Department of Homeland Security
 

��������������������������
 

DHS’ Watchlisting Cell’s Efforts To Coordinate 


Departmental Nominations 


(Redacted) 


OIG-13-105 July 2013
 
 

              

     

         

     

     

         

   

                       

                

                             

                           

  

                 

                     

                           

                       

                         

                           

                         

                      

                           

                      

         

                         

                   

                        

               

                             

                       

         

   

 OFFICE OF INSPECTOR GENERAL 

 Department of Homeland Security 

MEMORANDUM FOR:

FROM:

 Washington, DC 20528 / www.oig.dhs.gov

The Honorable William E. Tarry Jr.

Acting Under Secretary

Office of Intelligence and Analysis

Charles K. Edwards

Deputy Inspector General

SUBJECT:	 DHS’ Watchlisting Cell’s Efforts To Coordinate

Departmental Nominations

Attached for your information is our final report, DHS’ Watchlisting Cell’s Efforts To

Coordinate Departmental Nominations – Sensitive Security Information. We have also

included a redacted version of the report, which will be published on our website. We

incorporated the formal comments from the Office of Intelligence and Analysis (I&A) in the

final report.

The report contains ten recommendations aimed at improving the Department’s

Watchlisting Cell. I&A concurred with all ten recommendations. Based on information

provided in I&A’s response, we consider all ten recommendations to be open and resolved.

As prescribed by the Department of Homeland Security Directive 077‐01, Follow‐Up and

Resolutions for the Office of Inspector General Report Recommendations, within 90 days of

the date of this memorandum, please provide our office with a written response that

includes your (1) agreement or disagreement, (2) corrective action plan, and (3) target

completion date for each recommendation. Also, please include responsible parties and

any other supporting documentation necessary to inform us about the current status of the

recommendation. Until your response is received and evaluated, the recommendations will

be considered resolved and open.

Consistent with our responsibility under the Inspector General Act, we are providing copies

of our report to appropriate congressional committees with oversight and appropriation

responsibility over the Department of Homeland Security. We will post the redacted

version of the report on our public website.

Please call me with any questions, or your staff may contact Deborah L. Outten‐Mills, Acting

Assistant Inspector General for Inspections, at (202) 254‐4015, or Marcia Moxey Hodges,

Chief Inspector, at (202) 254‐4202.

Attachment
 

Executive Summary............................................................................................................. 1 


Background ......................................................................................................................... 2 


Results of Review................................................................................................................ 8 


DHS Has Centralized Its Watchlisting Process Within the WLC, But Some 


Components Continue To Nominate Through External Partners........................... 8 


Additional Performance Metrics and Streamlined Operations Are Needed
 

To Measure and Improve Timeliness, Effectiveness, and Efficiency.................... 11 


Recommendations................................................................................................ 15 


Management Comments and OIG Analysis.......................................................... 15 


WLC’s Quality Assurance Process Ensures Complete and Accurate Products, But 


It Is Duplicative and Hinders Timeliness............................................................... 16 


Recommendations................................................................................................ 18 


Management Comments and OIG Analysis.......................................................... 18 


WLC Coordinated Nomination Policies and Procedures With DHS Components, 


But Communication Could Be Improved .............................................................. 20 


WLC Did Not Coordinate or Communicate Its Decentralization Plan With DHS 


Operational Components Effectively.................................................................... 21 


Recommendation .................................................................................................. 26 


Management Comments and OIG Analysis ......................................................... 26 


Procedures For Training, Quality Assurance, and Oversight Programs
 

Are Needed ........................................................................................................... 27 


Recommendations................................................................................................ 28 


Management Comments and OIG Analysis.......................................................... 29 


WLC Needs Sustainability and Resource Allocation Plans.................................... 30
 

Recommendations................................................................................................ 32 


Management Comments and OIG Analysis.......................................................... 32 


Conclusion ............................................................................................................. 33 


 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Table of Contents 

www.oig.dhs.gov OIG-13-105 
 

 

 

 

 

 

 

 

 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Appendixes
 

Appendix A: Objectives, Scope, and Methodology ............................................ 34 


Appendix B: Recommendations......................................................................... 36 


Appendix C: Management Comments to the Draft Report ............................... 38 


Appendix D: Roles of Components Involved In Watchlisting............................. 45 


Appendix E: Watchlisting Legal Authorities ....................................................... 47 


Appendix F: DHS Data Systems Used by Watchlist Analysts.............................. 50 


Appendix G: Timeliness Standards...................................................................... 51 


Appendix H: Major Contributors to This Report................................................. 52 


Appendix I: Report Distribution ........................................................................ 53 


Abbreviations 

ACS Automated Case Support System 

CBP U.S. Customs and Border Protection 

CRCL Civil Rights and Civil Liberties 

DHS Department of Homeland Security 

E.O. Executive Order 

FBI Federal Bureau of Investigation 

FY fiscal year 

HSIC Homeland Security Intelligence Council 

HSPD Homeland Security Presidential Directive 

I&A Office of Intelligence and Analysis 

ICE U.S. Immigration and Customs Enforcement 

IDENT Automated Biometric Identification System 

KST known or suspected terrorist 

NCTC National Counterterrorism Center 

NTC-P National Targeting Center – Passenger 

ODNI Office of the Director of National Intelligence 

OIG Office of Inspector General 

OPS Office of Operations Coordination and Planning 

SCO Screening Coordination Office 

TIDE Terrorist Identities Datamart Environment 

TSA Transportation Security Administration 

TSC Terrorist Screening Center 

TSDB Terrorist Screening Database 

USCIS U.S. Citizenship and Immigration Services 

US-VISIT U.S. Visitor and Immigrant Status Indicator Technology 

WLC Watchlisting Cell 

www.oig.dhs.gov OIG-13-105 
 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Executive Summary 

The Department of Homeland Security (DHS) interacts with, observes, and gathers 

information from individuals during law enforcement, transportation security, and 

immigration and border security screening operations. The Department contributes 

some of this information to the Federal Government’s watchlisting efforts, which are 

used to inform government interaction with U.S. citizens and foreign nationals. In 

October 2010, DHS established a Watchlisting Cell in the DHS Office of Intelligence and 

Analysis to serve as the coordination point for departmental watchlist nominations. In 

April 2012, in response to its growing caseload and limited resources, the Watchlisting 

Cell proposed to decentralize its watchlist nomination process by providing watchlist 

analyst training and certification to analysts in DHS operational components, and then 

delegating to the certified watchlist analysts the authority to submit terrorist 

nominations. 

