So what to do? One possibility would be to appoint as director a hard-nosed, thick-skinned manager with a clear mandate for change -- someone of Donald Rumsfeld's caliber. (His judgment on Iraq has been questioned, but no one questions his capacity to reform a hidebound government bureaucracy.) Another would be to acknowledge the F.B.I.'s deep-rooted incapacity to deal effectively with terrorism, and create a separate domestic intelligence agency on the model of Britain's Security Service (M.I.5). The Security Service has no power of arrest. That power is lodged in the Special Branch of Scotland Yard, and if we had our own domestic intelligence service, modeled on M.I.5, the power of arrest would be lodged in a branch of the F.B.I. As far as I know, M.I.5 and M.I.6 (Britain's counterpart to the C.I.A.) work well together. They have a common culture, as the C.I.A. and the F.B.I. do not. They are intelligence agencies, operating by surveillance rather than by prosecution. Critics who say that an American equivalent of M.I.5 would be a Gestapo understand neither M.I.5 nor the Gestapo.

Which brings me to another failing of the 9/11 commission: American provinciality. Just as we are handicapped in dealing with Islamist terrorism by our ignorance of the languages, cultures and history of the Muslim world, so we are handicapped in devising effective antiterrorist methods by our reluctance to consider foreign models. We shouldn't be embarrassed to borrow good ideas from nations with a longer experience of terrorism than our own. The blows we have struck against Al Qaeda's centralized organization may deflect Islamist terrorists from spectacular attacks like 9/11 to retail forms like car and truck bombings, assassinations and sabotage. If so, Islamist terrorism may come to resemble the kinds of terrorism practiced by the Irish Republican Army and Hamas, with which foreign nations like Britain and Israel have extensive experience. The United States remains readily penetrable by Islamist terrorists who don't even look or sound Middle Eastern, and there are Qaeda sleeper cells in this country. All this underscores the need for a domestic intelligence agency that, unlike the F.B.I., is effective.

Were all the steps that I have listed fully implemented, the probability of another terrorist attack on the scale of 9/11 would be reduced -- slightly. The measures adopted already, combined with our operation in Afghanistan, have undoubtedly reduced that probability, and the room for further reduction probably is small. We and other nations have been victims of surprise attacks before; we will be again.

They follow a pattern. Think of Pearl Harbor in 1941 and the Tet offensive in Vietnam in 1968. It was known that the Japanese might attack us. But that they would send their carrier fleet thousands of miles to Hawaii, rather than just attack the nearby Philippines or the British and Dutch possessions in Southeast Asia, was too novel and audacious a prospect to be taken seriously. In 1968 the Vietnamese Communists were known to be capable of attacking South Vietnam's cities. Indeed, such an assault was anticipated, though not during Tet (the Communists had previously observed a truce during the Tet festivities) and not on the scale it attained. In both cases the strength and determination of the enemy were underestimated, along with the direction of his main effort. In 2001 an attack by Al Qaeda was anticipated, but it was anticipated to occur overseas, and the capability and audacity of the enemy were underestimated. (Note in all three cases a tendency to underestimate non-Western foes -- another aspect of provinciality.)

Anyone who thinks this pattern can be changed should read those 90 pages of analysis and recommendations that conclude the commission's report; they come to very little. Even the prose sags, as the reader is treated to a barrage of bromides: ''the American people are entitled to expect their government to do its very best,'' or ''we should reach out, listen to and work with other countries that can help'' and ''be generous and caring to our neighbors,'' or we should supply the Middle East with ''programs to bridge the digital divide and increase Internet access'' -- the last an ironic suggestion, given that encrypted e-mail is an effective medium of clandestine communication. The ''hearts and minds'' campaign urged by the commission is no more likely to succeed in the vast Muslim world today than its prototype was in South Vietnam in the 1960's.

The commission wants criteria to be developed for picking out which American cities are at greatest risk of terrorist attack, and defensive resources allocated accordingly -- this to prevent every city from claiming a proportional share of those resources when it is apparent that New York and Washington are most at risk. Not only do we lack the information needed to establish such criteria, but to make Washington and New York impregnable so that terrorists can blow up Los Angeles or, for that matter, Kalamazoo with impunity wouldn't do us any good.

The report states that the focus of our antiterrorist strategy should not be ''just 'terrorism,' some generic evil. This vagueness blurs the strategy. The catastrophic threat at this moment in history is more specific. It is the threat posed by Islamist terrorism.'' Is it? Who knows? The menace of bin Laden was not widely recognized until just a few years before the 9/11 attacks. For all anyone knows, a terrorist threat unrelated to Islam is brewing somewhere (maybe right here at home -- remember the Oklahoma City bombers and the Unabomber and the anthrax attack of October 2001) that, given the breathtakingly rapid advances in the technology of destruction, will a few years hence pose a greater danger than Islamic extremism. But if we listen to the 9/11 commission, we won't be looking out for it because we've been told that Islamist terrorism is the thing to concentrate on.