The Christmas Day attempt to bomb Northwest Airlines Flight 253 brought with it an especially unsettling aspect of déjà vu. Eight years earlier, there had been another transatlantic flight, another Islamic terrorist from outside the Middle East, and another near miss. Then, too, the solo terrorist had had trouble triggering the explosive, and alert passengers and crew had subdued him.

Counting the “liquids plot” of August 2006, this was al-Qaeda’s third post-9/11 attempt to bring down a transatlantic jet. The fixation on destroying transatlantic flights is reminiscent of an earlier fixation on the World Trade Center. It’s safe to assume that they’re likely to keep trying until they succeed. We’ve known this for years — but we haven’t managed to keep al-Qaeda operatives and explosives off the planes. Why not? In part, because our air-security system failed to work as designed. But also, in part — and this is even worse — because of the way it was designed in the first place; and because, in the years since 9/11, the privacy lobby has managed to stall a host of new security measures.

Let’s start with the unfortunate focus of our air-security system. Keeping weapons off planes has been our central strategy since the days of the Cuban hijackings in the 1960s. Clearly, we’re coming to the end of that era: Weapons keep getting smaller and their hiding places keep getting more imaginative and harder, or more embarrassing, to find. Umar Farouk Abdulmutallab was carrying about 80 grams of explosives — a bit heavier than a hot dog, a bit lighter than bra inserts that can change a B cup to a C.

The focus on weapons has to change, about which more later, but at present searching for weapons is the system we have, and it badly needs improvement. We actually do have better ways to find small weapons hidden in embarrassing places. The millimeter-wave and backscatter machines that look beneath clothing are far preferable to a “patdown” that probes everywhere that three ounces of explosives could be hidden. And, creepy as the scanners are, the privacy issues can be handled by making sure the images can’t be stored or copied and the image screeners are nowhere near the people being screened.

The Transportation Security Administration (TSA) has been using these machines as an alternative to patdowns in “secondary” screening for about a year. But most travelers don’t trigger secondary scrutiny. Abdulmutallab didn’t. If keeping weapons off the plane is our main line of defense — and it currently is — we need to screen everyone for the weapons Abdulmutallab was carrying.

So why don’t we? Today, everyone’s clamoring for the scanners, and even the privacy groups are trying to sound quite responsible on the subject. According to the New York Times, Marc Rotenberg, head of the Electronic Privacy Information Center (EPIC), asserted after the Flight 253 incident that “his group had not objected to the use of the devices, as long as they were designed not to store and record images.” In fact, though, just three months earlier EPIC and nearly two dozen other privacy groups had sent a letter to Congress saying that whole-body imaging ought to be prohibited.

The coalition that signed that letter was a well-oiled machine, one that had stalled many new security measures since 9/11. And, as far as whole-body imaging was concerned, the privacy lobby was on the brink of another success. In June, a bipartisan majority of the House of Representatives had voted to prohibit TSA from using the machines for primary screening. With a three-to-one margin of victory, it was nearly inevitable that the restriction would find its way into an appropriations bill or some other must-pass piece of legislation. If not for the inconvenient timing of the Christmas attack, another new security technology would have been taken off the table. (Oh, by the way, National Review readers, don’t get too comfortable making fun of EPIC and the other left-leaning groups that have made privacy their cause. The privacy coalition that nearly killed imaging also included the American Association of Small Property Owners and the Gun Owners of America, and they persuaded large numbers of conservatives to vote against the security interests of air travelers.)

The influence of the privacy coalition can be seen in a second Christmas Day failure. Abdulmutallab wasn’t on the 4,000-person no-fly list (where President Obama now believes Abdulmutallab’s name once belonged). Worse, he wasn’t even on the 14,000-person selectee list, which would have guaranteed added screening at the TSA checkpoint. And, remarkably, he apparently wasn’t even in the 400,000-person unclassified Terrorist Screening Data Base — the resource used by all agencies to screen for terror suspects. Instead, bits of information about him were apparently sitting in the classified 550,000-person Terrorist Identities Datamart Environment database — essentially a holding pen for information about possible terrorists that is still too fragmentary to enter in the screening databases.

