How 9/11 Changed U.S. Immigration: The 25-Year Rebuild

On 28 February 2003, a person applying to live or work in the United States dealt with the Immigration and Naturalization Service, a bureau of the Department of Justice. On 1 March 2003, the same person dealt with three pieces of a department built around preventing terrorist attacks. Nothing about their case had changed. Everything about who was judging it had.

That administrative move is the most consequential thing September 11 did to American immigration, and it explains most of what followed. The mandatory visa interview, the fingerprints taken on arrival, the school that reports your enrolment to a federal database, the social media accounts a consular officer expects to be public: these are not separate policies. They are floors added to one building, and the foundation was poured between 2001 and 2005.

Twenty-five years on, the machinery has outgrown the emergency that produced it. Systems built to find nineteen men now hold records on more than 300 million people, govern 1.58 million students, and fund a deportation apparatus larger than the rest of federal law enforcement combined.

This is what changed, in order, with the dates and the numbers attached.

What the hijackers actually carried

The claim that the September 11 hijackers slipped into the United States on student visas has circulated in Congress and on cable news for two decades. It is wrong. The 9/11 Commission’s Staff Statement No. 1 found that the 19 men filed 24 visa applications between 1997 and 2001 and received 23 visas. Fourteen carried B-2 tourist visas. Four carried B-1 business visas. Exactly one, Hani Hanjour, the pilot who flew American Airlines Flight 77 into the Pentagon, held a student visa. Those 19 men made 33 separate entries into the United States before the attacks, most of them through a tourist channel nobody had built a tracking system for.

Hanjour’s paperwork showed enrolment in an English-language program in Oakland, California. He never attended a class, and he never overstayed the visa itself. His violation was academic non-attendance, not immigration status. The other 18 men had no student paperwork to violate at all.

What the Commission actually found was undetected fraud and a watchlisting failure. Thirteen of the 19 presented passports issued less than three weeks before their U.S. visa applications, a pattern that drew no added scrutiny from consular officers. Two hijackers lied on their applications in ways the Commission called detectable, and nobody questioned them about it.

The larger failure happened before any of them reached an airport. The CIA tracked Nawaf al-Hazmi and Khalid al-Mihdhar to a January 2000 al-Qaeda planning meeting in Kuala Lumpur and knew al-Mihdhar held a U.S. visa. Neither man was added to the State Department’s watchlist. They flew into Los Angeles on 15 January 2000 under their real names and lived openly in San Diego for more than a year before the CIA passed their names to the FBI on 24 August 2001, eighteen days before the attacks. A watchlist entry, not a different visa category, would have stopped them at the gate.

The agency that disappeared

President George W. Bush signed the Homeland Security Act on 25 November 2002, folding 22 existing federal agencies into a single Department of Homeland Security with roughly 170,000 employees at the outset. The Immigration and Naturalization Service was one of them. On 1 March 2003, INS formally ceased to exist and its roughly 36,000 employees were divided three ways.

None of this was a new idea in 2002. The Jordan Commission, chaired by Representative Barbara Jordan, spent 1994 to 1997 arguing that INS should be split because its enforcement culture and its service culture worked against each other inside one building. But the Commission’s own plan scattered the pieces to existing departments: enforcement to Justice, benefits and visa functions to State, labour cases to Labor. Nobody in that debate proposed inventing a fourth cabinet department around a counterterrorism mission and putting all of immigration inside it. That is what happened instead, and it set the direction for every rule DHS has written since.

The scale shift shows in the numbers. When ICE and CBP opened for business in March 2003, their combined starting budgets were $4.82 billion. For fiscal 2026, Congress appropriated $11 billion for ICE and $18.98 billion for CBP through the regular process, then layered on $75 billion for ICE and $22.6 billion for CBP through reconciliation. CBP and ICE together now employ more than 96,400 people, against the entire INS headcount of 36,000 in 2002.