We reviewed the Watchlisting Cell to determine whether (1) it is timely, effective, and 

efficient in submitting DHS nominations; (2) the information provided to external 

partners is complete, accurate, and timely; (3) establishing the Watchlisting Cell has had 

an effect on the DHS component nomination process; and (4) the Watchlisting Cell has 

developed and communicated effective policies and procedures for coordinating 

nomination submissions within DHS. We also reviewed whether the Watchlisting Cell 

has developed an effective process for providing nominator certification training, quality 

assurance, and the oversight necessary for decentralization, and whether it has 

developed an effective methodology for planning and coordinating its resources. 

We determined that the Watchlisting Cell has had a positive effect on DHS and the 

interagency watchlisting community, as it increased the number and quality of DHS 

nominations, and provided oversight, guidance, and required watchlisting overview 

training to DHS components. However, it needs to develop performance metrics to 

improve its operational processes and to measure the effectiveness of its program 

initiatives. In addition, the Watchlisting Cell did not communicate effectively on its 

decentralization plan, and needs to determine the effect decentralized execution will 

have on the Watchlisting Cell’s caseload and ability to provide oversight. The 

Watchlisting Cell operated without an itemized budget or a method for tracking its 

expenses, and is not prepared to address increases or fluctuations in its caseload. 

We are making ten recommendations to develop performance metrics; streamline 

internal procedures; evaluate decentralization effects; develop training, oversight, and 

quality assurance processes for decentralization; and develop financial and sustainability 

plans for the Watchlisting Cell. 

www.oig.dhs.gov 1 OIG-13-105 
 

 

 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Background 


On September 16, 2003, the President issued Homeland Security Presidential Directive 6 

(HSPD-6), Directive on Integration and Use of Screening Information to Protect Against 

Terrorism, which directed the U.S. Attorney General to “establish an organization to 

consolidate the Government's approach to terrorism screening and provide for the 

appropriate and lawful use of Terrorist Information in screening processes.”1 In response, 

the U.S. Attorney General established the Terrorism Screening Center (TSC), which 

enables government officials to check individuals against the Federal Government’s 

consolidated terrorist watchlist, the Terrorist Screening Database (TSDB).2 

The U.S. Government’s Watchlisting System 

The TSDB provides sensitive but unclassified information to authorized users on both 

international and domestic terrorists. TSDB information on international terrorists is 

obtained from the Office of the Director of National Intelligence’s (ODNI) National 

Counterterrorism Center (NCTC) Terrorist Identities Datamart Environment (TIDE). The 

NCTC was established by Executive Order 13354 and the Intelligence Reform and 

Terrorism Prevention Act of 2004 to implement a 9/11 Commission recommendation 

calling for the NCTC to serve as a center for joint operational planning and joint 

intelligence.3 This act further directed that the NCTC will be the central and shared 

classified knowledge bank on known or suspected terrorists (KSTs) and international 

terrorist groups, as well as their goals, strategies, capabilities, and networks of contacts 

and support.4

 The NCTC is the primary U.S. Government organization for analyzing and 

integrating all intelligence possessed or acquired by the U.S. Government regarding 

terrorism and counterterrorism.5

 However, the tasks of collecting and analyzing 

intelligence pertaining exclusively to domestic terrorists, and investigating terrorism 

within the United States, fall primarily under the purview of the Federal Bureau of 

Investigation (FBI).6

 The FBI uses its Automated Case System (ACS) to support these 

efforts. 

1

 HSPD-6, Directive on Integration and Use of Screening Information to Protect Against Terrorism (September 


16, 2003).
 

2

 HSPD-11, Comprehensive Terrorist-Related Screening Procedures (August 27, 2004).
 3

 See Final Report of the National Commission on Terrorist Attacks Upon the United States, p. 403. 
 4

 HSPD-11 defines a KST as an individual known or reasonably suspected to be or have been engaged in 


conduct constituting, in preparation for, in aid of, or related to terrorism ("suspected terrorists") and 


terrorist activities.
 

5

 50 U.S.C. § 404o(d)(1).
 

6

 See 28 U.S.C. §§ 509, 510, 533, and 534; 18 U.S.C. § 2332b(f); Executive Order 12333; 28 CFR § 0.85.
 

www.oig.dhs.gov 2 OIG-13-105 
 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

As appropriate, information maintained in TIDE and ACS is exported to the TSDB. The 

term “export” describes the transfer of record information from one database to 

another. TSDB information on domestic terrorists is obtained from ACS. To the extent 

permitted by law, TIDE and ACS contain both substantive derogatory information and 

identifying information such as biometric, biographic, and travel records.7

 In addition to 

KSTs, TIDE and the TSDB include information on family members and associates who are 

not themselves KSTs. 

HSPD-6 requires all executive departments and agencies to provide the TSC with 

information regarding KSTs, as permitted by law. For example, information may 

become available through analysis of information in Federal data systems, by checking 

whether a newly identified KST has ever applied for an immigration benefit, or from 

information obtained during an interview with a KST at a United States port of entry. 

Relevant new and additional information is provided to the NCTC or the FBI for possible 

inclusion in TIDE, the TSDB, or ACS as a nomination, modification, enhancement, 

addendum, or removal. Nominations are new additions to TIDE, the TSDB, or ACS that 

contain information about individuals not previously identified as being associated with 

terrorism. Modifications/enhancements/addendums include new or corrected 

information about previously identified individuals with records in these data systems. 

Removals include TIDE, TSDB, or ACS records for individuals that were misidentified, no 

longer meet minimum standards for inclusion on the terrorist watchlist, or information 

has been uncovered that supports removal from watchlisting. The NCTC and FBI review 

information provided to determine whether it reaches the established threshold for 

inclusion in or removal from TIDE, the TSDB, or ACS. 

Authorized Federal, State, local, and tribal government officials use TSDB information to 

screen individuals for law enforcement, transportation security, and immigration and 

border security decision making. When a possible match to a TSDB record occurs during 

these interactions, officials must contact the TSC for resolution. The watchlisting 

community refers to these interactions as encounters. 

 

7

 HSPD-6 states that integration and use of screening information “shall be implemented in a manner 

consistent with the ... Constitution and applicable laws, including those protecting the rights of all 

Americans.” 

