25 Years After 9/11: Confronting the Next Generation of Threats

As discussed later in this testimony, China, Russia, and North Korea’s expanding conventional and nuclear capabilities increasingly threaten the United States—including the U.S. homeland—in ways that did not exist in the aftermath of 9/11.

Evolving Irregular and Gray Zone Threats

The United States also faces an evolving set of irregular—or gray zone—threats. Actions below the threshold of conventional warfare have long been an important component of statecraft.⁴ U.S. military doctrine refers to these types of actions as “irregular warfare.”⁵ Others have used such terms as gray zone activity, political warfare, asymmetric conflict, and low intensity conflict.⁶ Regardless of the term, the main components include:

• Information and influence operations, including psychological operations and
• Offensive cyber operations and electronic
• Support to state and non-state partners, such as guerrillas and proxy
• Covert and clandestine actions by intelligence and special operations forces, including sabotage and subversion.
• Economic ⁷

Countries carry out these types of operations for several reasons. First, they allow military and intelligence agencies to conduct coercive activities below a level that is likely to trigger a costly or risky conventional war. Second, irregular and gray zone activity is relatively inexpensive for perpetrators. Unlike conventional war, these activities generally do not require vast sums of money or cause the perpetrator to suffer substantial casualties. Some of these actions—such as offensive cyber and influence operations—can also be done from a state’s own territory, a third country, or virtual networks that lie far from the target country. Third, these actions are often deniable and difficult to attribute. Targeted governments are frequently cautious about attributing them because they fear escalation or want to protect intelligence sources and methods.⁸ Fourth, actions below the threshold of conflict can impose costs on targeted countries. For example, Russian sabotage operations in Europe have caused hundreds of millions of dollars in damage to undersea cables, rail infrastructure, pipelines, and other infrastructure. Defensive measures to protect physical and cyber infrastructure can also be expensive.⁹

China: The most significant long-term threat to the United States likely comes from China, which uses a wide range of tools below the threshold of armed conflict to expand the influence of the CCP and weaken the United States. While some of these Chinese actions are overt, many are designed to be covert and deniable. The U.S. public and other international audiences are often unaware of the nature and scope of these activities, including those that target companies, government agencies, universities, news media, digital platforms, and other organizations. China’s activities are wide ranging and include:

• Intelligence Operations: China’s intelligence services, such as the Ministry of State Security (MSS) and Ministry of Public Security (MPS), are engaged in extensive human intelligence, signals intelligence, and other types of intelligence collection as part of irregular warfare and gray zone operations—including intimidating Chinese diaspora in the United States. Chinese intelligence operations are not just pervasive, but they are used to plan and execute all of China’s other irregular warfare activities. The 2026 conviction of John Rogers, a former senior adviser for the Federal Reserve Board of Governors who collaborated with Chinese intelligence, is only the most recent example of the Chinese intelligence threat to the United States.¹⁰ In addition, China is also expanding its intelligence collection overseas against the United States, such as building signals intelligence platforms in such countries as Cuba and constructing space ground stations in such countries as Argentina.¹¹
• Cyber Operations: Chinese organizations, including units within the People’s Liberation Army (PLA), are involved in aggressive cyber campaigns against U.S. companies, universities, government agencies, media, think tanks, nongovernmental organizations, and other These efforts are designed to help China leapfrog ahead of the West by skipping the extensive and time-consuming research and development phases for new technologies. China’s cyber operations are also intended to influence foreign and domestic audiences, conduct long-term surveillance and intelligence gathering (such as Salt Typhoon), and assist with offensive military campaigns (such as Volt Typhoon).
• Information and Disinformation Operations: China is engaged in extensive information and disinformation activities overseas—including in the U.S. homeland—designed to influence decisionmaking and popular support to gain a competitive advantage. Beijing seeks to tightly control the image of China abroad, including influencing companies, organizations, and individuals that criticize China, from the National Basketball Association to Hollywood studios.
• United Front Work: China is involved in aggressive efforts to extend its reach overseas through united front work, which involves activity to protect and bolster the image of China and the United front work includes activities conducted in support of China’s soft-power agenda that seek to influence individuals who are positioned to amplify China’s preferred messaging on political, economic, and academic issues.
• Irregular Military Actions: The PLA Navy, PLA Air Force, PLA Rocket Force, People’s Armed Forces Maritime Militia, Coast Guard, research organizations, and private security companies linked to China are involved in widespread efforts to expand Chinese influence below the threshold of armed conflict. Chinese organizations are involved in near-seas activities (which focus on securing Chinese interests around such areas as the South and East China Seas) and far-seas activities (which are global in scope).
• Economic Coercion: China is increasingly engaged in the threat or imposition of economic costs and inducements to influence decision-making and popular support across the globe to gain a competitive advantage. There has been considerable focus on the Belt and Road Initiative as part of a broader effort to influence foreign Another concerning Chinese initiative is the Digital Silk Road, which aims to spread Chinese influence through telecommunications, e-commerce, hardware, software, big data, artificial intelligence/machine learning, and other digital infrastructure across the globe.

