In the three years before Tashfeen Malik and her husband killed 14 people in a shooting rampage in San Bernardino, Calif., on Dec. 2, the U.S. Department of Homeland Security (DHS) had at least three opportunities to identify her as a threat. During that time, Malik sent messages to friends discussing violent jihad and martyrdom, according to the FBI, and on multiple occasions DHS reviewed her applications for a “fiancé visa” and green card. But the department never saw the private messages and never flagged her as dangerous.
It turns out DHS wasn’t even looking, thanks in part to the civil-liberties concerns of the very man responsible for ensuring that such threats never make it to U.S. shores. As early as 2011, DHS officials were blocked from accessing even public social-media sites, let alone private messages, for fear they would waste time at work or endanger the security of government computer systems, according to a memo obtained by MSNBC. When Homeland Security Secretary Jeh Johnson was asked to end the policy for some officials who were charged with reviewing visa applications in early 2014, he declined, citing privacy concerns, according to a former senior department official interviewed by ABC News. Instead, Johnson says, the agency started a pilot project to include partial reviews of social media, adding, “We consult a variety of different law-enforcement and intelligence-community holdings.”
A lot has changed in the world of terrorism since 9/11. Fifteen years ago, social media didn’t exist and the most dangerous terrorists hatched elaborate and spectacular plots abroad. Now terrorist networks like ISIS crowdsource jihad, advertising on Twitter and Facebook and urging their followers to strike innocent civilians around the globe. The enemy lives peacefully in nearby neighborhoods and hides behind core values of family, free speech, religion, gun ownership and privacy. From the Boston Marathon bombers to the San Bernardino shooters, jihadists inspired from abroad have found that the Constitution protects not only rights but also plots–a kind of legal human shield. Conspiracies that take shape deep in our society dare us to abandon our values in pursuit of them.
For many Americans, the result is an amplified fear of both terrorists and tyrants. The country is petrified of radical jihadists but also convinced that government intrusions on personal rights are almost as dangerous. Liberals see encroachment on Fourth Amendment protections against unwarranted searches; conservatives see a constant threat to the Second Amendment’s right to bear arms. That in turn means easy access to weapons for those on the terrorist no-fly list, limited surveillance of even public speech and a rising atmosphere of fear that enables the clumsiest of bomb hoaxes to shut down the entire Los Angeles school system for a day.
All this explains why Johnson, 58, has possibly the hardest job in America. A high-powered lawyer and former fundraiser for Barack Obama, he is a cautious, sometimes political pragmatist on the front lines in the war on terror. He says he understands the new threat and the country’s fear of it and is always mindful of the need to balance security with the principles of freedom. “When you see a new phase in a global terrorist threat, when you see a new front being opened, there’s an understandable anxiety,” Johnson says, sitting in a bland conference room in the sprawling Ronald Reagan Building in downtown Washington. To answer that anxiety, he must convince Americans that the famously dysfunctional DHS can protect them without sacrificing their civil liberties. So far, it’s not going well.
Johnson has had a unique view of the changing terrorist threat. During Obama’s first term, he served as Pentagon boss Robert Gates’ top lawyer, becoming known as a hawk on the hard question of when it was legal to go after al-Qaeda suspects away from the battlefields of Afghanistan and Iraq. (His answer: often.) Once, recalls a former senior military official, commanders sought permission to go after a suspected al-Qaeda leader in a country in Africa. Johnson not only gave the legal green light for the operation but suggested two other associates whom the Special Forces should remove from the battlefield while they were at it. It was, says the officer, “very unusual for the legal counsel to be that forward-leaning.”
Over the course of his four years at the Pentagon, Johnson approved dozens of such requests, including the operation that resulted in the death of Osama bin Laden. The military’s success against al-Qaeda meant that after Obama’s re-election in 2012, the Administration could once again imagine rolling back the extraordinary powers that George W. Bush pursued in the years after 9/11, and perhaps even ending the war on terrorism. In November 2012, with al-Qaeda on the ropes, Johnson told an audience at Oxford University in England that eventually the war on terrorism would end and its special provisions would need to be curbed. When a sufficient number of al-Qaeda leaders and operatives had been killed or captured, he said, “We must be able to say to ourselves that our efforts should no longer be considered an ‘armed conflict.'”
Johnson squirms a bit when reminded of the speech today. “Clearly, those remarks in 2012 did not contemplate the environment we are in now,” he says. What happened in the interim? ISIS. After embracing the chaos of Syria to gain strength, the group swept back into its home base of Iraq in 2014. Its battlefield successes drew stepped-up military attacks from countries including the U.S., France and Russia. In turn, ISIS attacks in 2015 killed more than 1,200 civilians outside of Iraq and Syria.
ISIS’s savvy use of social media has turned the rising conflict with the West into a source of armed recruits on the battlefields of Iraq and Syria. More ominously, its steady message of a god-sanctioned, apocalyptic confrontation between Islam and the West has given rise to self-radicalized followers in countries around the world who are almost impossible to find before they turn violent, a kind of fifth column for the Internet age.
