Five years after 9/11, question is: Could it happen again?

On the morning of September 11, 2001, 19 terrorists thwarted every layer of aviation security designed to prevent a hijacking. Then they turned four fully fueled jetliners into the only weapons of mass destruction ever effectively used in the United States. They faced little opposition from the U.S. government, which was -- at least nominally -- responsible for defeating them. In fact, the terrorists succeeded in killing nearly 3,000 people because almost every obstacle put in place to stop them failed, was foiled, or was utterly unsuited to the threat. In some instances, authorities simply had no countermeasure to halt the terrorists' advance. The only effective resistance that the hijackers encountered that day came at the hands of their airborne victims, all of whom died with them.

The most obvious, the most basic question as the sun set on 9/11 was, "How did this happen?" To find out, Congress created the National Commission on Terrorist Attacks Upon the United States, which will forever be known by a simpler title, the 9/11 commission. In the summer of 2004, the commission released what is, without question, the most exhaustive and authoritative account of the assault. The minute-by-minute narrative of the deadly chaos is gripping in its detail and precise in its timing, and it ultimately leaves the reader asking one important question: "Could it happen again?"

The instinctive answer is probably "Of course not." Passengers would never allow four or five lightly armed hijackers to take over an airplane. Not after 9/11. They would beat them to within an inch of their lives -- maybe closer. And besides, the terrorists would never dare to try the same attack twice.

But the recent news that British intelligence thwarted a plan to blow up civilian jetliners using liquid explosives, unbeknownst to the passengers, tells us otherwise. That tactic was first conceived in 1995, by the man who tried to destroy the World Trade Center in 1993, and his uncle, the mastermind of 9/11. Terrorists don't abandon methods. They repeat them.

The 9/11 commission's report is not just the most damning account of how the terrorists succeeded. It is an unprecedented analysis of the myriad structures, processes, and people responsible for protecting the nation. Its most painful lesson is that the United States is too big, its bureaucracy too clumsy, its society too open to seal up every hole the terrorists slipped through that day. That didn't stop the commission from issuing 41 recommendations for making the nation safer -- not just from terrorism, and not just in the air. But five years later, the commission says that the Bush administration, Congress, and the private sector have failed to act meaningfully on almost half of those recommendations.

Does this failure mean that, today, 19 terrorists could board four airplanes, subdue their passengers, and fly the planes right over the heads of the nation's leaders, right past the ferocious firepower of the U.S. military, just as they did five years ago?

To get at the answer, National Journal went back to the 9/11 commission's report. What follows is a narrative of the attacks, taken almost entirely from the report itself and sometimes using its wording, for the sake of precision. This is accompanied by an update on the vulnerabilities exposed by the report. Have they been fixed? Have they even been addressed? Did remedies for existing weaknesses create new ones? The answers to those questions bring us closer to knowing whether another 9/11 is in our future.

Entering The United States

Then: Months before he piloted American Airlines Flight 11 into the north tower of the World Trade Center, Mohamed Atta had come to the attention of U.S. authorities. In January 2001, he persuaded an inspector with the Immigration and Naturalization Service to let him into the country so that he could continue pilot training at a U.S. school, even though he presented no student visa.

Now: After 9/11, the INS, widely viewed as dysfunctional, was disbanded. Today, stricter regulations for issuing student visas are in place. Any foreigner entering the United States on a student visa must be registered in a government computer system. However, the schools themselves have generally been responsible for entering the data, and have borne the burden of alerting federal officials when students don't show up for classes. In that case, federal officials are supposed to track them down. In August, several Egyptian students who were granted visas to attend a summer program in Montana never showed up at their assigned school, and the FBI launched a nationwide manhunt to apprehend them.

Then: The hijackers who boarded United Airlines Fight 175, which struck the south tower, had also talked their way into the United States to take flight training without student visas. Nawaf al-Hazmi and Khalid al-Midhar, who boarded American Airlines Flight 77, which was flown into the Pentagon, had visitor visas. The Central Intelligence Agency knew this, but officials there didn't inform the State Department and other authorities when the two men -- who had been under agency surveillance as suspected terrorists -- boarded a United Airlines plane in Bangkok and came to Los Angeles on January 15.

