“If national safety - the ability to respond to hurricanes, terrorist attacks, earthquakes - depends on the execution of explicit plans, on soldierly obedience, and on showy security drills, then a decentralized security scheme is useless.”