In his current job, Johnson finds himself charged with defending the U.S. against that threat: keeping ISIS-trained foreign terrorists out of the country and ISIS-inspired domestic ones off U.S. planes and trains. It’s hard. Every year the U.S. admits more than 170 million travelers, and about 40 million immigrants live in the U.S. Harder still is finding terrorists among the country’s 330 million citizens and permanent residents. A recent report by researchers at George Washington University found that 71 ISIS followers have been arrested for supporting the group since March 2014, and the vast majority of them were U.S. citizens or permanent residents. “This new phase requires a whole new approach to counterterrorism and homeland security beyond the traditional responses,” Johnson says. That means closer work with local law enforcement and communities where threats may appear long before they are visible to federal authorities.
Johnson’s immediate challenge is reforming an agency that never came to grips with the mission it was designed to accomplish in the first place: stopping another 9/11 by groups like al-Qaeda. DHS is a motley accumulation of 22 different agencies, including Customs and Border Protection, the Coast Guard and the Federal Emergency Management Agency. Among the scandals Johnson has struggled with on his watch are the prostitution and DUI scandals at the Secret Service; the Transportation Security Administration’s inability to spot bombs or weapons on passengers or in checked bags; and a morale funk that leaves DHS ranking last, again, in a recent survey seeking the best place to work among 19 big federal agencies.
So far Johnson has proposed unremarkable reforms to fix the agency and address the threat. He’s upped security at federal installations and boosted information sharing with state and local officials. Over the past year, he added new requirements to the visa-waiver program, which allows citizens of certain countries to enter the U.S. without prior screening. After the DHS inspector general found that TSA missed potential threats 96% of the time at passenger checkpoints in airports, he reassigned the head of TSA and imposed a 10-point plan aimed at fixing the problem. When ISIS claimed responsibility for downing a Russian airliner in Egypt on Oct. 31, Johnson imposed new restrictions on flights from some Middle Eastern countries.
Johnson’s hardest challenge, though, may be fighting America’s upsurge of fear. Late in the year, he unveiled a tweak to the terrorist warning system that will provide bulletins on potential threats. But there’s no good playbook for the hand-holding part of the job, and Johnson says he relies on a combination of personal and professional history to guide him.
Born in New York City in 1957 to a respected academic family, Johnson grew up in an affluent environment and attended top schools, graduating from Columbia Law School and joining a leading firm, Paul, Weiss. He married his childhood neighbor and has two college-age kids, one of whom is serving under him in the Coast Guard. Johnson’s first exposure to homeland-security issues came when he was an assistant prosecutor in the U.S. attorney’s office in Manhattan, where he tried high-profile cases, including one against a corrupt immigration official. After returning to his law firm in the early 1990s and rising to make $2.6 million a year as its first African-American partner he served in the Clinton Administration and later became a big fundraiser for Obama in 2008. He is sometimes mentioned as a possible candidate for statewide office, though he denies the ambition.
The polished and confident persona Johnson developed over his career serves him well when it comes to reassuring the public. Soon after the Paris attacks, he took to Amtrak on one of the busiest days of the year, walking the aisles and greeting passengers. He’s turned relations with Congress around after years of strained interactions with overseers. Delaware’s Tom Carper, the ranking Democrat on the Senate Homeland Security Committee, praises Johnson for his “cool confidence.”
Public shows of steadiness go only so far when the department he leads is as screwed up as DHS. Colleagues in the Obama Administration point out that for all his talk of counterterrorism, Johnson is responsible for spotting bad guys, not busting them–that’s the FBI’s job–and say he should focus on DHS’s problems, not public appearances. “He’s got this facade where he’s a knight in shining armor who’s going to save the country, and behind him there’s this organization that’s crumbling,” says one national-security official.
But in a war that is partly about just how many values Americans are willing to sacrifice in pursuit of the enemy, appearances matter. That’s especially true when fear is outstripping the actual threat. The risk Americans face from terrorism is extremely low: they are vastly more likely to freeze to death or die falling down stairs, for example, than to become a victim of a terrorist attack. Johnson thinks a calm public persona can help put the danger in perspective. “When you explain to people what you’re doing,” he says, “they will understand that in a free and democratic society, you cannot erase all risks.”
The evolving nature of the threat is likely to push the feds into taking more-invasive steps. Both the Boston Marathon bombing and the San Bernardino attacks involved family members (brothers in Boston, a husband and wife in California). These are “networks” that are hard to crack. In the face of the threat that has so quickly found sanctuary in the most protected corners of U.S. society, Johnson is still adjusting. Asked about the need to search social media in the wake of the San Bernardino attacks, Johnson says he’s looking at more aggressively scrubbing Facebook posts and Twitter feeds. The question is whether such deliberate caution will reassure Americans or worry them even more.
This appears in the December 28, 2015 issue of TIME.