What stuck, what got rolled back, and what quietly never resolved at all
By Michael Phillips | Riptide
Twenty-five years is long enough that the architecture built in the fall of 2001 has outlived the emergency that justified it, outlived most of the people who designed it, and outlived several waves of promised reform. It has not, however, been dismantled. Pieces of it have lapsed. Pieces of it have been renamed, repurposed, or folded into other missions entirely. But the core proposition — that the state needed new, faster, less-checked authority to see and act against threats moving inside its own borders — has never actually been reversed. It has only ever been renegotiated.
That distinction matters more than the news cycle around any single expiring statute suggests. This is a status report, not on the war on terror, but on the machinery it left behind: what became permanent, what Congress or the courts genuinely took back, and what exists today in the strange in-between state of having technically expired while continuing to operate anyway.
“The core proposition — that the state needed new, faster, less-checked authority to see and act against threats moving inside its own borders — has never actually been reversed. It has only ever been renegotiated.”
What Stuck
The Department of Homeland Security. The single largest bureaucratic reorganization since the creation of the Department of Defense folded 22 agencies — Customs, the Coast Guard, the Secret Service, immigration enforcement, FEMA, and more — into a single cabinet department in 2003. Whatever else can be said about DHS’s effectiveness, it never went anywhere, and it never shrank. Instead, it became the vehicle for a mission creep that nobody in 2002 fully anticipated: an agency built around the threat of another terrorist attack has become, twenty-five years later, increasingly dominated by immigration enforcement as a political, operational, and budgetary priority. A 2025 reconciliation law provided roughly $170.7 billion for immigration- and border-enforcement-related activities running through fiscal 2029; a second reconciliation measure signed in June 2026 added another $69.5 billion specifically for ICE and CBP. Together, the two packages have committed close to $240 billion — nearly a quarter-trillion dollars — most of it multi-year authority rather than a single annual budget figure, but a scale of commitment with no real precedent in the department’s history. The infrastructure, the legal authorities, and the institutional culture built for counterterrorism didn’t disappear when the threat picture changed; they were simply pointed at a new target. The 287(g) program, which deputizes local police and sheriffs to act as immigration agents, has grown by more than 1,000 percent since January 2025, according to ICE’s own count submitted to Congress this spring, fusing federal enforcement priorities directly into local policing in a way DHS’s architects never explicitly designed but never prevented either.
“The infrastructure, the legal authorities, and the institutional culture built for counterterrorism didn’t disappear when the threat picture changed; they were simply pointed at a new target.”
Fusion centers and information sharing. The “wall” between domestic law enforcement and foreign-intelligence investigations — rooted in FISA’s distinction between the two, court interpretations of FISA’s “primary purpose” requirement, and Justice Department procedures, especially the 1995 Reno guidelines, that by the late 1990s had hardened into formidable barriers to sharing information between intelligence and criminal investigators — was one of the specific failures 9/11 investigators focused on. The PATRIOT Act and subsequent FISA Court of Review decisions substantially dismantled it, and it has never gone back up. Dozens of state and regional fusion centers, built to merge federal, state, and local data streams, remain in operation today, largely outside the kind of public accountability that governs a police department or a federal agency with a named oversight committee.
Financial and travel surveillance. The expanded Bank Secrecy Act reporting requirements, the No Fly List and broader terrorist watchlist system, and enhanced airport screening under the TSA are now simply how the country works. There has been no serious legislative push to unwind any of them. The watchlisting system in particular has weathered real legal challenges — a 2014 federal ruling in Latif v. Holder found the redress process for people wrongly listed constitutionally deficient, prompting DHS to revise its procedures the following year — without the underlying incentive structure changing: nobody in government wants to be the official who took someone off a list who later commits an attack.
National Security Letters, the FBI’s power to compel businesses to hand over customer records without a judge’s order, survived the 2015 USA Freedom Act reforms with only modest changes to nondisclosure procedures. Many are still accompanied by gag orders that can run indefinitely, and the letters remain regularly used, mostly invisible, because recipients subject to an active nondisclosure requirement are legally restricted from disclosing the letter.
The critical-infrastructure protection mission, born of the same 2001 anxieties, now lives inside DHS’s Cybersecurity and Infrastructure Security Agency — a designation and an agency that outlasted the threat model that created it, and one currently facing its own dismantling fight [see Election Desk’s coverage of that story].