A visa application, year by year

The clearest way to see the rebuild is not a list of statutes. It is to watch a single visa application accumulate requirements. Drag the year below and the application rebuilds itself: each layer appears in the year it was added, with the law or policy that produced it.

Two things stand out when you run it. The first is how compressed the construction was: most of the permanent architecture was in place by January 2004, inside twenty-eight months of the attacks. The second is that almost nothing has ever been removed.

The legislative stack

The USA PATRIOT Act became law on 26 October 2001, forty-five days after the attacks, and it moved faster than anything that followed. Section 411 rewrote the terrorism-related grounds of inadmissibility, adding material support for a terrorist organisation as a standalone bar. Section 412 gave the Attorney General power to certify a noncitizen as a suspected terrorist and detain that person without charge. No applicant reads Section 411 directly, but the terrorism questions on every visa and green card application trace back to it.

Congress applied the same template to immigration on 14 May 2002 with the Enhanced Border Security and Visa Entry Reform Act. It ordered an interoperable database linking law enforcement, intelligence and visa records, required posts to transmit an applicant’s visa file electronically to the border before arrival, and forced State to expand student tracking after two hijackers used fraudulent changes of student status to stay in the country.

What stands out across fifteen years of statutes is what never happened. None of these provisions has been repealed. The interview requirement, the biometric mandate, the interagency database, the asylum corroboration rule and the waiver exclusions all still stand, layered on top of each other rather than replacing one another.

The four layers that reach every applicant

Strip away the country-specific rules and four changes reach nearly every visa applicant regardless of nationality.

The in-person interview. State began requiring most applicants to appear before a consular officer under a policy effective 1 August 2003, and Congress wrote the requirement into law with the Intelligence Reform and Terrorism Prevention Act on 17 December 2004. The statute, now codified at INA 222(h), requires an interview for anyone at least 14 and no older than 79, with waivers reserved for diplomats and officials on A and G visas, qualifying renewal applicants, and a narrow set of categories the Department periodically adjusts.

Biometrics. The 2002 Enhanced Border Security Act first mandated biometric identifiers on visas, and US-VISIT began collecting fingerprints and photographs at ports of entry on 5 January 2004. By the end of 2005 it covered every land border crossing. More than two decades later, biometric exit still is not complete. DHS has never built a comprehensive system to capture travellers leaving the country, largely because domestic and international travellers mix at the same airport exits. The government can prove with certainty when almost everyone enters but cannot systematically prove when they leave, which is why overstay tracking still leans on airline departure manifests.

The interoperable database check. Once an officer issues a visa, the file moves electronically to CBP before the traveller boards, a requirement written into the 2002 act so a name flagged after issuance but before arrival could be caught at the port rather than after entry. Every visa record is checked against watchlists fed by the National Counterterrorism Center, created by IRTPA in 2004, each time that record is queried.

The Security Advisory Opinion. Known informally as Visas Mantis when it applies to scientists and engineers, it surfaces as administrative processing, the words stamped on a passport when an officer cannot issue the same day. The system nearly buckled in its first two years. A Government Accountability Office review found that in spring 2003 Mantis cases took an average of 67 days to clear, and State’s own figures put the October 2003 average at 75 days, long enough to cost an applicant a semester or a job start date. State restructured the process through 2004, centralising case management and setting interagency deadlines, and by November 2004 GAO found the average had fallen to roughly 15 days.

Two decades on, the typical case moves far faster than it did in 2003. The outlier cases, the ones that generate complaints, still take about as long as they did when the system was new.

Special registration

The port-of-entry version of NSEERS, the National Security Entry-Exit Registration System, started as a pilot on 11 September 2002 and covered all ports of entry by October. Officers fingerprinted and photographed arriving nonimmigrant men from designated countries, questioned them under oath about their travel plans, and required many to check in again at set intervals and to leave only through a designated departure port.

A domestic call-in phase followed for men and boys aged 16 and over already inside the country, run in four registration groups between 5 November 2002 and 25 April 2003. Twenty-five countries appeared on the list across both phases. North Korea was the only one that was not majority-Muslim.

