The entire 9/11 Commission report includes only one finding that the attacks might have been prevented. This occurs on page 247 and is repeated on page 276 with the footnote on page 541, quoting the interrogation of the hijackers' paymaster, Ramzi Binalshibh. Binalshibh commented that if the organizers, particularly Khalid Sheikh Mohammed, had known that the so-called 20th hijacker, Zacarias Moussaoui, had been arrested at his Minnesota flight school (he only wanted to fly, not to take off or land) on immigration charges, then Bin Ladin and KSM would have called off the 9/11 attacks. And wisely so, because news of that arrest would have alerted the FBI agent in Phoenix who warned of Islamic militants in flight schools in a July 2001 memo that vanished into the FBI's vaults in Washington. The Commission's wording is important here: only "publicity" could have derailed the attacks.

This is why Ms. Carol Haave, the deputy undersecretary of defense, framed the problem wrongly at your August 24 hearing. She testified, "In the end, this is a discussion about risk. How much risk is the nation willing to endure in the quest to balance protection against the public's desire to know? It's a complex question that requires thought and ultimately action." She and the Pentagon have missed the point. We are not balancing protection against the public's desire to know. The tension is actually between bureaucratic imperatives of information control versus empowering the public and thus making us more safe. Yes, there are real secrets that must be protected, but the lesson of 9/11 is that we are losing protection by too much secrecy. The risk is that by keeping information secret, we make ourselves vulnerable. The risk is that when we keep our vulnerabilities secret, we avoid fixing them. In an open society, it is only by exposure that problems get fixed. In a distributed information networked world, secrecy creates risk - risk of inefficiency, ignorance, inaction, as in 9/11. As the saying goes in the computer security world, when the bug is secret, then only the vendor and the hacker know - and the larger community can neither protect itself nor offer fixes. Publicity is not a SHARE network limited to relevant players. Publicity is TV, the newspapers, the Internet, and the highly efficient information distribution system that is our open society. That is our strength, not our weakness.