8

 TSC, Watchlisting Guidance, (July 2010), Appendix 1. The guidance was updated in March 2013, after 

our fieldwork ended. 

www.oig.dhs.gov 3 OIG-13-105 
 

DHS’ Role and Contributions to the Federal Government’s Watchlisting Community 

DHS has nine operational components that contribute information to TIDE, TSDB, and 

ACS: U.S. Customs and Border Protection (CBP), U.S. Citizenship and Immigration 

Services (USCIS), the U.S. Coast Guard, U.S. Immigration and Customs Enforcement 

(ICE), the Office of Intelligence and Analysis (I&A), the U.S. Secret Service, the 

Transportation Security Administration (TSA), Office of Operations Coordination and 

Planning (OPS), and the U.S. Visitor and Immigrant Status Indicator Technology (USVISIT) program.9

 In addition, I&A and DHS’ Office for Civil Rights and Civil Liberties 

(CRCL), the Privacy Office, the Office of the General Counsel, and the Office of Policy 

 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Screening Coordination Office (SCO) share responsibility for ensuring compliance with 

Federal laws, regulations, and policies on screening and watchlisting, including privacy, 

civil rights and civil liberties protections, and DHS information-sharing policies. I&A and 

the Coast Guard are also members of the Intelligence Community.10 

DHS operational components contribute information through analysis of DHS data 

systems, as well as information gathered during encounters. I&A, OPS, TSA Office of 

Intelligence, USCIS Fraud Detection and National Security Directorate, and CBP’s Office 

of Intelligence and Investigative Liaison contribute primarily through analysis of 

information in DHS and Intelligence Community data systems and intelligence reports. 

US-VISIT provides photographic and biographic information from DHS data systems in 

addition to biometrics to TIDE for inclusion in the TSDB. CBP, USCIS, Coast Guard, ICE, 

Secret Service, and TSA obtain information during encounters, both in person and 

through automated matching of information in the TSDB and DHS screening systems 

and data subsets. For example, CBP officers at U.S. ports of entry encounter KSTs in 

9

 Operational component is used in this report to distinguish components directly involved in individual 

nominations, including intelligence components, from those that provide policy and oversight. 

In May 2013, the Office of Biometric Identity Management replaced US-VISIT. Because our fieldwork 

ended before this reorganization, this report refers to US-VISIT. 

10 The Intelligence Community is defined by the National Security Act, as amended, and Executive Order 

(E.O.) 12333, as amended, to include 16 executive-level elements with oversight provided by the Office of 

the Director of National Intelligence. 50 U.S.C. § 401a (4), E.O. 12333 § 3.5 (h), and 46 Federal Regulation 

59941 (December 4, 1981), as amended. DHS participation is specified in 6 U.S.C. § 101 et seq. 

www.oig.dhs.gov 4 OIG-13-105 
 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

person, while CBP’s National Targeting Center – Passenger (NTC-P) encounters 

individuals through automated screening of travelers seeking to enter or depart from 

the United States. TSA’s use of the No Fly and Selectee lists enables automated 

identification of individuals who are prohibited from boarding an aircraft, or who should 

undergo enhanced screening prior to boarding. Appendix D provides additional 

information about the role of DHS components in screening and watchlisting. 

Establishing and Operating the DHS Watchlisting Cell 

In July 2010, the Intelligence Community published its Watchlisting Guidance to help 

departments and agencies that are part of the watchlisting and screening community to 

standardize watchlist nominations and screening decisions, and develop procedures to 

carry out these activities.11 

13 Before the WLC, DHS did not have a central point of contact for 

coordinating departmental watchlist nominations. The WLC was established to submit 

all routine DHS-generated international KST nominations to NCTC. As of January 2013, 

the WLC was staffed with four full-time contractors, one full-time Federal employee, 

and one full-time Federal manager. Because the WLC operates 12 hours each weekday, 

in exigent circumstances DHS operational components are able to nominate KSTs to 

NCTC or the TSC. Operational components also maintain responsibility for watchlist 

nominations related to domestic terrorism. Appendix E summarizes the legal 

authorities for DHS’ watchlisting process. 

The WLC provides the NCTC with nominations generated from several sources, including 

component request nominations and WLC nominations. In addition, the WLC 

coordinates with Intelligence Community nominators to update or add subjects to TIDE 

when the data source is from a non-DHS department or agency. 

•	 Component Request Nominations: DHS operational components send the WLC 

nominations based on analysis of information in DHS holdings, and information 

gathered from DHS encounters. 

 

11 TSC, Watchlisting Guidance (July 2010). 12 

13 The National Intelligence Program funds intelligence activities in several Federal departments and 

agencies, including DHS and the Central Intelligence Agency. Office of Management and Budget, National 

Intelligence Program, Fiscal Year 2012 Budget. 

http://www.whitehouse.gov/omb/factsheet_department_intelligence. 

www.oig.dhs.gov 5	 OIG-13-105 
 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

•	 WLC Nominations: The WLC reviews and develops nominations from 

information in DHS holdings. Some nominations are based on information that 

DHS components publish following encounters, such as Homeland Intelligence 

Reports and other intelligence reports, reports generated by CBP on individuals 

denied entry into the United States, 14 The remaining 

nominations are based on advanced analysis, reviewing information in DHS data 

systems and classified systems to identify new KSTs or add information to the 

existing KST records. 

•	 Coordinations: DHS officers and intelligence analysts review external Federal 

partner information about KSTs. When officers and analysts determine that this 

information is not already in TIDE, but qualifies for inclusion, a watchlisting 

coordination request is initiated. 

Before submitting nominations to the NCTC for inclusion in TIDE, the WLC reviews and 

adds information from DHS holdings and equities, including biographic, biometric, 

immigration status, travel, law enforcement, and intelligence information. DHS officers, 

agents, and analysts maintain information relevant to watchlisting in multiple data 

systems listed in appendix F. WLC analysts routinely check as many as 13 of these 

systems. 


 The NCTC reviews each nomination to determine
 

whether the information provided meets minimum standards and justifies the WLC’s 

requested actions. 

In addition to providing nominations to the NCTC, the WLC was established to bring 

consistency to DHS’ role in the watchlisting process. The WLC provides required 

watchlisting overview training to component officers and analysts, and communicates 

Intelligence Community policy and procedure changes to operational components. The 

WLC also conducts oversight to ensure that nominations and coordinations satisfy the 

Intelligence Community’s threshold for inclusion and protection of rights. 

www.oig.dhs.gov 6	 OIG-13-105 

14 
 

 

 

 

 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Protection of rights is important to DHS, because it nominates to TIDE U.S. Persons, 

individuals with protected status, and individuals who are not themselves terrorists.15 

The Federal Government has an obligation to “protect fully the legal rights of all United 

States persons, including freedoms, civil liberties, and privacy rights guaranteed by 

Federal law.”16 DHS is also responsible for securing information regarding certain 

categories of noncitizens with protected status, such as refugees, asylum seekers, 

Violence Against Women Act applicants, and T and U visa holders, about whom certain 

information can be shared only in a limited national security or counterterrorism 

context. Although protections are limited for KSTs, some of the individuals in TIDE and 

the TSDB are family members or associates of KSTs. Finally, DHS is responsible for 

offering redress, or timely and fair review of complaints, to identify and correct errors in 

TIDE and the TSDB. 

