I phrased my point a little clumsily. What I was trying to say (and what I think we agree Schneier is saying) is that if you know about a type of attack and th

I phrased my point a little clumsily. What I was trying to say (and what I think we agree Schneier is saying) is that if you know about a type of attack and think that it's a type worth defending against, you shouldn't wait for it to actually happen before you take action. Abdul Mutallab could have used his butt (or other things, like a prosthesis or a wheelchair) to stash the parts necessary to assemble a relatively reliable bomb. That's a known attack type, but we're not defending against it at the security checkpoints. Now that could be a wise decision based on the fact that checking for it is hard and, as you said, "effective security comes way before the departure gate". But if some future terrorist carries out this quite-plausible attack and the government then decides that the TSA should start screening for it, it'll mean they learned nothing from the underwear bomber.