A plan to defend ships and ports from attack is six months overdue. Rules to protect air cargo from infiltration by terrorists are two months late. A study on the cost of giving anti-terrorism training to federal law enforcement officers who fly commercially was supposed to be done more than three years ago.
"The incompetence that we recently saw with FEMA's leadership appears to exist throughout the Homeland Security Department," said Mississippi Rep. Bennie G. Thompson, top Democrat on the House Homeland Security Committee. "Our nation is still vulnerable."
Congress must share the blame for the department's sluggishness in protecting commerce and travel from terrorists, according to other observers.
Lawmakers piled on deadline after deadline for reports, plans and regulations while the department, created after the 2001 attacks, had to integrate 22 agencies with 170,000 workers and cope with terrorist threats and hurricanes.
Those deadlines, sometimes for minor projects, distract the department from putting in place the most important security measures, experts say. The Transportation Security Administration, for example, scrambled to try to meet a Feb. 15 deadline to ban butane lighters from airplanes, a precaution that does little to protect airliners, they said.
"You have no ability to prioritize against something like that, and it's going to take up all your time," said Dan Prieto, homeland security expert with Harvard's Kennedy School of Government. "The urgent becomes the enemy of the important."
Thompson said the government has yet to develop a comprehensive plan to protect roads, bridges, tunnels, power plants, pipelines and dams. He said a broad plan to protect levies and dams might have helped prevent the New Orleans levies from being breached.
Homeland Security spokesman Russ Knocke said the department goes to great lengths to work with Congress. But, he said, "there is an extraordinarily high number of reporting requirements."
The department has to submit 256 reports to Congress every year, while the TSA alone has 62 reporting requirements.
"There's a lack of adult leadership on both sides," said James Carafano, a senior fellow at the conservative Heritage Foundation. "The department just doesn't have its act together," he said. "Some of these deadlines are unrealistic."
The first response to the Sept. 11 hijackings was to prevent terrorists from taking over airliners with weapons and crashing them into buildings.
So Congress set more deadlines for more security measures.
Some were met. Many were not.
A law signed by President Bush on Nov. 25, 2002, set a July 1, 2004, deadline for ships and ports to tighten security amid fears that terrorists might smuggle nuclear weapons in a cargo container.
The Coast Guard largely accomplished the undertaking. But much still remains undone: A report on how a grant program for shippers and ports would work is more than a year late; a report on cargo container security is eight months overdue; a national security plan for marine transportation is well past its April 1 due date.
Rep. Harold Rogers, chairman of the House subcommittee that oversees Homeland Security spending, was unhappy because the TSA missed a March 17 deadline for a plan to deploy bomb-detection machines at airports.
Rogers, R-Ky., put a provision in the Homeland Security spending bill, signed into law Oct. 18, that withholds $5 million from the department until it submits such a plan.
Some security deadlines have been met, especially those set soon after the Sept. 11 attacks.
Within nine weeks of the hijackings, lawmakers ordered a federal work force to take over airport security, many more air marshals and the creation of the TSA.
Congress set 33 deadlines; a press release went out each time one was met.
One of the biggest deadlines was met with great fanfare when the TSA announced on Nov. 19, 2002, that it had replaced private airport screeners with a government work force.
The next year, then-TSA chief James Loy told Congress they had met "100 percent of the aviation screening mandates."
The TSA does not make those kinds of announcements any more.