In addition to its oversight role, the WLC coordinates DHS watchlisting policies and 

practices through DHS’ Watchlisting Working Group. All operational components 

involved in watchlisting are members of this working group. DHS offices that provide 

guidance and oversight for the watchlisting process, CRCL, Privacy, and SCO, as well as 

the Office of the General Counsel, participate in the working group in an advisory role. 

A separate organization, the Homeland Security Intelligence Council (HSIC), is DHS’ 

advisory body that manages departmental intelligence functions, provides senior-level 

direction for intelligence activities, and promotes integration efforts. The HSIC is 

chaired by the Under Secretary for I&A, and includes the heads of intelligence functions 

in DHS operational components. 

WLC Efforts To Address Previous Recommendations 

In September 2011, we reported on DHS’ watchlisting process.17 We recommended 

that the newly established WLC develop and disseminate policies and procedures to 

standardize watchlisting terminology and operations, and limit duplication between 

operational components and the WLC. In addition, we recommended reducing reliance 

15 Executive Order 12333 defines a U.S. Person as “a United States citizen, an alien known by the 

intelligence element concerned to be a permanent resident alien, an unincorporated association 

substantially composed of United States citizens or permanent resident aliens, or a corporation 

incorporated in the United States, except for a corporation directed and controlled by a foreign 

government or governments.” United States Intelligence Activities, Executive Order 12333 § 3.5(k), 

(December 4, 1981), (as amended by Executive Orders 13284 (2003), 13355 (2004) and 13470 (2008)). 

https://www.cia.gov/about-cia/eo12333.html. 16 United States Intelligence Activities, Executive Order 12333 § 1.1(b), (December 4, 1981), (as amended 

by Executive Orders 13284 (2003), 13355 (2004) and 13470 (2008)). https://www.cia.gov/aboutcia/eo12333.html. 

17 DHS’ Role in Nominating Individuals for Inclusion on the Government Watchlist and Its Efforts To 

Support Watchlist Maintenance (OIG-11-107), September 2011. 

www.oig.dhs.gov 7 OIG-13-105 
 

 

 

 

 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

on contract personnel, and that I&A ensure adequate WLC staffing and resources to 

conduct encounter package and Homeland Intelligence Report analysis in a timely 

manner. Although the WLC completed actions to close these recommendations, 

additional challenges remain. 

Results of Review 

The WLC has had a positive effect on the DHS component nomination process by 

developing information and completing nominations from operational components with 

limited resources; safeguarding the rights of U.S. Persons, individuals with protected 

status, and those who are eligible for redress; and providing guidance and required 

watchlisting overview trainings.18 The WLC, however, needs to develop performance 

metrics to ensure that its processes are timely, effective, and efficient. WLC officials did 

not communicate effectively with DHS’ Watchlisting Working Group on its 

decentralization plan, and WLC officials need to evaluate the effect I&A’s plan for 

decentralized execution will have on the WLC’s caseload. The WLC also needs to further 

develop its watchlist analyst training and certification program, and provide oversight 

and quality assurance to implement decentralization. The WLC operated without a 

budget or method for tracking its expenses, and needs to develop an effective 

methodology for planning and coordinating its resources. 

DHS Has Centralized Its Watchlisting Process Within the WLC, But Some 

Components Continue To Nominate Through External Partners 

The WLC performs a critical role in coordinating DHS watchlist nominations and 

redress, is effective in coordinating nominations with other Federal departments 

and agencies, and provides guidance and required watchlisting overview training 

to DHS operational components. It provides assistance to DHS components with 

limited resources, and performs advanced analysis of information in classified 

systems and DHS holdings. Given the effective partnerships among Federal 

agencies and departments, some DHS operational components coordinate 

watchlist nominations through external agencies and departments, and some 

18 Executive Order 12333 defines a U.S. Person as “a United States citizen, an alien known by the 

intelligence element concerned to be a permanent resident alien, an unincorporated association 

substantially composed of United States citizens or permanent resident aliens, or a corporation 

incorporated in the United States, except for a corporation directed and controlled by a foreign 

government or governments.” United States Intelligence Activities, Executive Order 12333 (as amended 

by Executive Orders 13284 (2003), 13355 (2004) and 13470 (2008)). https://www.cia.gov/aboutcia/eo12333.html. 

www.oig.dhs.gov 8 OIG-13-105 
 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

provide biometrics and encounter packages directly to the NCTC for inclusion in 

TIDE. 

WLC’s Role Has Had a Positive Effect on DHS’ Watchlisting Process 

The WLC plays a critical role in managing DHS watchlist nominations. It reviews 

DHS nominations to ensure requirements for U.S. Persons are met, individuals 

who are determined not a threat are flagged for review by NCTC and removed 

from TIDE or removed from the TSDB export for DHS screening, and redress 

requests are considered. Although operational components also conduct 

compliance reviews, such as by identifying individuals who should be removed 

from the watchlist, operational priorities may take precedence. The WLC also 

disseminates guidance on Intelligence Community standards, ensures that 

component watchlisting staff receives required watchlisting overview training, 

and responds to DHS operational component requests for guidance. 

WLC analysts develop nominations and coordinations that would otherwise not 

be available to the Intelligence Community. For example, as part of analytical 

efforts, OPS identified new information in DHS data systems for watchlist 

records, including fingerprints and photographs for individuals on the No Fly list. 

In addition, OPS identified KSTs who had not been placed on DHS’ biometric 

watchlist, and provided clarification of U.S. Person status. 

 OPS officials said that the WLC’s capacity to complete the 

additional steps required to forward these nominations for inclusion in TIDE and 

the TSDB is one of I&A’s most important functions. In addition, WLC analysts 

conduct advanced analysis that most DHS components cannot perform because 

of limited access to classified or restricted systems. 

Some DHS Components Coordinate Watchlisting Information Directly With 

External Partners 

DHS operational components continue to forward watchlist nominations to 

external partners when there is a long-standing relationship, which ensures 

information is shared efficiently. Operational components with personnel 

overseas, including the Secret Service, ICE, and USCIS, continue to forward 

watchlist nominations through Department of State embassy staff. Operational 

www.oig.dhs.gov 9 OIG-13-105 
 

 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

components that participate in the FBI’s Joint Terrorism Task Forces in the 

United States coordinate resulting watchlist nominations through the FBI.19 For 

example, Secret Service officials said if they were to encounter a watchlisted 

individual in the United States, they would notify the responsible intelligence 

agency and work directly with the Joint Terrorism Task Forces on any resulting 

investigation. ICE officials said their agents in the United States work primarily 

through the Joint Terrorism Task Forces on nominations. Coast Guard officials 

also said that any information they received through participation in Joint 

Terrorism Task Forces would be shared through the FBI. 