By May 2003, 82,581 people had complied with the domestic call-in portion. At least 13,153 of them were placed in removal proceedings, nearly one in six of everyone who showed up to register. The proceedings did not stem from terrorism findings.

DHS stopped adding names to the country list on 28 April 2011, effectively mothballing the program after officials found it duplicated data the government already collected and produced no security return. The regulations stayed on the books for five more years. DHS did not remove them until a final rule published 23 December 2016.

That five-year gap was not paperwork housekeeping. As long as the special-registration regulation existed, USCIS kept applying it retroactively. Someone who missed a re-registration appointment or an exit check years earlier could still be found to have wilfully violated their nonimmigrant status when they later filed for a green card, a renewed visa or naturalization, even with a citizen spouse, a decade of employment and an otherwise clean record. The burden fell on the applicant to prove the lapse was excusable, years after the fact and often without the paperwork to do it.

So a program that had not enrolled a single new registrant since 2003, and had not flagged a single terrorist, kept producing adverse immigration decisions for another decade, because the rule that created the violation outlived the operation that generated it.

The databases you are now in

An applicant moving through the U.S. immigration system today leaves data in at least seven federal systems, and every one of them either did not exist before September 2001 or was rebuilt afterwards specifically so it could talk to the others. That interoperability, not any single new law, is the durable legacy of the rebuild.

Start with biometrics. IDENT, now run by the DHS Office of Biometric Identity Management, holds more than 300 million fingerprint identities, roughly a billion enrolled face images and around 9 million iris pairs, making it the largest biometric repository in the U.S. government. A 2008 memorandum of understanding between DHS, the FBI and the State Department made IDENT and the FBI’s fingerprint system interoperable, so a single query run at a border booth, a consulate counter or a police station now hits both at once. Before that agreement, the two systems could not see each other.

The connective tissue is the Terrorist Screening Database, built after Homeland Security Presidential Directive 6 in September 2003 folded competing agency watchlists into one FBI-run list at the newly created Terrorist Screening Center. It held roughly 158,000 names in 2004. By 2017 that had grown past 1.16 million. Every visa application, every ESTA request and every SEVIS enrolment is now checked against it.

Who stopped coming

Two systems seized up within weeks of the attacks, and neither snapped back on its own. The refugee resettlement pipeline and the visa pipeline that fed foreign students and researchers into American universities both went into a multi-year decline that the institutions depending on them could not reverse by asking nicely.

The government suspended new refugee arrivals for roughly three months after September 11 while the INS recalled the circuit-riding officers who interviewed applicants in camps overseas and reassigned them to security work at home. New interagency name checks and medical screening added months to every case still in the pipeline. The ceiling, the number the president sets each year as the program’s maximum, barely moved. Admissions collapsed anyway, from 68,920 in FY2001 to 26,790 in FY2002, a fall of 61 percent in a single year. The program did not come close to filling its ceiling again until FY2016.

Student and exchange visas fell on a similar timeline. Five of the six major sending regions recorded fewer student visa issuances after 2001, and the Middle East fell hardest. Average issuances per Middle Eastern country dropped from 1,477 in 2000 to 868 in 2002, a decline of 41 percent, and to 777 in 2003. Total foreign enrolment at American universities fell 2.4 percent in the 2003/04 academic year, to 572,509 students, the first annual decline in more than three decades. Enrolment fell again in 2004/05, by 1.3 percent, to 565,039.

Universities and scientific bodies made an economic case throughout the slump. Graduate-school applications from China fell 45 percent for 2003/04 and another 15 percent the following year. Applications from India fell 28 percent and then 5 percent. NAFSA and the Association of American Universities used those numbers as evidence that the country was exporting the talent it had spent decades importing.

What it cost

Money is the least ambiguous measure of what the country built after 2001, because dollars do not require interpretation the way a policy memo does. The United States has spent more than $315 billion on immigration enforcement since DHS was created in 2003, and federal immigration enforcement spending has grown nearly sixfold since FY2000.