Now: Laws and regulations have been changed to encourage, and in some cases require, intelligence agencies to share terrorism information with law enforcement agencies. Officials credit the interagency Terrorist Threat Integration Center with bringing together streams of intelligence that historically were kept separate, and with alerting the Transportation Security Administration, now in charge of aviation security, and military officials to threats against airplanes and airports.

Then: Had officials at the National Security Agency been alerted, they might have found records of al-Hazmi in their databases.

Now: The NSA is known to have shared information about suspected Al Qaeda operatives with law enforcement agencies immediately after the attacks. It has since increased monitoring of communications involving suspected Qaeda operatives both inside and outside the United States, some of it under the controversial "terrorist surveillance program."

Then: And had officials at State been told of the men's identities and suspected ties, they would have discovered that al-Hazmi and al-Midhar had been issued U.S. visas in the same city -- Jidda, Saudi Arabia -- within days of each other.

Now: The State Department determines who gets U.S. visas, but the Homeland Security Department controls U.S. ports of entry. The latter department has undertaken a multibillion-dollar effort -- the US-VISIT program -- to log the entry and exit of every visitor; the system, however, is not yet fully deployed nor fully integrated with other tracking systems, such as the one that monitors foreign students. And visitors from many nations, mostly in Europe, can enter the United States without a visa -- just as Americans can enter those countries without a visa.

Then: On 9/11, all but one of the hijackers were here on visitor visas, which allowed them to stay in the country for six months. That gave them time to finalize the plot and to obtain state-issued identification cards needed to board the airplanes. Although one hijacker didn't have a state ID, he was allowed on the plane anyway.

Now: Anyone entering the United States through an airport, seaport, or border crossing that has the US-VISIT entry-exit system must submit a biometric identifier -- fingerprints and a photograph -- if the visitor hasn't already done so at the U.S. consular office that issued the visa. The visa's expiration data is logged into VISIT, and if the holder has not left the United States by that date, his visa is voided and immigration enforcement can detain him. The VISIT program is far from perfect, according to analysts, and will take some time to deploy at every U.S. port of entry.

Then: Once in the country, some of the hijackers aroused suspicion, particularly among flight instructors who noticed that although the men wanted to pilot commercial jetliners, they had little interest in learning how to land them. Reports of Middle Eastern men at flight schools also attracted the attention of FBI officials in at least two field offices, but superiors rejected their requests for more intense surveillance.

Now: In the half-decade since 9/11, the FBI has tried to improve its intelligence-gathering and information-sharing capabilities. The bureau has created a national security division that is responsible for assessing terrorist threats. But the CIA has become the de facto leader in the "global war on terror," and the FBI still struggles to establish a modern computer system capable of analyzing the vast amount of potentially useful information that field agents acquire.

Boarding The Planes

Then: Early on the morning of September 11, Mohamed Atta and a fellow hijacker flew from Portland, Maine, to Boston's Logan Airport, where the two men were to board American Airlines Flight 11 bound for Los Angeles. When Atta checked in at Portland, the government's Computer Assisted Passenger Prescreening System flagged him for additional inspection, which consisted of holding Atta's checked bags off the aircraft until it was confirmed that he was aboard. CAPPS also flagged three hijackers on Atta's team when they checked in at Logan, but again the flag affected only how the airlines handled their checked bags. CAPPS had been implemented a few years earlier to prevent terrorists from putting explosives in baggage, and then not boarding the aircraft themselves.

Now: CAPPS has undergone at least three iterations. The Transportation Security Administration is trying to launch the Secure Flight System to screen airline passengers. But deployment has been beset by delays, management problems, and unresolved concerns about how the system would protect passenger privacy. The current screening system, which relies on antiquated technologies, has kept some suspicious passengers off planes, officials say, but not all of them. The system has also flagged individuals who were clearly not terrorists, calling into question its efficacy.