Because DHS does not have an enterprise-wide automated process to provide 

encounter packages and biometric information directly to the Intelligence 

Community, direct exchange is more efficient. As a result, some operational 

components that provided this information directly to the NCTC or TSC before 

the WLC was established continue this practice. For example, USCIS personnel 

are detailed to the NCTC and TSC, and USCIS shares encounter information, such 

as interview notes and copies of documents, through these personnel. CBP’s 

NTC-P provides encounter packages directly to the NCTC according to the 

mandate set forth in HSPD-6 and subsequent agreements.20 US-VISIT also works 

with the NCTC to provide biometrics for inclusion in TIDE as part of its 

interoperability process. 

In addition, DHS operational components have developed effective informal 

cooperative relationships for submitting nominations, based on partnerships, 

some of which predate DHS. When USCIS identifies a potential KST during 

applicant immigration benefit interviews, it provides the information to ICE. The 

Coast Guard screens passengers and crew on large vessels against law 

enforcement and terrorism information using Coast Guard and CBP data 

systems. Coast Guard officers who are collocated with CBP’s NTC-P then 

coordinate any resulting nominations with CBP. Secret Service officials said that 

CBP assists them by conducting interviews with KSTs at United States ports of 

entry, and that CBP manages any resulting watchlist nominations. 

Although the Coast Guard, ICE, Secret Service, USCIS, and US-VISIT do not 

channel most of their watchlisting activities through the WLC, all are members of 

19 Joint Terrorism Task Forces are small cells of highly trained, locally based investigators, analysts, 


linguists, and other specialists from dozens of U.S. law enforcement and intelligence agencies, led by the 


Department of Justice and FBI, and designed to combine the resources of Federal, State, local, and tribal 


law enforcement. http://www.justice.gov/jttf.
 20 NTC-P has always coordinated removals with NCTC directly, given the nature of imminent encounters.
 

www.oig.dhs.gov 10 OIG-13-105 
 

 

 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

DHS’ Watchlisting Working Group or are provided an opportunity to review 

watchlisting guidance. WLC officials said the DHS operational components are 

responsive when the WLC requests information or assistance to complete 

nominations, enhancements, or removal requests. Given limited WLC resources 

and the effectiveness of these long-standing external partnerships, we are not 

making a recommendation to augment these arrangements. 

Additional Performance Metrics and Streamlined Operations Are Needed 

To Measure and Improve Timeliness, Effectiveness, and Efficiency 

The ability to research, analyze, and compile information in multiple DHS 

holdings is one of the WLC’s most valuable contributions to the Intelligence 

Community. Submitting information from DHS holdings is inherently complex. 

WLC analysts must routinely check 5 DHS data systems, and may check as many 

as 13, to compile unclassified biographic, biometric, immigration status, and 

travel information in DHS holdings. WLC analysts must also check this 

information against information in TIDE and other classified and unclassified 

systems. The need to check multiple systems impedes the timeliness, 

effectiveness, and efficiency of WLC nominations; however, the WLC can 

improve its operations by developing performance metrics and identifying and 

addressing processes that are labor intensive and susceptible to human error. 

Additional Indicators Are Needed To Determine WLC Timeliness and 

Effectiveness 

According to the President’s December 2012 National Strategy for Information 

Sharing and Safeguarding, “[s]takeholders should not only measure 

improvements in information sharing and safeguarding processes (e.g., 

discoverability, timeliness, accuracy, compliance, and oversight), but also 

measure their overall effectiveness (e.g., how shared information helps to 

achieve the mission).”21 The WLC began reporting performance metrics in 

November 2011, primarily to inform operational components on the results of 

component requests. The WLC provides monthly reports on the number of 

component request nominations and coordinations submitted to NCTC, and the 

percent accepted by the NCTC for inclusion in TIDE. The WLC also reports on its 

timeliness in processing these cases. 

21 National Strategy for Information Sharing and Safeguarding, December 2012, p. 9. Information 

safeguarding is defined as strengthening the protection of classified and sensitive information, for 

example by identifying and preventing unauthorized access and enhancing data system controls and 

monitoring.

www.oig.dhs.gov 11 OIG-13-105 
 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

The WLC, in consultation with DHS’ Watchlisting Working Group, assigned 

priorities to component request nominations and coordinations based on the 

level of threat represented, and assigned timeliness goals to each priority level. 

The resulting statistics indicate that the WLC had difficulty meeting its timeliness 

goals for component requests: high-priority cases that should have been 

completed in 3 days averaged 4.91 days. Appendix G provides definitions for 

priority levels, as well as additional information on timeliness goals and results. 

Most of the WLC’s caseload is documented in a Tracking Spreadsheet. Although 

the WLC provides monthly statistics on requests for nominations and 

coordinations submitted by DHS operational components, it does not report fully 

on WLC analyst initiatives to develop additional nominations and coordinations 

from review of DHS data systems and published intelligence reports. For 

example, table 1 indicates the WLC’s actual caseload from March to July 2012, 

compared with the caseload it reported in its monthly report to the working 

group. The WLC did not report 30 percent of the nominations and coordinations 

it reviewed. Although many of the unreported cases represent instances in 

which a WLC analyst reviewed an intelligence report and determined that it did 

not contain information relevant to the watchlisting process, these 

determinations should be reflected in WLC caseload statistics. 

The WLC also needs to report consistently on the disposition of its caseload. For 

example, even though its September 2012 monthly statistics reported pending 

intelligence publications and encounter packages, the WLC did not provide an 

update in its October 2012 report. Consistent reporting will enable the WLC to 

assess its accomplishments and resource requirements better. 

Table 1: WLC Actual and Reported Nominations and Coordinations Caseload, 

March Through July 2012 

 

 

 

 

 

 

 

 

www.oig.dhs.gov 12 OIG-13-105 
 

 

 

 

 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

The WLC also needs to adopt standard performance metrics to track and report 

its review of intelligence publications, encounter packages, and other DHS 

sources of intelligence information. As of December 2012, for each of these 

caseloads the WLC provides a monthly report on the number pending, the 

number completed, and a cumulative number it refers to as a backlog. When 

the WLC identifies newly published intelligence information, it reports the new 

cases as additions to the cumulative backlog. The WLC needs to establish one 

process for tracking and reporting its backlog, or outstanding cases, and a 

separate process for managing and reviewing newly published intelligence 

information. The WLC also needs to develop a timeliness measure for review of 

newly published information. Standard performance metrics will inform the 

WLC of caseload increases or fluctuations, and its capacity to process new cases 

promptly. 

