I spent the morning of September 11, 2001 in the waiting room of an OB/GYN clinic, waiting for my wife to complete a test to see if my daughter was ready to be born.

That was the entire scope of my concern that day. Whether the test came back the way we hoped. Whether we would be parents by the weekend.

The television was on in that waiting room. I watched in disbelief as the second plane hit the south tower live, the way so many people did. 8:03 in the morning, Kansas time.

Before anything else, the count.

The attacks killed 2,977 people that morning, and that figure excludes the nineteen men who killed them, which is the right way to keep the count and the way I intend to keep it here. 2,753 died in New York. 184 died at the Pentagon. 40 died in a field outside Shanksville, Pennsylvania, aboard the one aircraft that day whose passengers had enough information to understand what was happening, and who acted on it. The true definition of heroes.

411 of the dead were first responders. 343 firefighters. 37 Port Authority police officers. 23 NYPD officers. 8 EMS providers. It remains the worst single day for emergency responders in the history of this country, and every one of those 411 climbed a stairwell while everybody sane came the other way.

I want to stay here longer than an anniversary piece usually does, because the number most people carry in their head is the 2,977, and the number that should keep them up at night is the one that is still moving.

The FDNY released a report three days ago covering twenty-five years of health effects. More than 600 of its members have now died from illnesses they took on working that site. That is past the 343 they lost on the day itself. Nearly 16,000 are enrolled in monitoring. More than 12,000 carry a certified condition. Almost 5,000 have had cancer, and roughly a quarter of those people have had more than one kind of it, which is the sort of number that stops reading like a number the moment you picture one firefighter sitting in one office getting that news for the second time.

Their commissioner, Lillian Bonsignore, said it in a sentence I have not been able to shake since I read it. 9/11 was not a one-day event for our department. It is a day that continues to sicken our members.

That is what the morning cost the people who ran at it. What it did to the rest of us started the same day, and in my case it started about twelve hundred miles west of the smoke, on a piece of ground where nothing had happened at all.

I was in the Army. Everything changed.

Fort Riley, Kansas. The nearest town is Manhattan. We went to THREATCON Delta and locked the post down. Moving anywhere became incredibly hard, gates shut, every vehicle searched, lines that ate an hour before you cleared them, and a post that had always felt like a small town started behaving like a perimeter. Soldiers who had never pulled that kind of duty in their careers went onto guard shifts.

My daughter was born three days later.

She arrived on a post sitting at the highest threat condition the United States Army has, to two parents who had planned for a completely ordinary week. Family wanted to come and see her. Getting them through the gate turned into its own small operation, and I remember being angry about it in a way that had nowhere useful to go.

I have never managed to separate those two events, and some years ago I stopped trying. My daughter's birthday and the worst morning this country has had sit three days apart on every calendar.

She turns twenty-five in three days.

That is the thing that got my attention this year. Every institution we built in response to that morning is exactly her age. She has never lived in the version of America that existed before it, and neither has anybody I am hiring as they enter the workforce.

What that morning built

Strip the anniversary language off it and the finding at the center of the 9/11 Commission Report comes down to something narrower and more uncomfortable than a failure to know. The pieces sat in different buildings, held by people who had no mechanism and no incentive to put them beside each other. The governing default was need to know, and need to know is a security control. It did precisely the job it existed to do. It kept information away from people who should not have had it, and it kept information away from people who needed it, because the control had no way of telling those two groups apart.

So the country rewrote the default. Need to share replaced need to know, and almost everything that followed was an attempt to build machinery for that sentence.

Congress authorized the Department of Homeland Security in November 2002, and it opened its doors in January 2003, the largest federal reorganization since the National Security Act of 1947. The Intelligence Reform and Terrorism Prevention Act of 2004 created a Director of National Intelligence and the National Counterterrorism Center, on the theory that somebody ought to be accountable for the whole picture rather than a slice of it. State and regional fusion centers followed. The ISAC model predates all of it, since it came out of a presidential directive in 1998, but the mandate and the money arrived afterward.