Set aside the failure to put Abdulmutallab into the main screening database — that looks like an error. What’s really troubling is not the error but the policy. We have pretty good information on 400,000 possible terrorists, but fewer than 20,000 of them are on the lists that TSA uses to screen air travelers. That means that 95 percent of the possible terrorists we know about can get on a plane bound for the U.S. without receiving any more scrutiny than a grandmother from Dubuque.

The FBI, the CIA, and the State Department know about these 400,000 suspects — but not TSA. For TSA, if you aren’t on the no-fly or selectee lists, you’re just regular folks. This is so not because TSA didn’t get the memo about Islamic terrorism, but because that’s the way the privacy machine wants it. It’s the intended result of the machine’s remarkably successful effort to stall and then roll back the security reforms undertaken after 9/11.

There’s already an entrenched mythology about the response to 9/11. In the myth, a frightened U.S. government throws civil liberties out the window within weeks of the attacks, launching a seven-year assault on our privacy that a new administration is only now slowly (too slowly, say the netroots) beginning to moderate. But in reality, privacy groups mobilized within weeks of 9/11 and won victory after victory. The Justice Department had to negotiate the USA PATRIOT Act with chairman Patrick Leahy of the Senate Judiciary Committee — a process often ignored when the act is presented as a panicky fait accompli imposed by the executive branch. Then, within 18 months of the attacks, the privacy groups killed the TIPS program designed to encourage citizens to report suspicious behavior, as well as Adm. John Poindexter’s Total Information Awareness (TIA) program, an effort to improve the use of information technology in the War on Terror.

After that, they went looking for bigger game. What they found was TSA.

The Department of Homeland Security (DHS) was brand-new in 2003. One of its priorities was to do exactly what the talking heads are now demanding in the wake of the Christmas Day attack: It wanted to transform TSA’s screening system from one that looked mainly for weapons to one that looked for terrorists as well. The tool for doing that would be a second generation of the Computer Assisted Passenger Prescreening System, or CAPPS II. CAPPS II would process passengers’ travel reservations to identify terror suspects much earlier and screen them more carefully — both before they got to the checkpoint and while they were there.

Until 2003, because TSA lacked access to travel-reservation data, it had relied on the airlines to do the screening. It sent over a list of names, and the airlines checked to see whether anyone with a listed name had made a reservation. If such a person was on the no-fly list, the airline refused to give him a boarding pass. If he was on a selectee list, his boarding pass was marked so that screeners could single him out for additional scrutiny.

That system was deeply unsatisfactory for many reasons, particularly as a consolidated list of possible terrorists was assembled from the many separate databases that existed before 9/11. Once these names had been assembled, the list was long and sensitive. No one wanted to trust unknown airline personnel with the crown jewels of U.S. counterterrorism intelligence, so giving them the entire list was out of the question. Plus, the airlines weren’t that good at figuring out when they had a name that matched. They’d flag Abdulmutallab for screening if that was the name they received from the government. But not Abdul Mutallab. Or Abdulmuttallab.

To make sure that planes were not brought down by a typo, the government had to supply all the likely variants and aliases for every suspect. That created a new problem: Millions of Americans have names that resemble those on the list. Of course they have different addresses and birthdates, so a halfway-decent computer system would not flag those people for scrutiny. The problem was that many in the perennially bankrupt airline industry didn’t have a halfway-decent computer system, and they weren’t eager to spend money upgrading their systems just to do the government’s screening job for it.

So, in 2003, DHS proposed to take over the processing of the list. The idea was straightforward: TSA would collect reservation data from the airlines and run its terror-suspect lists against the reservations. The reservation data would help resolve ambiguous cases in which two or more people had similar names. It would also provide new security capabilities, allowing TSA to identify connections between suspects who were on its list and previously unknown passengers who shared addresses or phone numbers with the suspects and who might be conspiring with them.