Then: As Atta's team boarded Flight 11, another team of five was checking in at Logan for United Airlines Flight 175. Two of the Flight 175 hijackers had trouble understanding standard security questions, such as whether they were carrying any items given to them by unknown persons. The United ticket agent had to repeat the questions slowly until the men answered properly. The hijackers then proceeded to the security checkpoint.

Now: Ticket agents today may flag passengers for further screening, but they're not a first line of defense, and they are no longer required to ask passengers security-related questions.

Then: The Flight 11 and Flight 175 hijackers passed through security checkpoints operated by companies under contract to the airlines.

Now: The federal TSA handles all airport security. Some airports use private contractors to check passengers' identification before they enter the checkpoint.

Then: All of them walked through metal detectors set up to react to items with at least the metallic content of a .22-caliber handgun.

Now: Metal detectors have been recalibrated to react to smaller metal objects.

Then: If any one of them had set off the detector, he would have been screened by hand using a more sensitive, metal-detecting wand.

Now: Passengers who trip the metal detectors are patted down by a TSA screener.

Then: Also, the hijackers' bags were run through an X-ray machine to examine their contents; nothing suspicious was found.

Now: TSA screeners have color monitors that help them distinguish objects of different density, which can help the screeners find explosives. But the machines do not detect explosives. Screeners can search for trace explosives using separate equipment.

Then: Meanwhile, at Dulles International Airport outside Washington, every member of the team preparing to hijack American Airlines Flight 77 faced additional screening. CAPPS flagged three of the hijackers, and the remaining two, brothers Nawaf and Salem al-Hazmi, raised the suspicions of an American Airlines customer-service representative at the check-in counter. One of the brothers lacked photo identification and couldn't understand English, but ultimately both were allowed to board.

Now: Passengers must present a valid photo ID to enter the security checkpoint. However, TSA officials have discretion to allow individuals without ID to go through screening and enter the terminal. Some security experts say that the only way to ensure that people don't use false IDs is to require a nationally standardized card, or to require all travelers, regardless of their destination, to present a passport.

Then: The final team of hijackers that day, those boarding United Airlines Flight 93, passed through security checkpoints almost without incident. One member was flagged by CAPPS; his checked baggage was screened for explosives and then put aboard the plane. All of the hijackers cleared the metal detectors.

The Hijackings

Then: Once the four planes were aloft and at or very near their assigned cruising altitudes, the hijackers struck. As part of their pilot training, some had learned how to make it harder for controllers on the ground to track the plane.

Now: U.S. flight schools must report their rosters to the TSA. Also, to get a license from the Federal Aviation Administration, pilots must undergo a basic background check and must be fingerprinted. Pilots who train outside the United States, however, don't need FAA clearance.

Then: Using violence, intimidation, and subterfuge, the hijackers took over the planes' controls and subdued most of the passengers. Every member of the crew -- the pilots and the flight attendants -- had been trained not to resist hijackers.

Now: Pilots and flight attendants are trained not to open the cockpit door during a hijacking under any circumstances. Although many of the protocols for how crews should behave in a hijacking or other crisis are classified, security experts say that pilots are instructed to land the plane as quickly as possible at the nearest airport.

Then: Nevertheless, the crew and passengers quickly assessed their situation and did their best to disrupt the attacks, by relaying important information to officials on the ground and, ultimately, by fighting back.

American 11

Then: The 9/11 commission did not determine how the hijackers got into the cockpit of Flight 11, but regulations at the time required that cockpit doors remain closed and locked during flight. One of the flight attendants, Betty Ong, who contacted American Airlines' Southeast Reservations Office in Cary, N.C., using an onboard pay phone, said that the hijackers had "jammed their way in."

Now: Cockpit doors have been reinforced, but they are not impervious to explosives.

Then: Ong's contact with authorities on the ground and others like it are examples of how flight attendants deviated from their training, which instructed them to communicate only with the cockpit crew in the event of a hijacking. The details they relayed helped alert the country to the hijackings.

To force passengers and flight attendants out of the first-class cabin and toward the rear of the plane, the hijackers used Mace, pepper spray, or some other type of irritant.

