Zero Fail

By Carol Leonnig

10 min read

Why does it matter? Because the institution standing between the president and a bullet has been running on luck for sixty years — and luck is not a security plan.

The Secret Service is supposed to be the standard. The benchmark every other protection agency measures itself against. More than 3,200 agents, a $3 billion annual budget, a training program that washes out most who apply.

Then a Delta Force sergeant major — a man who helped raid Mullah Omar's compound two weeks after 9/11 — sits across from one of those agents after a week of joint training and says, flatly: "I feel sorry for you guys. You'll never be able to stop a real attack."

The agent's stomach drops. Not because the assessment shocks him. Because he already knows it's true.

That's the gap between the institution Americans believe they have and the one its own agents describe. Sixty years of presidents kept alive not by excellence, but by luck. And the luck is running out.

The Secret Service Has Kept Every President Alive Through Luck, Not Skill

Brad Gable had spent his career running toward gunfire. As a member of the Secret Service's Counter Assault Team, the unit tasked not with evacuating the president but with neutralizing anyone who attacked him, he had drilled for years against exactly these scenarios. So when he sat down near Fort Bragg in the late summer of 2012 with a Delta Force sergeant major he'd come to respect, he felt ready for an honest answer. The operator was a veteran of the 2001 raid on Mullah Omar's compound, and he didn't crow about it. Gable asked him to rate the Service's overall readiness.

The sergeant major tried to dodge the question. Gable pressed.

"I feel sorry for you guys," the Delta operator said. "The Service has really let you down. You'll never be able to stop a real attack."

What made Gable's stomach drop wasn't surprise. It was recognition. He already knew about the outdated equipment, the spotty training. He'd been in Mumbai in 2010 when his unit nearly killed a local police officer they'd misidentified as a gunman — close enough to one version of institutional failure that the sergeant major's verdict felt less like news than confirmation. The Secret Service was surviving not on excellence but because no one capable had yet decided to test it. The institution was running on luck.

The gap between the Secret Service's public image as a precise, elite force and what its own agents describe has been widening since Kennedy. Zero Fail is built on years of testimony from agents who broke the Service's code of silence because the danger, they believed, had grown too real to ignore.

That gap has persisted and widened. The Service's budget has grown from five million dollars to over two billion. Its staff from three hundred agents to seven thousand. Public trust has remained nearly total. But the agents who know it best have been quietly concluding what Gable felt in that Fort Bragg restaurant: every president since Kennedy has survived not because the Secret Service stopped a real attack, but because no one sufficiently capable and determined has yet mounted one. That's the streak the public has taken for granted.

The Service Only Learns the Lesson That Just Got Someone Killed — and Forgets It Before the Next Threat Arrives

The Secret Service does learn from its crises. After Kennedy was killed in an open-top limousine, it stopped using open-top limousines. After George Wallace was shot at a campaign rope line, it developed rope-line protocols. After Hinckley put a bullet in Reagan outside the Hilton, it required metal detectors at every event. Rick Ahearn, who ran Reagan's advance operation, offered it as praise: the Service changed policy after every shooting incident. Agent Jonathan Wackrow gave it a name: "The Secret Service methodology is born of blood."

"Born of blood" is not the same as self-correcting. It describes an institution that fixes the specific wound that just killed someone — and nothing else. Magnetometers stop handguns at the door. They don't stop a man who jumps the fence. The reform cycle that looks like adaptation, seen from the next crisis, looks like blindness.

The gaps magnetometers couldn't address were documented. A uniformed officer spent eight months cataloging them: posts left unmanned during staff shortages, interior emergency alarms disabled because false alerts disrupted White House events, perimeter officers armed only with handguns and assigned to posts where radios cut out under normal use. He sent the findings up the chain and was removed before any of them were fixed.

A fence jumper penetrated the White House in 2014. Three years later, a man spent seventeen undetected minutes on the grounds while the president slept upstairs.