These tools are not mutually exclusive but are overlapping, reinforcing, and occasionally even duplicative and competitive. Multiple organizations are involved, such as the PLA, Ministry of State Security, Ministry of Public Security, United Front Work Department, and Ministry of Foreign Affairs. A wide range of non-state or quasi-state actors are also involved, from hacktivists to private security companies.

China has several strategic goals in conducting irregular and gray zone activities. The most important is preservation of the CCP’s rule. Another is expanding Chinese influence and weakening the United States as part of balance-of-power competition. These goals are in line

with China’s national strategy of achieving “the great rejuvenation of the Chinese nation on all fronts.”¹²

Russia: Russia (and the Soviet Union before it) have a long tradition of conducting irregular and gray zone activities. During the Cold War, the Soviet Union developed an aggressive campaign to influence populations across the globe in ways that aided Soviet interests and undermined the United States and its allies, which was best captured in the phrase “active measures” (or активные меры).¹³ Today, Russian active measures support several types of foreign policy objectives:

• Influence public opinion through psychological operations in Europe, the United States, and other countries to support Russian interests.
• Coerce governments, companies, or individuals to stop taking specific actions, such as curbing military and other assistance to Ukraine.
• Deter countries, companies, or individuals from taking specific actions, such as escalating the type and amount of military aid to Ukraine.
• Deter Russian soldiers, government officials, and citizens from defecting to the
• Create fissures between governments, especially between NATO
• Undermine the democratic norms and values that underpin the

Today, Russia is involved in a range of aggressive irregular and gray zone activity in the United States, from offensive cyber operations to espionage and disinformation. One of many recent examples is a Russian and Chinese intelligence campaign to spread disinformation on social media platforms about AI data centers in the United States.¹⁴ The Russian government has also conducted a campaign of sabotage and subversion—especially in Europe—designed to target countries, companies, and individuals that have provided support to Ukraine. Led by the Main Intelligence Department, or GRU, Russian attacks have included bombings, drone incursions, sabotage against undersea cables and pipelines, electronic attack, and cyber operations. Russia’s strategy has likely been to coerce governments and companies to stop providing assistance to Kyiv, deter Russian soldiers and citizens from defecting to the West, sow fear and division, and undermine public support for the Ukraine war.

Iran: Iran and Iranian-linked groups, such as Lebanese Hezbollah and the Houthis in Yemen, also pose an irregular and gray zone threat to the United States. Ayatollah Khomeini established the Islamic Revolutionary Guard Corps in 1988 to expand and improve Iran’s irregular warfare capabilities. The Quds Force (“Quds” is the Farsi word for Jerusalem) became Iran’s elite paramilitary arm, roughly equivalent to a mix of U.S. special operations forces and CIA paramilitary forces. It gathers intelligence, trains and equips partner forces, and conducts assassinations and bombings outside of Iranian territory.¹⁵ The Quds Force and Iranian-linked groups and individuals have plotted numerous attacks and assassinations inside the United States, including against U.S. President Donald Trump, former national security advisor John Bolton, and the Saudi ambassador to the United States.¹⁶ Iran has also engaged in a wide range of other irregular and gray zone activities, such as offensive cyber operations and disinformation campaigns.