Now: All of these substances were banned before 9/11. Screeners who found them were supposed to call a supervisor, who would alert airport hazardous-materials teams to dispose of the chemicals. These procedures haven't changed.

Then: After Ong's call, the airline dispatcher responsible for Flight 11 tried unsuccessfully to contact the cockpit.

Now: Today, if a pilot doesn't respond to airline or government controllers, the Air Force deploys fighter planes to intercept the aircraft. According to Air Force guidelines, the military pilot uses commonly recognized signals to instruct the aircraft to follow the fighter to an alternative landing site. If the signals fail, the military pilot can deploy flares to get the airline pilot's attention. Most fighters are equipped with UHF and VHF radios, through which they can hail the cockpit. If all of those steps fail, existing command-and-control systems allow military officials to obtain the necessary authority to engage the aircraft and, if need be, to shoot it down.

Then: Officials at Boston Logan, however, were already aware of a problem aboard Flight 11. Another flight attendant, Amy Sweeney, had contacted American's Flight Services Office in Boston and informed officials of the hijacking. At approximately 8:44 a.m., less than an hour after Flight 11 left Boston, Sweeney reported, "Something is wrong. We are in a rapid descent.... We are all over the place." An official asked Sweeney to look out the window to determine the plane's location. Sweeney replied, "We are flying low.... Oh, my God, we are way too low." Flight 11 then crashed into the World Trade Center's north tower.

United 175

Then: Seconds later, United Airlines Flight 175 changed beacon codes twice within a minute. Beacon codes identify the flight for controllers.

Now: Since 9/11, technical glitches have caused some aircraft to emit the incorrect beacon signal. When this happens, regardless of whether it was accidental, air traffic controllers demand an explanation for the code change. Fighter planes can be dispatched to assess the aircraft's status, and the FAA is supposed to monitor the flight constantly on radar.

Then: With the hijackers in control of the plane, a passenger, Peter Hanson, called his father in Connecticut, told him what was happening, and asked him to call United Airlines. Hanson gave him the flight number and said the plane was traveling from Boston to Los Angeles. Hanson's father called his local police department and told the dispatcher what his son had said.

Now: Officials say that some calls to police departments on 9/11 were dismissed as pranks. It is difficult to imagine that any police force would casually dismiss such a call today. Local law enforcement officials are encouraged, and in some cases trained, to contact state and federal authorities when they get such a report.

Then: It appears that, without knowing that hijackers had already flown one plane into the World Trade Center, some passengers aboard Flight 175 realized that their plane might be turned into a weapon and began planning to retake the aircraft. One passenger, Brian David Sweeney, called his mother and said that some passengers were thinking about storming the cockpit. In a second call to his father, Hanson said, "I think we are going down -- I think they intend to go to Chicago or someplace and fly into a building."

Hanson tried to reassure his father. "Don't worry, Dad -- if it happens, it'll be very fast -- my God, my God." The call ended abruptly. Hanson's father turned on a television and watched as Flight 175 slammed into the south tower.

American 77

Then: Seconds before Hanson made the first call to his father, the hijackers aboard American Airlines Flight 77 pulled out knives and began taking over the aircraft.

Minutes later, Flight 77 turned south, deviating from its assigned course. The hijackers turned off the transponder, which relays the plane's location and identifying information.

Now: Pilots can still turn off a plane's transponder, but they must explain to controllers why they did so. After 9/11, pilots of smaller aircraft that fly without instruments or flight plans objected to requirements that all planes use transponders. Any aircraft that deviates from a preset flight plan immediately raises suspicion, officials say.

Then: Air traffic controllers and American Airlines dispatchers attempted to contact the aircraft. Six minutes later, American Airlines Executive Vice President Gerard Arpey ordered all American flights in the northeastern United States that had not taken off to remain on the ground.

Now: Airlines still have the authority to ground their own planes.

Then: As on the other flights, passengers called their loved ones and asked them to alert the airline. Barbara Olson called her husband, then-Solicitor General Ted Olson, and reported that the hijackers had knives and box cutters. She also indicated that the hijackers didn't know she was using her cellphone.