By FY2012 that spending had overtaken the rest of federal law enforcement combined. CBP, ICE and the US-VISIT program spent $17.9 billion that year, about 24 percent more than the $14.4 billion spent on the FBI, the Drug Enforcement Administration, the Secret Service, the U.S. Marshals Service and the Bureau of Alcohol, Tobacco, Firearms and Explosives put together.

Staffing tracked the money. Border Patrol had 9,651 agents in FY2001 and 10,717 in FY2003, then roughly doubled to about 21,394 by FY2012, a level that has held since. CBP put the count at 21,471 agents as of June 2026. ICE’s Enforcement and Removal Operations division grew faster in percentage terms, from 2,710 officers in FY2003 to 6,338 in FY2012. Detention capacity grew alongside: the average daily immigration detention population ran near 20,500 in FY2001 and reached 67,456 by February 2026.

None of these numbers required a change in law to keep climbing. Congress and successive administrations chose, budget cycle after budget cycle, to fund a bigger enforcement apparatus rather than a faster legal system.

The machine outgrew its mission

Secure Communities and 287(g) prove that September 11 permanently changed how immigration law is enforced inside the United States, not just at the border. Both tools were built to close information gaps that let hijackers move undetected before 2001. Both ended up doing something else: sorting millions of people with no connection to terrorism through the same machinery, and Congress never voted on that shift.

Secure Communities runs on a simple mechanic. A local jail books someone and runs the fingerprints through the FBI’s criminal database, a routine practice that predates 9/11. What changed afterwards was the second check: those same prints now flow automatically to DHS immigration databases, built from the post-9/11 push to share identity data across agencies that had worked in silos. ICE gets an instant flag on anyone in the country illegally, whether or not the arrest has anything to do with security. DHS rolled the system out nationwide from 2008 to 2013, and from October 2008 through March 2012 it produced about 183,000 removals.

The program’s political life since then has run on repeat. The Obama administration ended it in November 2014 after governors and big-city police chiefs refused to keep booking people into it. It was reinstated by executive order in January 2017, revoked again in 2021, and interior arrests have risen sharply since January 2025 without the Secure Communities name being formally revived, because the fingerprint-sharing plumbing underneath it never stopped running.

287(g) tells the same story with local police instead of jail bookings. Congress created the authority in 1996, but the first agreement waited until 2002, when the Florida Department of Law Enforcement trained officers to identify immigration violators as part of a counterterrorism task force. More than 70 agencies had signed on by January 2009. The count then grew slowly for over a decade, sitting near 135 agencies in January 2025. It has since expanded to roughly 2,466 signed agreements across 39 states by September 2026.

With that caveat attached, the arc is clear. Removals rose from 189,026 in FY2001 to 246,431 in FY2005, 359,795 in FY2008, and a still-standing peak of 409,849 in FY2012. They fell to 240,255 in FY2016 and 185,884 in FY2020 amid pandemic border closures, then climbed again after 2024.

What changed for U.S. citizens

Most retrospectives on 9/11 and immigration focus on foreigners: visas, deportations, border walls. The rebuild also rewrote the rules for U.S. citizens moving in and out of their own country, and that half of the story gets skipped almost every anniversary.

The Western Hemisphere Travel Initiative is the biggest example. Before it, a U.S. citizen could cross back from Canada, Mexico, the Caribbean or Bermuda with nothing more than a driver’s licence or a birth certificate, sometimes just a spoken declaration of citizenship. IRTPA 2004 ordered DHS and the State Department to close that gap. The air phase took effect 23 January 2007. The land and sea phase followed 1 June 2009. Passport ownership jumped accordingly: roughly a quarter of Americans held a passport in 2006, and that share has since roughly doubled, passing 48 percent by the mid-2020s.

REAL ID moved on a slower clock. Congress passed it after the 9/11 Commission found that several hijackers had obtained valid state driver’s licences, and President Bush signed it on 11 May 2005. States resisted for years and deadlines slipped repeatedly. Full enforcement did not arrive until 7 May 2025, twenty years after the statute. Since that date, any traveller 18 or older presenting a non-compliant state ID at a TSA checkpoint faces extra screening or denial unless they carry an alternative such as a passport or a Global Entry card.