The institution fixes what just killed someone. It calls that progress. The next attacker exploits something adjacent, and the cycle continues.

Every President Since Kennedy Has Deliberately Made Himself Harder to Protect

The operational failures aren't new. And neither is the reason they persist.

What if the most dangerous person in any presidential motorcade is the president himself?

Three days before John Kennedy was killed in Dallas, he made a decision that shows how every commander in chief has resolved the central tension of presidential protection — the tension between looking powerful and staying alive.

The date was November 18, 1963. Kennedy's motorcade was rolling through Tampa on the longest open-air presidential ride in Secret Service history: 28 miles, with 125,000 spectators expected. Two agents were riding on the rear running boards of the president's limousine, gripping trunk handles, positioned to throw themselves between Kennedy and any attacker who got close. This was standard practice. It was also, Kennedy decided, the wrong image.

He leaned forward to his trip supervisor and said it plainly: "It's excessive, Floyd. And it's giving the wrong impression to the people. Tell them to stay on the follow-up car. We've got an election coming up. The whole point is for me to be accessible to the people."

This is the structural contradiction, stated out loud by the man it most endangered. A president's political survival requires looking like he doesn't need protecting. A protective agent's mission requires the opposite. Kennedy named the conflict directly. He resolved it in favor of the campaign.

That order traveled with the motorcade to Dallas. On November 22nd, agent Jack Ready obeyed it: he did not ride the rear steps behind the president. Clint Hill was back on the follow-up car when the first shot cracked. He sprinted to the limousine in seconds — fast enough, he would calculate for the rest of his life, that he might have taken the third bullet himself if he had started from the limo's rear bumper rather than the car behind it. He spent decades unable to set down that particular arithmetic.

The point isn't that Kennedy got himself killed. Every president since has made the same calculation, in larger or smaller ways, because the calculation is structural. Appearing unafraid of your own citizens is part of governing. Appearing to need a human shield is not. The Secret Service does not get to resolve this tension — the president does. And every president, when the moment arrives, has decided that political optics matter more than the protocol designed to keep him breathing.

The agents learn to work around it. Then someone tests the gap.

The People Who Try to Fix the Institution from the Inside Are the Ones Who Get Destroyed

In January 2006, Officer Charles Baserap walked into room 60 of the Old Executive Office Building believing he was about to impress his superiors. He had reason to think so. Two senior leaders sought him out privately after his reports, framing the conversations as neutral ground — small fixes materialized at his posts within days.

Then Clancy's meeting filled with a different atmosphere. The Uniformed Division chief sat frowning across the desk. Clancy told Baserap his written assessment was "completely inaccurate," that he lacked the big picture, and that he was "very close to crossing the line of the disclosure clause" — grounds for dismissal. Three times, Clancy asked whether Baserap had shared his draft outside the Service. The meeting ended: "You may return to your post."

What Baserap had documented, and what nine out of ten officers would later confirm in a systematic survey, was concrete: posts left unmanned during staffing shortages, junior officers sent to the most isolated entry points, no long guns to match a rifle attack, radios that cut out under normal use. He put it in writing, which was apparently the offense. His response to Clancy's meeting was to distribute his memo at midnight — one copy placed in every supervisor's mailbox up the chain of command. Officers across the complex made dozens of additional copies and passed them post to post. They named it the Uniformed Division Officer's Manifesto.

The Service's retaliation was patient. Baserap was fired one day before reaching career-status job protection, on a technicality involving sick leave after oral surgery. When he landed a defense contractor position, the Service told his prospective employer he had been dismissed for misconduct. That was false. It took eighteen months of litigation to correct his file.

Both leaders who suppressed him — Clancy and Pierson — later became directors of the Secret Service. The failures Baserap documented and was warned to stop discussing materialized in public exactly as he predicted: a fence jumper, a vehicle incursion, a man who walked through the unlocked front door. A former colleague said it plainly: "After all, Baserap predicted it."