That reform got one enormous thing right, and it took me years inside this work to see how completely right it was. The need to share intelligence about human operatives bore the same patterns in technology. Same problem, different medium. Fragments sitting in separate places, held by people with no reason to put them together, against an adversary who has to be right once while you have to be right continuously (this is the way). Every indicator you push into a sharing community today is that human intelligence lesson, ported.

So if you work in security, none of that is background history. It is the reason you say the phrase "information sharing" without thinking about it. Every ISAC membership, every threat feed on the budget line, every slightly awkward call to a peer at a competitor to ask whether they are seeing the same thing you are seeing, all of it traces back to a conclusion somebody wrote down about a morning in 2001.

Nobody in my formation that September used the word cyber. That came later, with the budget.

Under threat, again

The clearest surviving expression of need to share in American law is the Cybersecurity Information Sharing Act of 2015. It does one genuinely useful thing. It gives a company liability protection when it hands threat indicators to the government, which is the entire difference between a security team that shares and a legal department that says no.

Here is where that law sits on the twenty-fifth anniversary.

It sunset on September 30, 2025. It stayed expired for roughly six weeks, until Congress passed a temporary renewal on November 12 that ran only to the end of January, which is the sort of runway you hand a pilot program rather than the legal backbone of national threat sharing. The partial shutdown then killed it a second time, for several days, and almost nobody outside this field noticed. A spending bill signed on February 3, 2026 brought it back through September 30 of this year. A continuing resolution has now carried it to December 11.

Twice in twelve months, the statute protecting the act of telling each other what we know was legally dead. Not under debate. Dead.

I am not going to dress that up. We pulled one durable lesson out of the worst morning in modern American history, and we now renew it in ninety-day increments, stapled to whatever spending fight happens to be running that month.

September 11 is not over. It is still killing the people who ran toward it, and the single lesson we managed to write into law is currently running ninety days at a time.

The price we agreed to pay

The cost sits on the other side of the same ledger, and it is not the cost people usually list. We gave up privacy rights willfully. Nobody took them from us. We handed them over to feel safer, and the arrangement worked well enough that we stopped thinking about the transaction at all. Those rights were real, they are rarely considered now, and in a global digital world where nearly every device we own reports on us by default they remain a true cost of safety.

That cost needs to be considered routinely, not forgotten and not normalized. Normalized is the dangerous one. A cost you argue about every few years is a cost you are still choosing on purpose. A cost nobody mentions has quietly become the floor, and floors do not get voted on.

The accounting also stops too early, which is where I part company with most anniversary coverage. The impact on our military went far beyond the people hurt that day. It bore a twenty year war. A real war, not the tidy version that shows up in a retrospective, with thousands of service members dead or disabled and one of the most significant mental health crises the armed forces have ever seen. More than 7,000 killed in the post-9/11 wars. Brown University's Costs of War project puts the number of post-9/11 service members and veterans lost to suicide at more than four times that figure.

History, not memory

Many of the service members serving today were not born when this began. The soldiers pulling guard at Fort Riley tonight have no memory of the morning that first put their predecessors on those shifts. They inherited the posture without the event. For them it is history, and history is a different animal than memory. History gets taught. Memory gets carried.

That matters more than it sounds, because they are the responders now. The people holding the line today, in a firehouse or a SOC or at a gate in Kansas, are increasingly people for whom September 11 is a chapter rather than a morning. They will make the calls about what we share and what we give up, and they will make them without the thing that made those questions feel urgent to the rest of us.

And the ones who do carry it are running out. The responders are still dying, twenty-five years on, from a day everybody else has filed under history. More than 600 from a single department, and that number will be larger next September than it is today. The living memory is leaving at exactly the moment the people replacing it never had any. Those are the same fact.

My daughter turns twenty-five on Monday, and the soldiers standing guard tonight are her age and younger, which means the gate I could not get her grandparents through is older than every one of them. They will inherit the sharing and the surveillance both. The least we owe them is to keep saying out loud that we chose it.

If this piece finds you at a hard moment, the Veterans Crisis Line is there. Dial 988, then press 1.