In addition, the WLC should identify opportunities to track and report 

performance metrics that demonstrate its unique contributions to the 

watchlisting community. The WLC currently conducts analysis of information 

available only in DHS holdings, but does not report on its success in adding this 

information to TIDE and the TSDB. For example, DHS is uniquely positioned to 

collect and share biometric information from in-person KST encounters. 

Although WLC analysts routinely check whether biometrics are available when 

they complete nominations, they do not consistently track or report the number 

of KSTs for whom they have identified new biometric information. WLC analysts 

routinely identify information from unclassified DHS sources, such as a KST’s 

telephone number or address listed on an immigration benefit application that 

may previously have been available only from classified sources. Information 

from unclassified sources can be added to the TSDB to assist screeners and 

investigators in identifying KSTs. In addition, WLC analysts routinely check U.S. 

Person status to ensure appropriate safeguards during terrorism investigations, 

but do not track or report the number of records modified. The WLC should 

consult with internal and external stakeholders, including DHS’ Watchlisting 

Working Group and the NCTC, to identify performance metrics that will 

demonstrate the value of WLC contributions. Measuring the WLC’s unique 

contributions to the watchlisting community can support a business case for 

maintaining or increasing WLC resources. 

Additional Streamlining Is Needed To Improve DHS’ Watchlisting Process 

Efficiency 

The process for preparing DHS nominations is inherently complex, given the 

need to check DHS holdings in multiple unclassified systems and transfer 

unclassified information between classified and unclassified systems. However, 

www.oig.dhs.gov 13 OIG-13-105 
 

 

 

 

 

 

 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

the WLC’s current nomination process takes an estimated 2 to 4 hours for each 

case, and the WLC needs to address inefficiencies. For example, WLC analysts 

must request assistance from I&A’s information technology staff to transfer an 

unclassified document between classified and unclassified systems. To avoid 

delays, WLC analysts manually cut and paste, or retype, individual data elements 

between systems and into the WLC-developed nominator source form, a process 

that is susceptible to human error. This unclassified form is then transferred to 

the classified system, where each data element is again manually entered into 

the NCTC standard nomination tool. While transferring text information from 

the NCTC standard nomination tool to TIDE is automated, biometric images, such 

as photographs and signatures, must be uploaded manually to TIDE in a separate 

process. Developing performance metrics will enable WLC officials to assess the 

staff costs associated with these manual processes and make informed decisions 

on streamlining processes and reducing human error susceptibility. 

In addition, the WLC’s process for internally managing and tracking its caseload 

has inefficiencies. The WLC has developed a Tracking Spreadsheet to manage its 

caseload and report monthly statistics, which requires WLC analysts to cut and 

paste, or retype data from other sources. There is also a separate internal 

process for managing support documents and adherence to record retention 

requirements, which requires analysts to transfer supporting electronic files and 

documents manually for each nomination among folders on I&A’s internal 

classified computer share drive at several stages. Both processes are labor 

intensive and susceptible to human error. Although the WLC has developed 

specifications to automate transfer of data from the NCTC’s standard nomination 

tool to streamline case tracking and reporting, the project has not been funded. 

Developing performance metrics will enable WLC officials to determine where 

funding automation projects could reduce costs and improve nomination quality 

or timeliness long-term. 

The WLC needs to track and report all of its activities to provide better 

information on increases or fluctuations in its caseload and resource 

requirements. The WLC should also identify, track, and report metrics that 

demonstrate its value to DHS and the watchlisting community. Developing such 

performance metrics could inform decisions on information technology project 

investments to automate some WLC processes. Funding automation projects 

that minimize processes susceptible to human error and improve safeguarding of 

information, particularly information on U.S. Persons and individuals with 

protected status, should receive priority. 

www.oig.dhs.gov 14 OIG-13-105 
 

 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Recommendations 

We recommend that the Acting Under Secretary for Intelligence and Analysis: 

Recommendation #1: 

Develop additional performance metrics that document all Watchlisting Cell 

operations accurately and demonstrate program effectiveness. 

Recommendation #2: 

Evaluate current watchlisting processes to identify opportunities to improve 

information sharing and ensure information integrity. At a minimum, this 

evaluation should include measures to streamline processes that are labor 

intensive and susceptible to human error. 

Management Comments and OIG Analysis 

We evaluated I&A’s written comments and have made changes to the report 

where we deemed appropriate. A summary of I&A’s written response to the 

report recommendations and our analysis of the response follows each 

recommendation. A copy of I&A’s response, in its entirety, is included in 

appendix C. NCTC also provided a response, which is included in its entirety in 

appendix C. 

In addition, we received technical comments from departmental components 

I&A, CBP, USCIS, CRCL, Office of the General Counsel, and Office of Biometric 

Identity Management (formerly US-VISIT), as well as NCTC, and incorporated 

these comments into the report where appropriate. I&A concurred with all ten 

recommendations contained in the report. We appreciate the comments and 

contributions made by each entity. 

Management Response: I&A officials concurred with Recommendation 1. In its 

response, I&A said the WLC has captured metrics on production rates since 

December 2010. Component metrics were initially combined with I&A metrics; 

however, current reporting shows production by component. TSA has 

developed and shared an interim tool solution with the WLC, and that tool is 

being adapted to ensure the WLC can document its operations accurately and 

demonstrate program effectiveness. Testing and implementation is anticipated 

to be complete by March 2014. 

www.oig.dhs.gov 15 OIG-13-105 
 

 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

OIG Analysis: We consider I&A’s proposed actions partially responsive to the 

intent of this recommendation, which is resolved and open. I&A and TSA are to 

be commended for adapting an automation tool that will document WLC 

operations accurately. To close this recommendation, I&A will also need to 

identify performance metrics that demonstrate the WLC’s effectiveness and 

value to the Intelligence Community. We have provided some examples of 

performance metrics in the text that demonstrate effectiveness. 

Management Response: I&A officials concurred with Recommendation 2. In its 

response, I&A said the WLC and participating Watchlisting Working Group 

members continually evaluate processes and procedures to ensure that methods 

in place are effective and efficient. In 2011 and 2012, the WLC worked with 

Intelligence Community and departmental partners to develop requirements for 

a DHS Watchlisting Enterprise nomination tool. Earlier in 2013, the WLC selected 

a nomination tool and has since taken steps to acquire funding for its 

development. This tool is expected to eliminate most labor intensive activities, 

reduce the potential for human error, and improve visibility. In the meantime, 

TSA has developed and shared an interim tool solution with the WLC that will 

streamline some, but not all, processes by March 2014. 

OIG Analysis: We consider I&A’s proposed actions responsive to the intent of 

this recommendation, which is resolved and open. We will close this 

recommendation when we have reviewed a detailed description of I&A’s 

selected nomination tool for sufficiency and I&A’s request for funding this tool. 

