How did the U.S. security system miss this terrorist?

Story highlights

  • 49 were killed and more than 50 wounded in an attack at the Pulse nightclub in Orlando
  • Matt Mayer: National security system must be reformed before the next Orlando

Matt A. Mayer is a visiting fellow with the American Enterprise Institute and former senior official with the U.S. Department of Homeland Security. You can follow him @ohiomatt. The views expressed are his own.

(CNN)As we continue to gather information about the Orlando terrorist attack, which left 49 people dead and more than 50 wounded, it is already clear we should be asking two vital, related questions: How many innocent people will die before America reforms its domestic national security apparatus? And how many attacks must we endure before the cliches end and specific actions begin?

The Orlando shooting is exactly the kind of attack we've been expecting since those of September 11, 2001. After the attacks in Paris; San Bernardino, California; and Brussels; the threat of attacks directed, enabled or inspired by groups like ISIS reached all-time highs. Yet our domestic national security apparatus remains the same.
    The reality is that when it comes to the lives of innocent Americans, talk is cheap and deadly. Congress, President Barack Obama and our law enforcement community need to act. Now.
    First, based on reports out within the first 24 hours, it appears the Federal Bureau of Investigation (FBI) erred in its actions with Orlando terrorist Omar Mateen. The FBI interviewed Mateen in 2013 after he made "inflammatory" statements to a co-worker. The comments centered on Mateen claiming he had family and friends in al Qaeda and Hezbollah, and connections to the Boston Marathon bombers. A year later, the FBI interviewed Mateen again over contact with Moner Mohammad Abu-Salha, who went to Syria and conducted a suicide bombing. Mateen and Abu-Salha attended the same mosque in Florida.
    I'm not suggesting the FBI should have arrested Mateen after the 2013 and 2014 incidents. But at a minimum, a red flag should have been raised after Mateen purchased two guns in the last two weeks. How an individual whose actions twice prompted the FBI to investigate -- including a 10-month preliminary investigation -- can purchase guns and ammunition without any alert apparently being triggered with law enforcement suggests a failure of our intelligence system.
    FBI Director Jim Comey's statement Monday indicating Mateen had been removed from the FBI watch list bears further explanation. After all, relatively few Americans -- Muslim or non-Muslim -- fall into the category of being interviewed twice by the FBI over potential terrorism-related issues, much less being monitored for an extended period.
    So, several questions must be answered by law enforcement.
    What did the FBI do to keep a tab on Mateen? Did the Central Florida Intelligence Exchange (CFIX) do anything over the last four years related to Mateen? Did the FBI communicate with local law enforcement or the CFIX about Mateen? As I noted earlier this year, our domestic intelligence system needs to be reformed by consolidating state and local information and intelligence fusion centers with the FBI's Joint Terrorism Task Forces to make sure our federal, state, and local law enforcement entities are as bolted together as possible.
    Too many of the fusion centers haven't meaningfully detected terrorists or plots, so federal resources need to be used more effectively, as there is too much redundancy across the country. If the FBI failed to share information or intelligence with Orlando law enforcement, or if the CFIX had little to no bead on Mateen, these reforms should be instituted immediately.
    Next, it would appear based on the Orlando attack that ISIS has communicated a standard operating procedure to followers. That SOP seems to recommend that attackers identify a location with few exits where people will be densely gathered and where darkness will provide some level of concealment. These factors will virtually guarantee a high level of casualties. The Orlando attack is a second version of the Bataclan theater attack. If this observation is borne out by the investigation, it unfortunately means that venues all over America need to take additional precautions going forward.
    Regardless of whether Mateen acted alone as a lone wolf or was part of a small cell (the U.S. Attorney has indicated others are being investigated), local law enforcement needs to increase its use of human intelligence (HUMINT) to conduct more robust monitoring, surveillance, and undercover activities.
    In an American Enterprise Institute report coming out later this week, I detail how this HUMINT program should be funded and operated to ensure we respect civil liberties. Our ability to detect and to stop future attacks increasingly will depend upon overcoming the limitations encryption puts on law enforcement and the nebulous nature of lone wolf or small cell operations. HUMINT is a key capability we will need, especially in cases where a potential terrorist has interfaced with law enforcement.
    Finally, if the investigation finds that Mateen had any communications with ISIS or other terrorists, it will reignite the "iPhone" debate between law enforcement and technology companies over encrypted communications. Earlier this year, I proposed a national commission on the use of technology by terrorists.
    Five months later, Congress hasn't managed to do more than release draft legislation on the issue. Congress's failure to launch a national commission to dig into the use of technology by terrorists must be corrected this week. These are tough issues that require a deep, but fast, dive so that America can put in place the "worst-best" option when it comes to terrorists' use of technology.
    It is true we cannot stop every terrorist attack. The Orlando attack, however, unlike in San Bernardino, had elements that should have given law enforcement a better opportunity to detect Mateen's actions and intercede before Sunday's mass shooting. The fact that we can't stop all of the attacks makes it all the more critical that we do stop the ones in which the potential terrorists are known by law enforcement.
    We must reform the system before the next Orlando.