A senior supervisor on the Obama detail named Rafael Prieto was discovered to have been lying on his security clearance forms for years. The investigation turned up twenty undisclosed foreign trips, contacts that had alarmed the CIA, and knowledge of classified presidential safe house locations. On a Friday night, Prieto bought duct tape and hoses from Home Depot and ran his Toyota's engine in his Mount Pleasant garage. The investigator who had run his polygraphs briefed Director Sullivan on what he'd found. Sullivan's response: "Did you really think he was a security risk?"

Auditors found that a deputy assistant director named George Luczko had been downloading and forwarding pornographic material on government systems. Sullivan was briefed confidentially. Months later, he promoted Luczko to head the Office of Professional Responsibility — the internal unit that investigates employee misconduct. Luczko had secured the promotion by pledging complete personal loyalty to the director.

Twenty-Nine Seconds to Walk Through the Front Door of the White House — and Everything Had Already Failed

At 7:16 p.m. on September 19, 2014, Marine One lifted off the South Lawn. With the president gone, the Counter Assault Team began stripping off their tactical gear. Some pulled out their earpieces. There was no need to monitor the radio now.

Three minutes later, Omar Gonzalez hopped the north fence, through a section where the pointed iron finials that deter climbers had gone missing.

He was a 42-year-old disabled Army veteran living out of a Ford Bronco, with 800 rounds in the trunk. Officers had spotted him walking the perimeter with a hatchet a month earlier and let him go. Now he was inside the fence, limping toward the mansion, and nearly every defense the Secret Service had built began failing in sequence.

The Joint Operations Center tried to broadcast a jumper alert, but one officer's keyed radio blocked the transmission entirely. The Emergency Response Team received no alarm because someone had removed the booth speakers over the summer; officers had been joking about colleagues "liberating" audio equipment. The Belgian Malinois, trained to intercept fence jumpers within six seconds, was still in its crate; its handler was on a personal call. The officer posted at the front door had left to recommend New York restaurants to a colleague. The crash-box alarms inside the mansion had been silenced over a year earlier at the White House usher's request, because they disrupted events.

Officer Phylicia Brice, unwarned, saw Gonzalez through the window and tried to latch the doors. Too late. He pushed them open, knocked her down, and kept walking. Twenty-nine seconds after clearing the fence, a man carrying a folding knife had penetrated the White House. He reached the Green Room before an officer tackled him.

The Gonzalez breach would have been damning as a single incident. Then three years later, Jonathan Tran spent 17 undetected minutes on White House grounds while the president slept upstairs. The sensor at the fence line was disabled — construction crews nearby kept triggering false alarms. A camera malfunctioned. A motion-activated light was broken. The officer who finally spotted Tran tried to radio for backup: his radio didn't transmit. Secretary Kelly asked Acting Director Callahan how every system could have failed at once. Callahan said they had run out of money for repairs. Same devices. Same gap. Three years after Gonzalez walked through the front door.

Everything Baserap documented in 2005 — the unfixed radios, the vacant posts, the dog in its crate — appeared again in 2014, and again in 2017. The institution had not failed to learn its lessons. It had learned precisely the lesson it always learns: fix what generated the bad headline, leave everything adjacent in place, and trust the streak to hold. And the structural problems kept compounding beneath a public reputation that remained, through all of it, untouched.

What 'Born of Blood' Actually Means When the Blood Teaches Nothing

Brad Gable didn't need the Delta operator to tell him. He already knew. That's the part worth sitting with — not the verdict delivered across a Fort Bragg table, but that the man asking the question had already arrived at the answer. The Secret Service spends decades producing people exactly like Gable: trained, honest, capable of seeing clearly. And then it spends decades ensuring those people cannot speak. The sensors that failed in 2014 were still broken in 2017. The officer who documented both gaps in writing was fired before either breach happened. What you are left with is not a question about the next attack. It is a question about whether the institution will be able to hear the agent who already knows where it's coming from.