...and what are they up to?
Why hasn't Al Qaeda attempted an large CBRN attack, given the group's M.O of "spectacular" mass casualty attacks against symbolic targets? I have my ideas, but they are speculative.
Could be any one of a number of factors:
1) They can't get one into a strategic location. Since 9/11, security around high-value American targets has increased many-fold. Metal detectors are almost ubiquitous in Washington DC these days. I've never felt safer riding the Metro. Even airliners transiting US airspace are subject to American-style security procedures. I remember having to stop at two checkpoints in Frankfurt airport for my return trip to the States... one for the German officials, and another for the Americans. On that overseas trip, I was surprised how lax the foreign airport security was compared to what I had seen since Sept 2001.
2) They can't get one, period. They may have been unable to procure the equipment to manufacture a CBRN weapon due to increased scrutiny from homeland security officials. Even large fertilizer purchases bring a visit from the FBI.
3) Al-Qaeda did not have a follow-up to 9/11, and they're still in the planning stages for their next big move within the US. It could simply be that they were planning this all along, to stir up a hornet's nest within the US and sit back, watching the nation eat itself up with fear and recrimination. Then, with impunity, they strike again while we are worrying about civil liberties and racial profiling.