What Got Rolled Back
The genuine rollbacks are fewer, narrower, and mostly the product of court rulings and public scandal rather than proactive congressional reform.
Bulk phone metadata collection. This is the closest thing the post-9/11 era has to a clean legislative win for privacy advocates. After Edward Snowden’s 2013 disclosures revealed the NSA was using Section 215 of the PATRIOT Act to collect the phone records of essentially every American, the Second Circuit ruled the program had never actually been authorized by the statute’s language in the first place. The 2015 USA Freedom Act ended bulk collection and replaced it with a narrower, court-ordered, provider-held system. It was real reform, and it stuck.
The torture program. The CIA’s post-9/11 “enhanced interrogation” regime — waterboarding, stress positions, extended sleep deprivation — was the subject of a scathing 2014 Senate Intelligence Committee report and was formally banned by a 2015 statutory amendment restricting interrogation techniques to the Army Field Manual. That rollback has held for over a decade now across administrations of both parties, even ones that campaigned on bringing torture back.
Section 215, and the lapse has held for more than six years. Section 215’s business-records authority, the roving-wiretap provision, and the “lone wolf” surveillance authority — the three provisions originally written with sunset clauses back in 2001 — expired on March 15, 2020, after Congress failed to agree on reauthorization terms, and Congress has never revived them since. That makes this the most durable rollback of the post-9/11 era: not a single dramatic reversal but six and a half years of Congress simply declining to put the authority back, through two administrations of different parties. It’s a real result. It’s also not an irreversible one: nothing prevents Congress from reviving some or all of the authorities in a future bill, and the government retains other legal tools — national security letters, pen registers, ordinary subpoenas — that cover much of the same ground Section 215 did.
What Quietly Never Did
This is the category the anniversary retrospectives tend to undersell, because it doesn’t produce a clean headline. Nothing “quietly never resolving” looks like news. It looks like paperwork.
The 2001 Authorization for Use of Military Force is the biggest one, and it isn’t close. Passed by Congress on September 14, 2001 — three days after the attacks, with a single dissenting vote, cast by Rep. Barbara Lee — the AUMF authorizes force against those who “planned, authorized, committed, or aided” the 9/11 attacks and anyone who harbored them. It names no enemy, sets no geographic limit, and carries no sunset clause. Both of its original targets, Osama bin Laden and his successor Ayman al-Zawahiri, have been dead for years. The Defense Department has told Congress that force has been used pursuant to the 2001 AUMF in Afghanistan, Iraq, Syria, Libya, Yemen, Somalia, and Niger — seven countries. The geographic count only tells part of the story: successive administrations also stretched the authorization’s substantive reach to ISIS, an organization that did not exist when Congress wrote the law and was not responsible for the September 11 attacks. Lawmakers from both parties have introduced repeal or sunset bills nearly every Congress since 2019; none has passed. Of everything examined here, the AUMF is the cleanest example of authority outliving its original justification by decades while nobody with the power to end it does.
Total Information Awareness is the case study everything else gets measured against. In 2003, Congress killed the Pentagon’s TIA program — a Poindexter-era effort to develop systems capable of searching and linking enormous quantities of Americans’ financial, medical, travel, communications, and other transactional data — by a House vote of 407 to 15 and a Senate vote of 95 to 0. It remains one of the cleanest, most bipartisan surveillance rollbacks in the post-9/11 record. Reporting soon after found that key components of the program had simply relocated to a research office inside the NSA within months, under new names, with the same contractors, and continued largely uninterrupted. Years later, the Snowden disclosures confirmed the broader pattern: capability that gets defunded by name doesn’t necessarily stop; it often just stops being called by that name. It’s the same shape the AUMF and Section 702 stories take, at different scales — Congress registers a formal objection, and the underlying machinery finds a new legal or bureaucratic home.