Now: The 9/11 commission speculated that the hijackers may not have tried to stop passengers' calls because they presumed that word of the attacks was already spreading on the ground. Considering how much information and warning the passengers relayed, it is doubtful that terrorists would allow phone calls in a future attack.

Then: A few minutes later, the hijackers disengaged the plane's autopilot.

Now: With newer systems onboard some aircraft and in some control facilities, ground controllers can override an attempt to disengage the plane's autopilot. Aviation engineers and flight planners look forward to a day when planes will actually take off, fly, and land themselves, particularly during an emergency when a human pilot cannot react quickly enough.

Then: Flight 77 was approximately 38 miles east of the Pentagon, traveling at an altitude of 7,000 feet. As the plane approached its target, it made a 330-degree turn, descended 2,200 feet, and headed toward the building. The hijacker at the controls pushed the throttles to maximum and went into a dive. Flight 77 hit the Pentagon traveling at 530 miles per hour.

United 93

Then: Almost an hour earlier, United Airlines Flight 93 had departed Newark Liberty International Airport in New Jersey for San Francisco. The flight crew was unaware that Flight 11 had been hijacked. By 9:03 a.m., when Flight 93 had been airborne for more than 20 minutes, officials at the FAA, American, and United realized that multiple planes had been hijacked, and they were watching a second plane hit the World Trade Center. But crisis managers at the FAA and the airlines hadn't warned other aircraft.

Now: The Transportation Security Administration manages aviation crises such as hijackings. Its aircraft warning procedures are classified.

Then: At 9:07, four minutes after United Flight 175 struck the south tower, FAA controllers in Boston, who were tracking the first two hijacked planes, requested that the FAA's Herndon Command Center outside Washington "get messages to airborne aircraft to increase security for the cockpit." The 9/11 commission found "no evidence that Herndon took such action."

United Airlines did notify some airborne planes to take defensive action at 9:19, when flight dispatcher Ed Ballinger, on his own initiative, transmitted warnings to 16 transcontinental flights: "Beware any cockpit intrusion -- Two a/c [aircraft] hit World Trade Center." Flight 93 received Ballinger's alert, but it wasn't transmitted until 9:23, because Ballinger was still covering other flights, including Flight 175. The pilot of Flight 93, Jason Dahl, replied, "Ed, confirm latest mssg plz -- Jason." The hijackers attacked less than two minutes later.

Now: Controllers have text-based messaging systems to alert aircraft that are similar to the ones in use on 9/11. Security experts believe that controllers would use the systems more quickly and would alert more planes with detailed warnings if a hijacking were to occur today.

Then: After learning through phone calls that other planes had been hijacked and flown into buildings, Flight 93's passengers quickly grasped the gravity of their situation. They attempted to storm the cockpit, presumably to retake control of the aircraft. The 9/11 commission reported no evidence that they succeeded. But the hijackers, perhaps sensing that they were about to be overwhelmed, apparently put the plane into a dive. It crashed into a field in Shanksville, Pa., at 580 mph. The 9/11 commission concluded that the hijackers were "defeated by the alerted, unarmed passengers of United 93."

Now: Only a few months after 9/11, passengers on a trans-Atlantic flight subdued shoe bomber Richard Reid, and suspicious passengers on other flights likewise have been attacked by fellow fliers, sometimes at the direction of the flight crew. Following the example of Flight 93, it's almost certain that passengers would resist any attempt to seize an airplane. Indeed, they are probably the best line of defense currently available in civil aviation.

The Government's Response: The FAA and NORAD

Then: The official response to the hijackings and suicide attacks was carried out by the FAA, which on September 11 was required by law to regulate aviation safety and security, and by NORAD, the North American Aerospace Defense Command, which was established in 1958 to defend North American airspace and the continent. The FAA had no protocols for handling suicide hijackers.

Now: The FAA still manages air traffic, but the TSA handles aviation security and responds to hijackings in coordination with the military. Many of the onboard security protocols for airline crews are classified.

