerabilities that can be exploited—sometimes with very simple tactics, e.g. using boxcutters they were allowed to carry aboard aircraft to hijack them, and then using the aircraft as human-guided cruise missiles,” he says.

In response, Stewart says security programs “must also be agile, adaptive, and creative, so that they have the capacity to proactively foresee and prevent attacks. Responding to attacks is not enough: we must work to anticipate and prevent them.”

The 9/11 Commission made a series of recommendations designed to do just that, calling for a global counterterrorism strategy and a reorganization of government structures and departments. Those recommendations led the establishment of the National Counterterrorism Center, the appointment of a national intelligence director, Congressional oversight in both the Senate and House of the newly formed U.S. Department of Homeland Security, and changes in information sharing. It also called for a more robust FBI with a specialized national security workforce.

“Day and night, dedicated public servants are waging the struggle to combat terrorists and protect the homeland,” Kean and Hamilton wrote. “We need to ensure that our government maximizes their efforts through information sharing; coordinated effort; and clear authority.”

To a large extent, the U.S. national security apparatus has done that, wrote FBI Director Christopher Wray in an essay for The Washington Post on the 20th anniversary of 9/11.

“As a result of changes made in response to 9/11—and thanks to a lot of hard work by the FBI and our partners and some good fortune—we have not experienced another large-scale attack from a foreign terrorist organization on American soil,” Wray wrote. “But make no mistake: As the Islamic State attack and tragic loss of 13 brave American service members and nearly 200 Afghans in Kabul last month painfully reminded us, the threat has not disappeared. To the contrary, over the past 20 years, as technology advanced and the world became more interconnected, familiar threats transformed and new ones emerged.”

Now, instead of the foreign terrorist fighter, the focus is on the challenge of domestic violent extremism, said U.S. Department of Homeland Security Secretary Alejandro Mayorkas in a speech at the National Press Club on Thursday.

“The threat has evolved; now it’s the domestic violent extremist. The individual who is radicalized by violence by reason of an ideology of hate or false narratives propagated on social media and other online platforms,” Mayorkas explained.

In the September issue of Security Management, Stewart writes about the current state of the jihadist movement 20 years after the 9/11 attacks.

“Today, the main threat posed by the al Qaeda pole of the jihadist movement outside of its primary areas of operation stems from grassroots jihadists who think globally but act locally, posing a far larger threat to the institutions and people of the countries its franchise groups are based in than to the West,” he writes.

However, that does not mean that the prior iteration has disappeared from the threat landscape, especially in light of the Taliban takeover in Afghanistan close to the anniversary of 9/11. The risk of militancy is a feature of the international security landscape, and the anniversary combined with the Taliban's takeover raises the likelihood of solidarity attacks, Wood says.

"Our intelligence teams have been monitoring the situation in Afghanistan closely, with a particular focus on high risk locations where Islamist militant groups have operational freedom and state capacity to respond is weak but also in lower risk locations where vehicle ramming and knife attacks are possible," Wood says. "Organizations need to have robust and reliable information sources, be able to asses the changing threat level, and agility to respond at speed when needed."