Manufacturing Security
Surprise as a Product: The State of Exception and the Fiction of “Security”
In modern states, “surprise” rarely means that no one knew. More often it means that knowledge did not acquire binding force. Information did not become a decision, the decision did not become a change in practice, and the change in practice did not become auditable reality.
This is why the report that Israel’s prime minister received intelligence as early as 2018 describing a Hamas plan for a large-scale invasion should not be treated as a morality play about hindsight. It is better read as a mechanism description: how a system can “know” and still remain structururally blind. Source: https://www.timesofisrael.com/report-netanyahu-received-intel-on-hamas-plan-to-invade-southern-israel-as-early-as-2018/
The same architecture appeared in the American “surprise” after September 11. The public remembers a before and after. Institutions remember a different story: signals existed, warnings circulated, but operational conversion failed. The 9/11 Commission framed this as failures of imagination, policy, capabilities, and management. Translation: the system did not force itself to treat high-impact scenarios as binding constraints. Source: https://govinfo.library.unt.edu/911/report/911Report_Exec.htm
To understand this without conspiracy fantasies, we need to be clear about what security services are actually for. They are not a prophecy industry. Their job is risk reduction through three functions. First, detect signal. Second, translate signal into operational constraint. Third, implement constraint via readiness, doctrine, redundancy, training, and procurement. A system can succeed without predicting dates. It fails when high-impact scenarios are allowed to remain “known” without becoming binding.
Now the uncomfortable part: modern governance cultivates a mental illusion of penetrative vision. The public is encouraged to believe that power “sees” and therefore controls. But complex bureaucracies often invert that promise. The more channels, reports, and classification layers exist, the easier it becomes to disperse responsibility. The more documents circulate, the easier it becomes to confuse circulation with action. The more alerts become routine, the easier it becomes to treat alarm as background rather than a command to restructure.
That is why surprise has machinery. It is produced across decision layers. Each layer can extinguish a warning’s operational force without malice and without anyone needing to “hide” information. The outcome looks like ignorance from the outside, while being, from the inside, a normalized form of non-conversion.
Layer one: signal becomes a document. The warning is written, routed, delivered. This creates institutional comfort: it existed. But existence is not force. “We sent it” is not “we changed the system.”
Layer two: probabilistic sedation enters. Here we meet the most dangerous sentence in governance: “unlikely at this time.” It may be analytically cautious, yet operationally lethal. It shifts a warning from boundary condition to background information. After September 11, this was described as a failure of imagination. In practice, it is a failure to treat high-impact scenarios as binding even when their probability is uncertain.
Layer three: resource competition does the rest. Every warning must beat budgets, fatigue, competing missions, and daily metrics. Systems optimized for continuous performance have a built-in allergy to rare catastrophe. High-impact, low-frequency scenarios are structurally penalized because preventing them produces no visible “success,” while preparing for them costs money, attention, and political bandwidth today.
Layer four: political authorization reframes the entire picture. This is where meta-power appears: the management of perception and governability, not only the management of threats. And this is where we must name a feature of contemporary politics that many prefer not to see.
The state of exception as governing environment
In many democracies, power is sustained less by coherent programs and more by continuous mobilization. Not promise, but necessity. Not plan, but emergency. Not accountable structure, but permanent reaction. This does not require cynical intent. It only requires incentives. If legitimacy is maintained by demonstrating that the situation is always critical, then crisis becomes a resource, not merely a problem.
That produces a structural paradox. Threat must remain real, but it must not be closed by audit. Audit converts atmosphere into chain-of-decision: who received, who dismissed, who did not implement, what alternatives existed, what resources were denied, what doctrine remained unchanged. Audit turns crisis into responsibility, and responsibility into political cost. So systems drift toward a security model that is atmospheric rather than procedural. Atmosphere is governable. Procedure is auditable.
Layer five: absence of audit generates surprise. Without independent audit, the system learns through narrative rather than correction. “Surprise” becomes reusable. It justifies consolidation, resets expectations, protects incumbents, and re-legitimizes emergency governance. The public is invited to focus on slogans and unity, while the decision chain remains untraceable.
This is where modern states begin to resemble corporations at their worst. In corporate disaster playbooks, responsibility is dispersed into “process.” The public is told: it was systemic. We will review. We will implement recommendations. It sounds reasonable, but it dissolves decisions into procedures, and procedures into rhetoric. States without audit adopt the same style. Tragedy becomes an opportunity to reorganize language rather than reorganize responsibility.
The fictionalism of “security”
The most perverse mechanism appears after catastrophe. Before the event, “security” is presented as a stable capacity: we see the field, we have protocols, we are on it. After the event, security is quietly redefined so the catastrophe becomes, by definition, the kind of thing security could not have been expected to cover.
You can observe the linguistic markers. “Unprecedented.” “Nobody could have imagined.” “Not designed for this scenario.” These phrases are not merely descriptive. They are bureaucratic solvents. They dissolve accountability by shifting the definition of competence after the fact. The model is rewritten so the event is excluded as an exception, and the institution remains innocent.
This is why “security” can function as a narrative brand more than as an operational discipline. When reality strikes, the brand survives by redefining its scope. The public is told, implicitly, that the catastrophe was outside the contract.
Yes, but what about the victims and the families
Mechanism talk can sound cold, even offensive, because it risks turning human loss into an analytic object. That is not what is happening here. The point is the opposite: to refuse the cheap consolation that tragedy was metaphysical, unforeseeable, or merely “an intelligence failure.” Families are owed more than memorial language. They are owed the truth about how the machine works, because only that truth reduces repetition.
A demand for audit is not revenge. It is respect. It treats loss as something that imposes obligations on institutions, not only emotions on citizens. When we retreat into vague blame or heroic fatalism, we protect the apparatus that failed the dead. When we insist on traceability, we honor them by forcing change where it actually matters: in the conversion chain.
What we do not want to know
We do not want to know that surprise is often manufactured by design features we tolerate because they are politically convenient. We do not want to know that the state of exception is not only imposed by enemies, but also cultivated as a mode of governability. We do not want to know that large security bureaucracies can become experts at producing the appearance of penetrative vision while being structurally protected from the consequences of their own non-conversion. We do not want to know that “security” can be a fiction that survives by redefining itself around the very moment it failed.
So here is the practical test that avoids moral grandstanding. Stop asking: did someone know. Ask: where, precisely, did warnings lose operational force. Ask: what mechanism compelled stress-testing of high-impact scenarios even when labeled unlikely. Ask: whether independent audit exists that can close the chain of responsibility.
Where, precisely, did the conversion chain break in 2018–2023?
This is mechanism description, not accusation of malice.
Yochanan Schimmelpfennig
