A quarter century has passed since the September 11 attacks exposed critical vulnerabilities in America’s ability to track foreign travelers. Yet according to a bipartisan review released this week by the House Permanent Select Committee on Intelligence, the United States has still not fully implemented one of the most fundamental border security reforms recommended by the 9/11 Commission.

The Commission called for a biometric entry-exit screening system to be created “as quickly as possible.” That recommendation came in 2004. Today, in 2026, the system remains incomplete.

The facts are these: Air exit screening is considered nearly complete. Sea exit remains incomplete. Biometric land exit at both the northern and southern borders is not finished. Even at the southern border, where concerns have been most acute, biometric exit screening is listed as incomplete and relies partially on re-entry data rather than confirmed departure information.

This matters because the inability to determine whether foreign travelers had actually left the United States was among the critical failures that allowed the September 11 plot to succeed.

Consider the case of Nawaf al-Hazmi. He entered the United States in January 2000 after attending an al-Qaeda meeting in Kuala Lumpur with Khalid al-Mihdhar. Both men subsequently lived in California. By August 2001, American authorities had finally begun searching for them. On August 22, immigration officials informed investigators that Mihdhar had re-entered the United States on July 4. They found no record showing that Hazmi had departed after his January 2000 entry. Investigators assumed he had likely left the country with Mihdhar the previous year.

He had not. Hazmi remained in the United States. On September 11, he and Mihdhar hijacked American Airlines Flight 77 and flew it into the Pentagon.

The 9/11 Commission later determined that Hazmi had overstayed his authorized period by nine months. Another hijacker, Satam al-Suqami, had overstayed by four months. Neither violation was detected or addressed before the attacks.

The problem extended well beyond two visa overstays. The Commission found that travel documents and travel patterns might have provided authorities an opportunity to intercept between four and fifteen of the nineteen hijackers. The information existed across intelligence, immigration, and travel systems. Too often, it was not connected or acted upon in time.

The Commission’s recommendation was direct: the Department of Homeland Security, with congressional support, should complete a biometric entry-exit screening system as quickly as possible. The objective was not merely to know who entered the country, but to connect a person’s identity to travel records and confirm when that person departed.

Much of the envisioned system has since been constructed. Biometric screening is now complete for air entry, sea entry, and pedestrian land entry, according to the House report. U.S. Customs and Border Protection reports that facial biometrics are employed for entry at all international airports and for international departures at fifty-seven airports.

Yet the complete system envisioned by the 9/11 Commission, one that would close the gaps that existed on September 10, 2001, remains unfinished twenty-five years later. The question Americans must ask is straightforward: If not now, when?

The families who lost loved ones on September 11 were promised that the lessons learned from that day would prevent future tragedies. This bipartisan review suggests that promise has not been fully kept.

Related: Buy Now Pay Later Loans Shift From Luxury Items to Basic Necessities