Terrorist and Other Threats: The United States faces a significant threat from a range of terrorist groups, criminal organizations, and other non-state actors. Unlike during the period after 9/11, there is no clear paramount threat from a group like al-Qaeda. Instead, the United States faces formal groups, loose networks, and lone actors who are plotting to kill Americans and spread fear in the United States or otherwise threaten important U.S. security interests.¹⁷

The End of Sanctuary

Based on these threats, the U.S. homeland is more vulnerable than it has ever been, signaling an end of U.S. sanctuary. The homeland has, of course, never been entirely secure. The British burned Washington (including the White House) during the War of 1812, al-Qaeda terrorists attacked the United States on 9/11, and the Soviets posed a serious nuclear threat to the United States during much of the Cold War. The Japanese also struck Pearl Harbor before Hawaii was a state. Nevertheless, the Atlantic and Pacific Oceans have helped insulate the U.S. homeland from external attack, along with relatively friendly neighbors to the north and south.

Today, however, threats to the U.S. homeland are greater than they have ever been.

First, U.S. adversaries—such as China, Russia, and North Korea—have significantly advanced their conventional and nuclear capabilities to strike the U.S. homeland. China possesses a growing arsenal of land-based intercontinental ballistic missiles, such as the DF-41, which can hit targets across the continental United States; sea-based submarine-launched ballistic missiles, such as the JL-3, which can be launched from the PLA Navy’s nuclear powered submarines and can target locations across the U.S. homeland; and aircraft, such as the H-6N bomber, that can launch land-attack cruise missiles and air-launched ballistic missiles against the

U.S. homeland. In addition, Russia possesses a range of land-based intercontinental ballistic missiles, such as the RS-28 Sarmat and RS-24 Yars, capable of hitting the U.S. homeland; submarine-launched ballistic missiles, such as the Bulava, that can strike the continental United States from the Arctic or Pacific; and Kh-101 (conventional) and Kh-102 (nuclear) air-launched cruise missiles that can hit the United States from Russian aircraft. Finally, North Korea has intercontinental ballistic missiles, such as the Hwasong-18 and Hwasong-19, capable of hitting the U.S. homeland.¹⁸

During the Cold War, the U.S.’s nuclear arsenal was a deterrent against Soviet conventional and nuclear attack, including through the concept of Mutually Assured Destruction. But nuclear weapons are no longer a deterrent to conventional attack. Iran has conducted multiple attacks against nuclear-armed Israel with cruise missiles, ballistic missiles, and drones, as have Iranian partner forces such as Lebanese Hezbollah and the Houthis in Yemen. In addition, Ukraine has ramped up attacks against nuclear-armed Russia by orchestrating a series of short-, medium-, and long-range strikes to disrupt and destroy Russian logistics and supplies. Ukraine has struck several types of Russian targets with conventional weapons:

• Energy infrastructure, such as oil refineries, pumping stations, and fuel storage facilities and tankers.
• Industrial base targets, such as missile and drone production facilities, microelectronics plants, and semiconductor plants.
• Logistics targets, such as rail lines, roads, bridges, and munitions storage facilities, as well as vehicles and freight trains transporting military supplies.
• Military bases and other military targets, such as headquarters, command and control facilities, ships, aircraft, radar, air defense systems, drone launch positions, and electronic warfare systems.