Section 702 is the marquee example, and it is unfolding right now. Section 702 of FISA — the authority that lets intelligence agencies collect the communications of foreigners abroad, sweeping in an enormous volume of Americans’ messages in the process — traces its lineage to the warrantless wiretapping program the Bush administration ran outside any statutory authority after 2001. When that program became public in 2005, Congress’s response wasn’t to shut it down; the FISA Amendments Act of 2008 legalized a version of it going forward and granted retroactive legal immunity to the telecom companies that had already been secretly complying. Section 702 is that 2008 framework’s direct descendant, reauthorized on a rolling basis ever since. It was up for reauthorization again in the spring of 2026. What followed was a case study in how sunset provisions actually function in practice. Congress passed a ten-day clean extension in mid-April; the House then passed a three-year reauthorization with an unrelated digital-currency provision attached that stalled in the Senate; lawmakers fell back on a forty-five-day clean extension instead, buying time until June 12. When that final deadline arrived without a deal, Section 702 formally expired. Surveillance under it did not stop. The Foreign Intelligence Surveillance Court had certified the program for a full year back in March, and under the statute’s own transition language, that certification keeps existing collection running through roughly March 2027 regardless of what Congress does or doesn’t do. In effect, the law lapsed, and surveillance continued anyway under a still-valid classified FISA Court certification. The chairman and ranking member of the Senate Intelligence Committee publicly asked the administration in late April to declassify that order within fifteen days; as of the most recent reporting available for this piece, it had not been released. This is the pattern the sunset-clause architecture was supposed to prevent — a program continuing to operate on inertia rather than active democratic consent — and it is the pattern that has instead defined nearly every reauthorization fight since 2006.
“In effect, the law lapsed and surveillance continued anyway under a still-valid classified FISA Court certification.”
NSEERS shows the same dynamic playing out in the immigration system specifically. Between 2002 and 2003, DHS required men and boys from 25 mostly Muslim and Arab countries to register with immigration authorities — a program that produced not a single terrorism conviction in nearly a decade. The Obama administration stopped using it in 2011 and formally rescinded the underlying regulation in 2016. But DHS’s own final rule explaining the rescission was candid about why it no longer mattered: NSEERS’s functions had already been absorbed into newer, broader biometric and data systems — US-VISIT, SEVIS, ESTA — that could do everything NSEERS did and more, for a far larger population, automatically. The named program died. The capability didn’t; it scaled up and got folded into the entry-exit infrastructure that today underpins the current immigration-enforcement buildup. It’s a small, well-documented precedent for the much larger DHS-to-ICE story playing out now.
Guantánamo never closed, and it found a second act. Fifteen men remain at the detention facility, a fraction of the nearly 800 who passed through it over the years — some still held without ever being charged with a crime, others facing prosecution before the military commissions system, including the co-defendants in the 9/11 case itself, whose trial still has not happened a quarter-century later. Obama campaigned explicitly on closing the facility and didn’t manage it; the current administration campaigned on keeping it open and has instead expanded its use. What’s changed in the last two years isn’t closure — it’s expansion of purpose. Since 2025, the facility has also been used to temporarily hold immigration detainees, a reported figure in the hundreds that we’re not treating as confirmed here pending a stronger primary source. A site built as the physical symbol of extralegal counterterrorism detention is now doing double duty as an overflow valve for the immigration-enforcement surge, which is as clean an illustration as exists of how post-9/11 infrastructure gets reused rather than retired.
The sunset clause itself never did what it was designed to do. Sixteen provisions of the original PATRIOT Act carried sunset dates specifically so Congress would be forced to revisit them with fresh eyes. In 2006, fourteen of those sixteen were made permanent outright. The remaining fights — over Section 215, Section 206, the lone wolf provision, and later Section 702 — have followed an almost identical script every few years: brinkmanship, a short “clean” extension to buy negotiating time, another short extension, and either a reauthorization that changes little or, as in 2026, an actual lapse that the executive branch absorbs through its own legal interpretations rather than treating as a hard stop. A mechanism built to guarantee periodic democratic reconsideration has instead become a recurring test of how long a surveillance program can keep running on legal fumes while Congress argues.
Watchlist redress remains functionally theoretical. The 2014 Latif v. Holder ruling found the No Fly List’s redress process constitutionally deficient, and DHS revised its procedures the following year. The revised process has itself drawn continued litigation over whether it gives a wrongly listed person a real, timely way to clear their name. Nobody has proposed abolishing the list. Nobody has fully resolved that question either. It simply persists in the same half-litigated state it’s occupied for most of the last decade.