We encourage the WLC to provide information on additional opportunities it has 

identified to improve information sharing and ensure information integrity. In its 

response, NCTC officials stated they want to partner with DHS in implementing 

this recommendation, and we believe NCTC can provide valuable suggestions on 

improving information sharing and ensuring information integrity. 

WLC’s Quality Assurance Process Ensures Complete and Accurate Products, But 

It Is Duplicative and Hinders Timeliness 

The WLC submits high-quality nominations and coordinations to the NCTC. The 

WLC also demonstrates a commitment to meeting Intelligence Community 

standards, and to protecting privacy and civil liberties. However, its three levels 

of quality assurance review of information obtained from DHS operational 

component encounters, intelligence reports, and data systems is duplicative and 

hinders timeliness. 

www.oig.dhs.gov 16 OIG-13-105 
 

 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

WLC Nominations Are Complete and Accurate, and Protect Individual Privacy 

Nominations and coordinations that the WLC submits to the NCTC have a 

rejection rate of less than 1 percent. NCTC officials said that the WLC is 

responsive to correcting errors when identified. The WLC reviews component 

requests for nominations and coordinations before submission to the NCTC. 

Some requests, however, are not forwarded to the NCTC because the individual 

was previously nominated by another Federal department or agency or DHS 

component. The WLC also rejects component nominations when the individual 

does not meet Intelligence Community standards, such as when the association 

between an individual and a KST is too tenuous to meet the standard. 

WLC’s internal processes demonstrate a commitment to meeting Intelligence 

Community standards for privacy and civil liberties protections. WLC analysts 

are familiar with the added legal requirements for cases that involve U.S. 

Persons and individuals with protected status. Because these requirements are 

complex, WLC analysts keep this information at their work stations for reference 

and contact General Counsel, Privacy, CRCL, and other appropriate offices as 

necessary. In addition, the WLC’s nomination source form requires analysts to 

verify whether an individual is a U.S. Person or has protected status. WLC 

analysts are familiar with DHS’ data systems, know which data system is the 

most reliable source for information they routinely check, and know whom to 

call in DHS operational components to address questions with interpreting this 

information. 

Quality Assurance Process Hinders WLC Timeliness 

Although the WLC’s quality assurance process promotes accurate and complete 

submissions to the NCTC, it is duplicative and hinders case processing timeliness. 

For example, there are three review levels for all NCTC submissions. At the first 

level, although most nominations are developed from a component request or 

published DHS intelligence report, WLC analysts describe these sources as a 

“starting point,” and routinely recheck each data element provided, as well as 

searching DHS data systems for additional information. At the second level, 

another WLC analyst rechecks each data element to be submitted to the NCTC. 

Of the four full-time WLC contractor analysts, two analysts spend 50 percent of 

their time conducting second-level quality assurance reviews. Because these 

analysts are contractors, a Federal employee performs a third level of review and 

checks each record before submitting it to the NCTC. Although the Intelligence 

Community watchlisting guidance requires quality control measures, quality can 

likely be maintained with less duplication. 

www.oig.dhs.gov 17 OIG-13-105 
 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Better coordination with DHS operational components could reduce some 

duplication of effort. For example, the WLC has had some success encouraging 

components to submit requests using the WLC’s nomination source form. The 

WLC should evaluate whether it is necessary to conduct multiple quality 

assurance checks when the source form is used. The WLC’s remaining caseload 

stems largely from reviewing published DHS component intelligence reports. 

Should the WLC review the process by which operational components develop 

these reports, it may determine sufficient quality controls exist and it is 

unnecessary to recheck all data elements provided. Operational components 

may be willing to provide additional data elements or sourcing information in 

intelligence reports when doing so requires limited time and resources. If the 

WLC is not able to identify opportunities to streamline its quality assurance 

process through closer coordination with operational components, it may be 

necessary to develop a quality assurance process that relies in part on random 

review and feedback from the NCTC quality assurance process. 

Recommendations 

We recommend that the Acting Under Secretary for Intelligence and Analysis: 

Recommendation #3: 

Survey DHS operational components to determine which components have 

sufficient intelligence reporting quality controls to enable the Watchlisting Cell to 

reduce its duplicative quality assurance review. 

Recommendation #4: 

Identify and incorporate procedures and capabilities to streamline the 

Watchlisting Cell’s internal quality assurance process to improve timeliness. 

Management Comments and OIG Analysis 

Management Response: I&A officials concurred with Recommendation 3. In its 

response, I&A said the WLC has demonstrated commitment to ensuring that 

effective procedures are developed and communicated. Beginning in September 

2012 and continuing in 2013, the WLC developed and delivered training to 

Watchlisting Working Group intelligence and vetting analysts in a Watchlist 

Analyst Course. The training course comprised three modules: basic 

watchlisting; a training environment; and advanced concepts. Component 

personnel dedicated time and effort, spanning several months, towards 

certification. In advance of receiving their certification, component analysts had 

www.oig.dhs.gov 18 OIG-13-105 
 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

to demonstrate their knowledge of departmental and Intelligence Community
 

policies and procedures. 

In addition to this training and oversight, the WLC, through the Department’s 

Watchlisting Working Group, led discussions on ways for the DHS Watchlisting 

Enterprise to maximize efficiencies and avoid redundant activities. As a result of 

this training, oversight, and communication, departmental production increased, 

and the WLC was able to shift resources to avoid redundancies. It is important 

to note that message releaser activities are not part of the WLC’s quality 

assurance review. I&A said the WLC does not have “three levels of quality 

assurance review” as indicated in the draft report. I&A said that the training and 

certification program has already had the effect called for in the 

recommendation, believes these actions and clarification address the 

recommendation, and respectfully requests it be closed. 

OIG Analysis: We consider I&A’s proposed actions partially responsive to the 

intent of this recommendation, which is resolved and open. The intent of this 

recommendation is to address when a WLC contractor reviews an intelligence 

report published by an operational component, such as a Homeland Intelligence 

Report, and checks each fact provided. To close this recommendation, I&A 

should determine whether its current internal quality assurance process is 

necessary for developing nominations from intelligence reports published by 

operational components. In its response, NCTC officials stated they want to 

partner with DHS in implementing this recommendation, and we believe that 

NCTC can assist the WLC in evaluating whether operational components have 

sufficient intelligence reporting quality controls. 