Then: NORAD had prepared almost entirely for an external attack, most likely from the Soviet Union or some other military force.

Now: After 9/11, the U.S. Northern Command was created and was given broad authority to provide command-and-control for the Defense Department's homeland-defense efforts, and to coordinate military assistance with civilian agencies and authorities. The commander of NORTHCOM also runs NORAD.

Then: Both the FAA and NORAD were virtually powerless to stop the 9/11 hijackers. "They struggled, under difficult circumstances, to improvise a homeland defense against an unprecedented challenge they had never before encountered and had never trained to meet," the 9/11 commission concluded.

On September 11, the four hijacked planes were monitored mainly by four different FAA centers -- in Boston, New York, Cleveland, and Indianapolis. As a result, each center had only a partial picture of what was unfolding across the entire system.

Now: The FAA is upgrading its technology to make controllers more aware of all traffic in the system. But crisis operations are handled primarily by the TSA.

Then: Before 9/11, pilots were trained to notify a ground controller of a hijacking by radio, or by "squawking" 7500 -- the universal transponder code for a hijack in progress.

Now: The hijack code hasn't changed, and if a pilot squawks 7500, fighter planes are supposed to be dispatched immediately.

Then: The pilots that day apparently never had the chance. Some passengers reported that the hijackers killed the pilots, and in instances where the pilots were left alive, they were apparently removed from the cockpit so quickly or forcefully that they couldn't alert ground controllers.

After a pilot's hijacking alert, controllers were to notify their supervisors, who then would inform others up through several links of the management chain at the FAA, and ultimately to headquarters. There, a hijack coordinator was to ask the Pentagon's National Military Command Center for a fighter to follow the flight and report anything unusual.

There was no protocol for the FAA control centers to contact the military directly to request assistance with a hijacked airliner. Indeed, as the 9/11 commission reported, "For the FAA to obtain military assistance from NORAD required multiple levels of notification and approval at the highest levels of government."

On September 11, the FAA's planned response began between 8:25 a.m. and 8:32 a.m., when Boston Center managers notified their chain of command that hijackers had seized American Flight 11. Officials in Washington did not contact the Pentagon to request a fighter. Perhaps sensing the same urgency that gripped some of the flight attendants, controllers at Boston Center broke with protocol and tried to contact the military directly.

Now: Current procedures allow the FAA to notify Homeland Security and NORAD directly; those entities handle the aircraft interception.

Then: At NORAD's Northeastern Air Defense Sector (NEADS), Battle Commander Robert Marr sought authorization to scramble fighters. Marr called his superior, who later recalled giving the order to scramble, saying that "we'll get authorities later."

Two F-15 fighters at Otis Air Force Base in Massachusetts were scrambled at 8:46, but NEADS didn't know where to send them; the hijackers had turned off Flight 11's transponder. While NEADS was looking for the plane's primary radar return, Flight 11 flew into the north tower. The fighters weren't airborne until 8:53. With no target, they were vectored toward military-controlled airspace off Long Island, where they were held to avoid civilian air traffic in the New York area.

Pentagon planners presumed that any attack would emanate from outside the country, allowing time to identify the threat and scramble fighters to intercept it. On September 11, only seven alert sites in the United States could send interceptors quickly, and each of those sites had two fighter aircraft on standby.

Now: The total number of alert sites today is closely guarded, but has been variously estimated at 24 to 30. During congressional testimony in July 2005, an Air Force general said that the number of alert sites depends on the national threat level, which dictates the Air Force's "alert posture." Maj. Gen. Marvin Mayes, commander of the 1st Air Force, which provides air defense and surveillance of the continental United States for NORAD, said, "Typically, at any given alert site, there are ... two aircraft on alert with a spare." Mayes also said that alert aircraft can be dispatched if a commercial plane deviates from its flight path or if the TSA determines that a passenger aboard is on the government's "no-fly" list.