All of this runs through an agency that did not exist before 9/11. Congress created the Transportation Security Administration on 19 November 2001, federalising airport screening within weeks of the attacks. TSA now operates on a budget near $11.8 billion a year with a workforce above 58,000, the officers who check every rule above at the checkpoint itself.

The same idea, applied again

The modern era of vetting looks new only if you ignore the paper trail. Every rule since 2015 extends authority Congress built between 2001 and 2004, applied to categories of traveller that DHS and the State Department kept widening.

The first modern statute to attach a travel consequence to nationality itself, rather than to conduct, passed on 18 December 2015. The Visa Waiver Program Improvement and Terrorist Travel Prevention Act stripped visa-free entry from dual nationals of Iraq, Syria, Iran and Sudan, and from anyone who had recently travelled to those countries, regardless of which other passport they carried.

Executive Order 13769, signed 27 January 2017, tested how far that logic could run administratively rather than by statute. Litigation over three successive versions ended at the Supreme Court on 26 June 2018, when Trump v. Hawaii upheld Proclamation 9645 by a 5 to 4 vote. Chief Justice John Roberts described Section 212(f) of the Immigration and Nationality Act as a “comprehensive delegation” that “exudes deference to the President in every clause”.

Online identity followed the same arc. The State Department began requiring social media identifiers on the DS-160 and DS-260 on 31 May 2019, covering five years of usernames. That single question expanded fast. F, M and J applicants were told in June 2025 to make accounts public. H-1B and H-4 applicants followed effective 15 December 2025. From 30 March 2026 the requirement reaches K, R, H-3, Q, S, T and U visas and several smaller categories, covering fiancé visas, religious workers, and trafficking and crime victims alike.

Geography tightened too. From 6 September 2025, nonimmigrant visa applicants must interview in their country of nationality or legal residence, ending decades of third-country stamping. Immigrant visa interviews followed the same rule from 1 November 2025. Then, on 16 December 2025, a new proclamation expanded entry restrictions to 39 countries, 19 under full suspension and 20 under partial suspension, effective 1 January 2026.

None of this is invention. It is the 2002 Homeland Security Act and the 2004 Intelligence Reform and Terrorism Prevention Act, still setting the terms two decades on.

What this means for your case in 2026

Six layers of vetting built since 2001 now apply to a single visa case, and each runs on its own clock. Treat them as separate systems, not one process, and plan around the slowest link. Which layers apply depends on what you are filing.

Build a real buffer for administrative processing. State says most 221(g) holds clear within 60 days of the interview, but a Security Advisory Opinion can run months for applicants in fields like engineering, aviation or nuclear physics, or from countries under heightened screening. Do not book a start date, a wedding or nonrefundable travel against a 60-day assumption.

Treat your online presence as part of the application, not background noise. “Publicly viewable” means exactly that. A locked or friends-only account reads as concealment to a consular officer, so adjust privacy settings before you file, not after a request for evidence.

• Check SEVIS separately from your visa. A visa can stay physically valid while a SEVIS record is terminated, and the reverse happens too. Confirm status through your school’s international office before any international trip.
• Confirm your consular district. Third-country stamping ended on 6 September 2025. If you live outside your home country, check which post you now belong to, because wait times there may be longer.
• Map your dual-nationality exposure. Check whether either nationality falls under the 19 full-suspension or 20 partial-suspension countries effective 1 January 2026. The more restrictive nationality controls.
• Pull your own record first. A prior NSEERS registration or an old overstay has not vanished. Those records sit inside the systems screening every application today.

The architecture is not going to be dismantled. Twenty-five years of statute say the layers stack rather than replace, and the newest one took effect five months ago. Knowing which layer you are standing on, and which law put it there, is the difference between a delay you can plan for and one that takes you by surprise.