- › Converged security exists as a named discipline because of September 11, 2001, and most of what our field takes for granted was written in its aftermath.
- › The clearest gains are in coordination and response, where the failures were documented precisely enough that they could actually be engineered against.
- › The same period built a surveillance apparatus that this publication now covers critically most weeks, and that is part of the same inheritance.
- › An industry that will not account for both halves of what it built is not being serious about the anniversary.
- › The obligation a practitioner carries is to the people inside the building, which is a narrower and harder standard than compliance.
On the morning of September 11, 2001, firefighters climbing the North Tower were working from radios that could not reliably carry a message through the building. An evacuation order went out. The 9/11 Commission later found that some of the personnel it was meant for did not hear it on their radios at all, and learned of it from other firefighters and police officers who were already coming down and told them face to face on the stairs.
The Commission was careful about what it concluded from that, and I want to be equally careful. It found that at least twenty-four of the at most thirty-two companies in the North Tower did receive the instruction, by radio or from somebody in person, and it stated plainly that the technical failure of the radios was not the primary cause of the firefighter deaths there.
What has stayed with me for twenty-five years is the part underneath the finding. The message that did get through got through because people on a staircase told each other. A human channel carried what the system could not, which is a thing our entire field now organizes itself around and which on that morning was nobody’s specialty. The radio belonged to one department, the building belonged to another, and the coordination belonged to nobody at all.
Two thousand nine hundred and seventy-seven people were killed that day. Three hundred and forty-three of them were New York City firefighters.
The Discipline Is Downstream of That Morning
Almost everything a security practitioner does now traces back to the years immediately after. The Transportation Security Administration was created that November. The Homeland Security Act followed in 2002 and the department stood up in 2003. Standoff distance, hostile vehicle mitigation, and the bollards outside every civic building in the country came from the same period, and my colleague Dusten walked through that lineage in detail in our retrospective on physical security since 9/11.
What is less often said out loud is that the word converged belongs to that inheritance too. Our whole vocabulary came out of the same few years, and most of us use it without remembering where we got it.
Before 2001, physical security and information security were separate trades with separate conferences and separate budgets, and a person who did both was considered to have an odd résumé. The argument that they are one problem, that a door and a firewall are the same control expressed in different materials, was made repeatedly in the Commission’s findings without ever using our vocabulary. The whole reason a converged operations center is a defensible business case today is that the alternative was examined in public, at length, after it failed.
The Commission’s most quoted line is that the most important failure was one of imagination. I have always thought the more useful finding sits a layer below that. Imagination was not the scarce resource, and somebody inside that system had imagined most of it already. What was missing was any mechanism by which one part of the apparatus could tell another part something it did not already want to hear, in time for it to matter.
What Genuinely Got Better
I want to be specific here, because the honest version of this anniversary is not a lament. A great deal of serious work got done, by people who mostly did not get credited for it, and the results are load-bearing.
Interoperability is real now. The radio problem was studied down to the frequency and the repeater, and the money followed. A firefighter and a police officer at the same incident today can generally talk to each other, and that was not true in 2001. It is unglamorous, expensive, mostly invisible engineering, and it saves lives quietly enough that nobody writes about it.
Response coordination has an actual structure. Unified command, mutual aid compacts, and the practice of running a joint incident with a named commander are ordinary now. When I read our own coverage of organizations that could not decide who was allowed to declare an incident, I am watching the private sector work through a problem the public safety world was forced to solve twenty years earlier.
Buildings are designed for the people getting out. Stair width, pressurization, redundant egress, photoluminescent markings, and the assumption that a full evacuation is a scenario rather than a formality. These changes are written into code and nobody notices them, which is what a mature control looks like.
Information sharing exists as a practice. Between agencies, and between the public and private sides, in a way that had no precedent. The sector-specific structures we now take for granted were an argument somebody had to win.
None of that was inevitable. It came from documenting failure precisely enough that it could be engineered against, which remains the single most valuable thing our field knows how to do.
What Else We Built
Here is where an anniversary piece from a security company usually stops, and stopping there would be dishonest. The second half of the inheritance is harder to write about because it implicates the people writing.
The same twenty-five years produced the most extensive domestic surveillance apparatus in American history, and a great deal of it was built by this industry, sold by this industry, and defended by this industry. None of that belongs to somebody else’s story, and it was profitable for the people telling it.
Look at what we published in our own briefings this week. The Department of Homeland Security opened a procurement worth up to $440 million to standardize how federal agencies capture fingerprints, faces, irises, and palmprints, and the trade association for our sector spent the same week defending automated plate readers against a growing bipartisan push to restrict them. A state driver database holding photographs and addresses for everybody in Florida was reached with a working police credential. We covered fusion centers monitoring the social accounts of people who oppose camera networks. We do this most weeks, and we do it because it is the news, not because it is a position.
Every one of those systems has a lineage that runs back to the same twenty-five years and frequently to the same legislation. Each was built by people who believed, mostly sincerely, that they were preventing the next one.
I do not think that makes the people who built them villains. I have worked alongside enough of them to know better, and I have specified systems myself that I would scope differently today. But a field that will only narrate the half of its inheritance that flatters it has not actually reckoned with anything. It has written a brochure.
The capability outlived the fear that justified it. That is the pattern worth naming on an anniversary, because it is still running. Nothing built under emergency conditions gets dismantled when the emergency recedes. It gets a budget line, then a vendor, then a customer base, and then a trade association explaining why the alternative would be worse.
The Standard That Actually Holds
I keep coming back to the stairwell, and to the people climbing it who were carrying out a plan somebody else had written for them years earlier. They had no way to evaluate that plan and no opportunity to decline it.
Whatever a practitioner believes about policy, the obligation is to the specific people inside a specific building on an ordinary Tuesday morning who are relying on work they will never see and cannot evaluate. That is a narrower standard than compliance and a considerably harder one. It does not care whether the control was purchased, whether the diagram was correct, or whether the assessment came back clean. It asks whether the thing would hold.
Most of what has gone wrong in this industry over twenty-five years came from answering a different question than that one. What will satisfy the auditor, what will survive the budget cycle, and what will be defensible afterward. Those are real pressures and I have felt all of them. None of them is the same question as whether the people in the building would get out, and the gap between them is where most of the failures I have been called in to examine actually live.
Twenty-five years is long enough that most of the people entering this field now have no memory of the morning that produced it. They inherit the standards, the frameworks, the acronyms, and the apparatus, and they inherit them as furniture rather than as answers somebody arrived at under specific conditions that no longer obtain.
Some of that furniture should be kept. Some of it was a response to a particular fear and has been quietly repurposed since. Knowing the difference requires knowing where it came from, which is most of what an anniversary is for.
The radios work now. That took twenty-five years, a great deal of public money, and a documented account of exactly how they had failed.
Jeff Welch is CEO of Grab The Axe.
A PhD candidate in Health Psychology and former Corrections Officer, Jeff founded GTA to dismantle passive security models. He focuses on the 'Human Zero-Day', mitigating executive burnout and decision fatigue before they become security breaches.
View Author Page →