“A named program dies, its underlying capability gets absorbed into broader infrastructure, and that infrastructure eventually does far more than the original ever did.”
The Pattern Underneath the Pattern
Line up these categories and a shape emerges that’s more interesting than any individual program’s fate. The things that stuck were the things that built institutions and budgets — DHS, fusion centers, the watchlist bureaucracy — because institutions generate their own constituencies and are almost impossible to unwind once agencies, contractors, and career staff depend on them. The things that got rolled back were mostly forced by courts or public scandal, not by Congress deciding proactively that less surveillance was better policy — Section 215’s lapse being the partial exception, a rollback achieved through inertia rather than a vote, which is a strange kind of victory to hang a civil-liberties narrative on. And the things that quietly never resolved split into two flavors: authorities like the AUMF that never had a sunset clause to begin with and simply keep getting reinterpreted for new enemies, and authorities like Section 702 that do have sunset clauses, which turn out to function less as genuine off-switches and more as recurring leverage points where the executive branch and Congress renegotiate terms every few years without either side actually walking away from the underlying program. Total Information Awareness, twenty-three years on, is the reminder that even the rare clean, bipartisan kill doesn’t necessarily kill the capability — only the name.
“Capability that gets defunded by name doesn’t necessarily stop; it often just stops being called by that name.”
The most consequential story of the last eighteen months isn’t a new law at all. It’s the redirection of the entire architecture — the budget, the personnel, the legal theories tested and refined against terrorism suspects for two decades — toward immigration enforcement instead. Congress has committed close to a quarter-trillion dollars to that redirection in just two reconciliation bills. The 287(g) program is fusing federal priorities into local policing at a pace with no real historical precedent. NSEERS already showed the template in miniature: a named program dies, its underlying capability gets absorbed into broader infrastructure, and that infrastructure eventually does far more than the original ever did. None of this required new authorizing legislation comparable to the original PATRIOT Act; it required only pointing existing infrastructure somewhere else and funding it heavily, which turned out to be far easier than building anything from scratch.
“The state built a set of tools in a moment of genuine emergency, discovered those tools were far more durable and far more flexible than the emergency that justified them.”
Twenty-five years on, the honest accounting isn’t “the security state grew” or “the security state shrank.” It’s that the state built a set of tools in a moment of genuine emergency, discovered those tools were far more durable and far more flexible than the emergency that justified them, and has spent the two and a half decades since finding new missions for hardware that was never actually designed to expire.
This piece draws on Department of Justice fact sheets and statutory summaries of the PATRIOT Act and USA Freedom Act; the 9/11 Commission Report’s account of the FISA “wall” and 1995 Justice Department information-sharing procedures; Defense Department and congressional testimony on operations conducted under the 2001 AUMF; Reuters, the Washington Post, Roll Call, and Ars Technica’s reporting on the Section 702 reauthorization fight between April and June 2026; the Senate Intelligence Committee’s April 2026 declassification request and the EveryCRSReport summary of Section 702’s transition provisions; DHS’s 2016 Federal Register final rule rescinding NSEERS; Defense Department detainee-transfer announcements and public reporting on Guantánamo’s current population and its use for immigration detention; American Immigration Council fact sheets on the 2025 and 2026 reconciliation bills’ immigration-enforcement funding; ICE’s April 2026 congressional testimony on 287(g) program growth; the Electronic Frontier Foundation’s analysis of National Security Letter nondisclosure practices under USA Freedom; and court records in Latif v. Holder *and related No Fly List litigation. Historical detail on the Total Information Awareness program draws on contemporaneous ACLU and National Journal reporting following its 2003 defunding, later corroborated by the 2013 Snowden disclosures. Two figures cited elsewhere in early reporting on this story — a broader “22 countries” AUMF citation and an unverified count of migrants held at Guantánamo since 2025 — were checked against primary sourcing and either narrowed or withheld pending stronger confirmation; where a precise figure could not be verified to Riptide’s standard, that’s noted directly in the text rather than presented as settled.
Keep This Reporting Free
If this work matters to you, please consider supporting it.
Your contribution helps fund independent reporting across our entire network.
Discover more from RIPTIDE
Subscribe to get the latest posts sent to your email.
