It's actually good security practice. If the terrorist's find out they got flagged because of X, now they know not to do X any more.
This is the comedy of the whole security theater system. In the old days generals always prepared to refight the last war, in the fatherland security era its about the same concept. The next attack will not come from a properly documented airline passenger, it'll come from "rio grande swimmer number 50 million and one".
May as well just let them fly even if we know they're bad guys, if they're going to get here anyway, one way or another, at least we'll make a profit off the ticket and its easier to track their actions at an airport than some desert out west.
Even worse, they're better off letting all the bad guys thru to boost budgets, and stop only good guys because its safer/less confrontational and makes good theater. If I know that, they probably figured it out a long time earlier, and almost surely implemented it.
Its also a bad tactical move. Lets say he was in fact a bad guy. The obvious standing order for a bad guy would be if you get caught, yet are not drone attacked or sent to the concentration camp in cuba, then being busted should be the immediate signal to enter our completely porous and open borders via non-traditional routes, and "do your thing" since you're obviously of no further use undercover. The mere fact this dude did nothing for over a year using this logic proves his innocence. If he was a bad guy then he would have "sneaked" in, gotten on campus as quickly as possible while his intel is still current, and (done something tragic)
This whole narrative that there is a prevalent terrorist threat against our western countries is both a product of irrational fear and general government megalomania. I'm not even sure there's malevolence behind it.
Osama Bin Laden really won the very first time the terms "War on terror" were pronounced - I don't think he could ever have dreamed of such a wide and lasting success
It's not really that great security practice if you're missing a ton of real terrorists who don't do X, and you're catching a lot of non-terrorists who do do X, and no one can figure out what's going on since no one knows what X is. That's not protecting our methods; at that point, it's really just picking people out randomly.
You have a test that flags terrorists 99% of the time, and also flags innocent people 1% of the time. The test flags a person. What are the odds that this person is a terrorist?
Answer: roughly one in a million, depending exactly on the terrorist:non-terrorist ratio in your sample population. Since there are millions of normal people for each terrorist, a small false positive rate still grabs so many people as to make the test nearly useless.
And of course it goes well beyond this. Since actual terrorists are so rare, you can never confidently state that a test will flag terrorists 99% of the time. You can easily measure the false positive rate, but it's basically impossible to measure the true positive rate with any accuracy. You can guess and extrapolate, but when it comes to actually measuring performance in the real world, you'll have a very difficult time distinguishing between a test that flags 99% of terrorists, and a test that flags 1% of terrorists.
It's either a false positive (that's most likely, considering how few terrorists there actually are), or a subtle hint to discourage his associates from ... doing things.
What terrorists? Good security practice is making a system that is usable, because otherwise the best practice would be to seal the boarder completely.
edit: this is obviously false, since by taking the monopole of violence, the government also has to drop some barbaric practices. And this is all due process and defense rights are about, limitations of the government power. Call it unfair, but drones are unfair too.