Then: Two minutes after the fighters were airborne, a controller in New York Center told her manager that she believed that United Flight 175 had also been hijacked. The manager tried to notify his regional superiors but was told that they were discussing a hijacked aircraft, presumably Flight 11, and that they refused to be disturbed.

Now: Given that Al Qaeda's trademark tactic -- conducting multiple, simultaneous attacks -- is well known among security agencies, it's difficult to imagine officials dismissing a report of a second hijacking because they were too busy discussing the first one.

Then: At Indianapolis Center, Flight 77 disappeared from radar after the hijackers turned off the transponder. Controllers thought it might have crashed. Managers at the center did not instruct other controllers to assist those personnel already searching for Flight 77, nor did they or officials at FAA headquarters put out an alert to the surrounding centers to search for the flight's primary radar return. As a result, Flight 77 headed due east toward Washington, undetected for 36 minutes.

Now: Seven principal agencies are still involved in responding to air threats, and government auditors have found marked improvement in the ability to locate and intercept airborne threats.

Then: By the time controllers at Dulles spotted Flight 77, the plane was less than six minutes from the Pentagon. Controllers at Reagan Washington National Airport had directed an unarmed National Guard aircraft, which was en route to Minnesota, to follow it. The pilot moved into position, identified the plane as a Boeing 757, and then watched as it hit the Pentagon.

Confusion also gripped controllers at the FAA's Cleveland Center who were tracking United Flight 93. They understood that the plane had been hijacked, and asked the Herndon Command Center whether anyone had requested military fighters. Cleveland officials reported that they were ready to make that request to a nearby military base, but the command center informed them that higher-ranking FAA personnel were the only ones authorized to do so, and were working on it. After the command center learned that a plane had hit the Pentagon, the FAA took the unprecedented step of ordering all aircraft to land at the nearest airport. Flight 93 crashed at 10:03.

Now: The Government Accountability Office has found improved coordination among those agencies responsible for air security, particularly the FAA, the TSA, and NORAD. The FAA can report that an aircraft is in restricted airspace based on its own radar tracking. It can choose to monitor the aircraft and try to contact the pilot if it determines that the plane is not heading toward a "protected asset," such as the White House. If NORAD and the FAA believe that the aircraft is a threat to a protected asset, NORAD or the Homeland Security Department can dispatch fighters to intercept it. The FAA would continue to try to raise the pilot. If the aircraft doesn't respond, the Defense secretary or the president can order the fighters to engage it.

Testifying in July 2005, Paul McHale, assistant secretary of Defense for homeland defense, said, "Carefully defined rules of engagement and a clear chain of command have been established to defeat terrorist air threats. The president has delegated to the secretary of Defense the authority to take immediate effective action in response to a terrorist air threat."

Epilogue

So, could 9/11 happen again? Surely, would-be terrorists could enter the country legally, and presumably they have done so. When actually boarding flights, however, they would face increased scrutiny. But terrorist watch lists clearly aren't functioning optimally, and official investigations have shown that passengers still smuggle banned items, including knives, onto airplanes.

Any attempted hijacking would be met with potentially lethal resistance from passengers. This may be the single best insurance that another 9/11 couldn't happen -- at least, not the same way. It's conceivable, even likely, some experts say, that hijackers could incapacitate the passengers, perhaps by anesthetizing them or using more-powerful offensive weapons. At that point, the plane's fate would lie with the pilots, who would attempt to land immediately under fighter escort. Since 9/11, the military has dispatched fighters many times to intercept civilian airliners. Once intercepted, the hijackers would be finished, because even if they breached the cockpit and took control of the aircraft, they would be shot out of the sky. Of course, terrorists could avoid detection almost entirely by infiltrating the ranks of commercial airline pilots, a strategy that security experts don't dismiss.

Airplanes can also be destroyed without being crashed into buildings. Airline cargo still isn't screened for explosives. Airports don't have the equipment to detect bombs in carry-on luggage. And terrorists could fire a missile at an airplane from the ground -- something they have tried abroad. Simply put, where there's a will, there's a way. Terrorists have watched the government's and the public's response to 9/11, and just as they learned how to exploit weaknesses once, they could do it again.