There was a bitter lesson at the bottom of that idea. In August 2001, when the government was looking for the two known al-Qaeda operatives at the heart of the 9/11 plot, it would have caught them if it had had access to travel-reservation data. The reservation data would also have revealed links between those two and many of the other hijackers — all before the morning of September 11.

So a new system must have seemed like a no-brainer to the new management at DHS. But, fresh from its victories over TIPS and TIA, the privacy coalition had other ideas. “This system threatens to create a permanent blacklisted underclass of Americans who cannot travel freely,” an ACLU counsel told the Associated Press in February 2003. Another ACLU attorney declared that CAPPS II would “give the government an opening to create the kind of Big Brother program that Americans rejected so resoundingly in the Pentagon.” By June 2003, the organization had filed suit to block the program. By August, a Left-Right privacy coalition was lobbying against it. And by September, just two years after 9/11, the privacy groups had won: Congressional appropriators stopped the program dead in its tracks and prohibited implementation of any program like it until the Government Accountability Office (GAO) certified that ten strict conditions had been met. DHS spent the next five years trying to meet those requirements, without success. Finally, in late 2008, DHS succeeded in launching Secure Flight, a pale imitation of the original program, which gave TSA access to no traveler information other than name, gender, and birthdate. The GAO declared that TSA had met only nine out of ten requirements, and let the appropriators deem that sufficient to begin Secure Flight. To its credit, the Obama administration has stuck with Secure Flight.

So, eight years after 9/11, we’re still looking for weapons and not terrorists — because of the obstructionism of the privacy lobby. As long as Secure Flight was stalled, we were all stuck with the old system of sending lists to airlines and living with whatever their creaking computer systems dished up. Most couldn’t separate Sen. Ted Stevens’s wife from the singer formerly known as Cat Stevens (a reported apologist for the fatwa against Salman Rushdie). As the lists grew, and Secure Flight still languished, the blame fell not on the privacy machine, but entirely on the agency that had tried to fix the problem years earlier. As long as Secure Flight was stalled, administering even a small no-fly and selectee list was painfully difficult, and a massive inconvenience for travelers whose names resembled those on the no-fly and selectee lists. TSA took all the blame — thus discrediting both the idea of screening for possible terrorists and an agency that no traveler was much disposed to love in any event. Every time TSA’s reputation took a hit for mismatched names, it became easier for Congress and the privacy groups to say that they still didn’t trust the agency to administer a new program.

In fact, the millions of privacy victims created by the mismatched names became an excuse for rolling back other security measures, including the terrorist watchlist. In 2008, when TSA began to get close to meeting the congressional requirements for Secure Flight, ACLU official Barry Steinhardt held a news conference to announce that the watchlist had reached 1 million names (he was wrong, but the coverage was good anyway). “The list is out of control,” he said. “There cannot possibly be 1 million terrorists threatening and poised to attack us. If there were, our cities would be in ruins.” He mourned “the tens of millions of Americans [who would now be] caught up in a Kafkaesque web of suspicion.”

This almost brings us up to Christmas Day 2009, and the question of why Abdulmutallab wasn’t on a no-fly or selectee list, or for that matter why 95 percent of the terrorist suspects known to the U.S. government are treated like upstanding citizens when they get to a TSA checkpoint. I have a pretty good idea why the no-fly and selectee lists are so hard to get on. Imagine you were a security official watching the ACLU press conference in 2008. They got the number of names on the list wrong, trashed TSA for a problem they’d created themselves, and got fawning coverage for it. Do you really want to stick your head over the parapet and suggest a substantial expansion of lists that the ACLU says are already “out of control” and victimizing tens of millions of Americans?

In the end, I’m sure all the investigations the president has asked for will find errors in how the agencies handled the lists and the screening. But when they do, let’s for once skip the football analogies — the “fumbles” and the “dropped balls” — and go straight to tennis. Because if ever there was a “forced error” in policymaking, this is it. And, as in tennis, full credit should go to those who forced it. In this case: the privacy machine.