The other component of the alarming intelligence was traditional "analysis" keyed around the Christmas and New Year's holidays: U.S. intelligence analysts have for years looked to important dates-such as religious holidays (both Christian and Islamic) and anniversaries of historic events-as moments when terrorists might strike.

But the emerging view of some intelligence analysts is that both of these two central premises may have been wrong. The alarmingly specific intelligence that spooked counterterrorism officials on the eve of Ridge's Dec. 21 announcement now appears to have been garbled at best: not only has nothing developed suggesting that there was a plan to hijack any particular airline over the holidays, some intelligence-community officials fear that some of the specific data may have actually been "disinformation" designed to throw U.S. officials off or "test" the nation's defenses.

Equally problematic is the holiday and anniversary fixation of Homeland Security officials. One U.S. intelligence-community official notes that a history of Al Qaeda's major attacks-the Aug. 7, 1998, bombings of two U.S. embassies in Africa; the Oct. 12, 2000, bombing of the USS Cole, and the September 11 attacks-show no correlation to any holiday or historical anniversary." The fact is Al Qaeda strikes at a time of their own choosing," says the official.

Cox emphasized to NEWSWEEK that the color-coded alert system is sending confusing messages to the public-citing contradictions in Ridge's Dec. 21 press conference announcing the Orange alert. On the one hand, Ridge said that strategic indicators of an upcoming Al Qaeda attack "are perhaps greater now that at any point since September 11." On the other hand, the Homeland Security secretary said members of the public should "continue with your holiday plans" as though nothing were different.

Cox said that, at a minimum, Homeland Security should scrap the one-size-fits-all color-coded approach and adopt a more nuanced system in which there are individualized warnings for particular geographic regions or economic sectors about which there might actually be hard intelligence. Beyond that, he said, Homeland Security officials should move toward a revamped system in which specific security protocols are spelled out for state and local law-enforcement officials-and alerts to the public are provided only when there was a particular reason for it.

Will Homeland Security take Cox's less-than-subtle hint? In recent interviews, officials acknowledged the current alert system is less than perfect and said they are already considering a more tailored system anyway. But they also defended the overall approach and provided NEWSWEEK with new details about the far-ranging-and costly-security measures that were taken during the higher alert.