As Figure 3 illustrates, Ukraine has conducted long-range strikes (greater than 300 kilometers from Ukrainian territory) against such cities as St. Petersburg and Moscow. Ukraine has also orchestrated medium-range strikes (30–300 kilometers) against targets in Kursk, Kaluga, Belgorod, and other oblasts. Finally, Ukrainian forces have carried out short-range strikes (less than 30 kilometers) against thousands of targets just across the border in Russia and in Russian-controlled areas of Ukraine, such as Crimea.¹⁹

The implication is clear: the U.S.’s nuclear arsenal is no longer sufficient to deter conventional strikes

Second, there is an increase in irregular and gray zone threats and capabilities from state and non-state actors against the U.S. homeland. One example is the proliferation of commercially available, AI-enabled unmanned systems, which can be weaponized. Both Ukraine and Russia are building drones with longer ranges, higher payloads, a greater ability to evade electronic warfare and countermeasures, autonomy, and AI that allows for drone “swarming.”²⁰ During Operation Spider Web in 2025, Ukraine smuggled drones into Russia inside of cargo trucks and conducted strikes that damaged or destroyed Russian military aircraft, including Tupolev Tu-95MS and Tu-22M3 strategic bombers.

U.S. military installations, nuclear power plants, and other critical infrastructure are experiencing a high volume of unauthorized drone incursions. Concerts, sports stadiums, transportation infrastructure, and other locations in the U.S. homeland are increasingly vulnerable to advanced unmanned air, ground, sea, and undersea systems. As Cathy Lanier, the Senior Vice President and Chief Security Officer of the National Football League, said at the Center for Strategic and International Studies in June 2026, “Our distance from our adversaries is no longer a sense of safety for us … If you think about just one mass gathering attack, the Super Bowl, we have 70,000-80,000 people, but we have a global stage.”²¹

Congress has made notable progress on countering drones, particularly with the passage of the Safer Skies Act. However, significant gaps in technology, bureaucracy, and implementation remain. There are still limited authorities for federal, state, and local officials to counter and mitigate the threat from drones. The Safer Skies Act does not grant counter-drone mitigation authority to private entities. Private venue operators, critical infrastructure owners, and hospitals remain legally barred from jamming or destroying unauthorized drones themselves. While the act provides a legal pathway for local authorities to intervene, commercial consumer drone technology is advancing much faster than the slow federal policy and equipment acquisition cycles. There is also a severe operational bottleneck caused by the Safer Skies Act’s requirement that all state and local law enforcement have to be certified by a single federal schoolhouse: the FBI’s National Counter-UAS Training Center in Huntsville, Alabama. More than 18,500 state, local, and correctional agencies depend on that training center, which opened in 2025.²² But only 61 officers had been official certified by July 1, 2026.²³

In addition, there has been a significant increase in the offensive cyber threat to the U.S. homeland. Unlike traditional Chinese hacking groups that historically focused on intellectual property theft or political espionage, Volt Typhoon’s explicit mission was strategic sabotage of

U.S. critical infrastructure—such as power grids, water systems, communications hubs, and transportation hubs—that could be triggered in the event of a U.S.-China crisis.

Intelligence Implications

Two and a half decades after 9/11, there is an urgent need to increase intelligence collection and analysis across federal, state, and local entities; identify and fix security gaps; and strengthen the American public’s resilience against enemies at home and abroad. This committee possesses the unique bipartisan oversight and legislative authorities to reshape the intelligence community for a new era. The 9/11 commission was helpful in improving intelligence sharing and coordination against an evolving terrorist threat. But U.S. intelligence efforts are far too siloed, under-resourced, and unprepared to deal with the evolving state-based threat to the United States—especially a U.S. homeland that is increasingly vulnerable to attack. I have included below several suggestions for consideration:

• The Office of the Director of National Intelligence (ODNI): One of the most significant recommendations of the 9/11 Commission was to create an ODNI to coordinate and improve accountability across a stove-piped S. intelligence community. But 25 years later, ODNI has failed to effectively achieve these results. Instead, it has added another layer of bureaucracy with ambiguous authority, little budget control or coordination, patchy leadership, and a tendency to complicate rather than improve intelligence sharing. Congress should consider a major review—either by Congress or a Congressionally-mandated national commission—of the ODNI based on the evolving national security landscape and policy needs. Should ODNI be abolished? Should it be replaced by a small, professional intelligence office, perhaps akin to the Office of Management and Budget, that focuses on coordination and deconfliction of such issues as counterintelligence, counterterrorism, and other threats? Should ODNI be significantly evolved in other ways? These are difficult—but momentous—questions that need to be urgently answered.
• Section 702: Section 702 of the Foreign Intelligence Surveillance Act allows a range of U.S. intelligence agencies—such as the National Security Agency, Central Intelligence Agency, and Federal Bureau of Investigation—to collect communications between foreigners overseas. With Congressional oversight and protection of U.S. citizens, the program has been successful. It has prevented terrorist attacks and aided in the conviction of international criminal groups, Russian and Chinese spies, and drug traffickers. But Section 702 lapsed on June 12, 2026, after Congress failed to pass an extension. While existing FISA court surveillance certifications may allow current intelligence collection to temporarily continue, the lapse has plunged U.S. intelligence agencies and telecommunications providers into a highly uncertain legal gray zone. Based on the multi-faceted state and non-state threats to the U.S. homeland, the right answer is clear: reauthorize Section 702.²⁴
• Joint Terrorism Task Forces (JTTFs) and Fusion Centers: Congress should consider broadening the mandate for JTTFs and Fusion Centers to focus on state-sponsored threats. Expanding the formal charter will allow local agencies to tackle illicit corporate and criminal activities that are below the threshold for federal investigations, but are critical components of Chinese, Russian, and other foreign intelligence There is also a national shortage at every level for sworn law enforcement personnel that are responsible for homeland security threats. To combat this, many agencies have employed civilians to fill the gap. Congress should consider supporting a grant-funded program to embed civilian Intelligence Support Officers into JTTFs and Fusion Centers, which would allow them to bridge the gap between local investigative data and federal intelligence feeds.
• Legislation Against Foreign Agents: Enact stronger legislation that criminalizes foreign agents that harass, surveil, or conduct other types of actions against U.S. residents on American soil, a tactic frequently deployed by China and other governments. This should include strengthening the Foreign Agents Registration Act (FARA).
• Critical Infrastructure Protection: Expand the mandatory reporting requirements for cyber incidents and physical attacks orchestrated by state-backed groups attempting to compromise S. water, energy, transportation, and other critical infrastructure. Foreign adversaries are weaponizing advanced technology, including generative AI and micro-targeted digital campaigns, to inflame domestic political opinion, undermine trust in democratic institutions, and exploit vulnerabilities in critical infrastructure.

There are other steps that Congress should consider, but which fall outside of the jurisdictions of the House and Senate intelligence communities. One of the most significant is legislation that helps counter drone incursions in the U.S. homeland. While such legislation as the Safer Skies Act represents an important shift by granting state and local agencies the right to detect, track, and mitigate hostile drones, the legal and technical frameworks are still being established. Congress should also help ensure that the Department of Justice and the Department of Homeland Security have adequate appropriations to implement the mandatory national training and certification programs required for local officers. Congress should also build upon the Federal Communications Commission’s recent actions and consider establishing a clear framework allowing vetted, high-risk critical infrastructure operators to deploy approved counter-UAS systems under direct federal or state and local law enforcement supervision.

The 9/11 Commission report was instrumental in arguing that the United States faced a “generational challenge” from terrorist groups that threatened the United States.²⁵ Today, there is a new generation of Americans and a new generational challenge—one based largely on adversary threats to the U.S. homeland and U.S. interests abroad. The United States is witnessing an end of sanctuary after decades of relative safety from foreign adversaries. President Dwight D. Eisenhower may have said it best in a radio address to the nation on May 19, 1953, when he emphasized the need for a sustainable defense of the nation, “A defense strong enough both to discourage aggression and beyond this to protect the nation—in the event of any aggression... This defense must, first of all, be one which we can bear for a long and indefinite period of time.”²⁶

Please consult the PDF for references.