Management Response: I&A officials concurred with Recommendation 4. In its 

response, I&A said the WLC follows a “two-person rule” for all terrorist 

nomination activities. This rule ensures that the same watchlist analyst does not 

perform consecutive activities in the nomination process. The nomination 

process is labor intensive and the potential for human error is great. Because of 

this, it is necessary for the Department to continue with its current quality 

assurance process. The WLC’s success, low error rate, and protection of civil 

rights and civil liberties are a direct result of this rule. As indicated previously, 

development of new software tools and increased DHS Watchlisting Enterprise 

communication by March 2014 will enable the WLC and DHS Watchlisting 

Enterprise members to improve the timeliness of its nominations and ensure the 

future success of the Department’s watchlisting program. 

www.oig.dhs.gov 19 OIG-13-105 
 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

OIG Analysis: We consider I&A’s proposed actions partially responsive to the 

intent of this recommendation, which is resolved and open. Developing 

software tools could limit some vulnerabilities to error. However, assigning a 

Federal employee, rather than a contractor, to provide the second level of 

review necessary for the two-person rule could also streamline the process 

without sacrificing quality. We will close this recommendation when we receive 

an evaluation of procedures and capabilities that were adopted to streamline 

the WLC’s internal quality assurance process. 

WLC Coordinated Nomination Policies and Procedures With DHS Components, 

But Communication Could Be Improved 

The WLC coordinated effectively with DHS’ Watchlisting Working Group to 

develop required overview trainings, and policies and procedures for submitting 

watchlisting nominations. However, bilateral communication to resolve issues 

specific to components needs improvement. 

WLC Coordinates With DHS’ Watchlisting Working Group On Procedures 

The WLC solicited comments from DHS Watchlisting Working Group members on 

its standard operating procedures, the working group charter, and topics for a 

watchlisting overview training required by the Intelligence Community. The WLC 

negotiated with working group members to determine what information would 

be provided in WLC monthly reports. Working group members also responded 

to WLC requests to test some forms and processes it developed. 

Working group members consider monthly meetings constructive, and cite 

information received from these meetings, such as information on DHS data 

systems, changes in Intelligence Community standards and requirements, and 

monthly statistics on nominations. However, bilateral communication to resolve 

issues specific to components has been less effective. For example, several WLC 

analysts said some operational components continue to submit nominations that 

do not meet eligibility criteria. Several component working group participants 

said they were not aware of Intelligence Community or DHS policy that resulted 

in rejected nominations until the policy was explained in a subsequent working 

group meeting. Several component officials said they forward some 

nominations through other Federal departments or agencies, when they 

anticipate the external process will be less cumbersome or more successful than 

working through the WLC. Several USCIS officials said the WLC could provide 

USCIS with more case-specific assistance, such as when there are inconclusive 

matches to TIDE or the TSDB. 

www.oig.dhs.gov 20 OIG-13-105 
 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

WLC Did Not Coordinate or Communicate Its Decentralization Plan With DHS 

Operational Components Effectively 

The WLC developed its decentralization plan without analyzing potential effects 

decentralization would have on the WLC or DHS operational component 

caseloads. It also did not consult DHS offices responsible for providing oversight 

and guidance, including CRCL, SCO, and Privacy, of its plan. Only the operational 

components can determine whether they have the capacity and resources to 

process their own nominations.22 Although CBP’s NTC-P has the capacity to 

assume its own watchlisting caseload and may have the resources to streamline 

and automate its watchlisting nomination process, decentralization effects on 

other DHS operational components are less clear. 

WLC Needs Additional Information To Plan for Decentralization 

The WLC developed its plan to decentralize watchlisting nominations to the 

operational components because its watchlisting nomination caseload increased 

while WLC staff resources remained constant. In FY 2012, the Intelligence 

Community expanded the categories of individuals that could be included in the 

TSDB, which increased DHS’ watchlist nominations. Dedicated WLC funding from 

the National Intelligence Program ended, requiring I&A to fund WLC activities 

and resources from its general budget. In addition, in FY 2013 Intelligence 

Community guidance limited the use of contractors throughout the Federal 

Government’s Intelligence Community. 

The WLC published its decentralization memorandum, and corresponding 

nominator training and certification plan, through the HSIC. Because key DHS 

Watchlisting Working Group members and stakeholders, such as CBP’s NTC-P, 

SCO, and CRCL, are not members of the HSIC, they did not receive notification of 

the decentralization plan. The WLC did not announce the decision to the DHS 

Watchlisting Working Group, and did not solicit comments from the operational 

components. SCO, CRCL, and Privacy, which have oversight and guidance roles 

in watchlisting, were not consulted in advance, and were not asked to assist in 

developing the nominator certification training or the certification program. 

I&A officials said by providing watchlist analyst training and certification training 

to operational components and empowering them to prepare and submit 

watchlisting nominations directly to the NCTC, components could assume 

22 Department of Homeland Security, Delegation To the Under Secretary For Intelligence and 

Analysis/Chief Intelligence Officer, DHS Delegation Number 08503 (August 10, 2012). 

www.oig.dhs.gov 21 OIG-13-105 
 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

responsibility for a portion of the WLC’s caseload. While CBP, OPS, USCIS, ICE, 

and TSA participated in the first nominator certification training, their 

commitment and ability to provide watchlisting nominations to the NCTC vary 

widely. 

CBP’s NTC-P officials said the NTC-P has the capacity to assume its own 

watchlisting caseload. NTC-P officers complete most of the steps required for 

nominations in the course of targeting and screening operations, and are 

experienced users of DHS data systems that are checked to complete 

watchlisting nominations. The NTC-P is exploring the technological resources 

necessary to automate interfaces between its case management system and the 

NCTC’s standard nomination tool. Automation would improve the accuracy and 

timeliness of nominations. 


 Tables 2 and 3 provide additional information on the
 

WLC caseload from component requests and other sources. 


www.oig.dhs.gov 22 OIG-13-105 
 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Table 2: WLC Caseload by Component (December 2010 to August 2012*) 


www.oig.dhs.gov 23 OIG-13-105 
 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Table 3: WLC Nominations and Coordinations (December 2010 to August 

2012*)

 OPS officials said that while they have 

resources to identify new biometric information on KSTs in DHS data systems, 

they cannot divert additional resources to the WLC’s labor-intensive process for 

completing nominations. OPS officials said that after the WLC announced its 

decentralization policy, staff focused on projects that did not require following 

the WLC’s watchlisting nomination procedures, such as identifying KSTs whose 

fingerprints do not appear on the US-VISIT biometric watchlist. 

 

WLC officials, and some USCIS officials, said that USCIS could provide additional 

watchlisting nominations, including removals from the watchlist through 

supporting the redress system. USCIS officials from the Fraud Detection and 

National Security Directorate indicate USCIS stands committed to continuing 

coordination with the WLC, while developing its own USCIS watchlist function 

support capabilities. As a significant step toward support capabilities, USCIS 

www.oig.dhs.gov 24 OIG-13-105 
 

 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

currently has two staff that completed course work within the DHS watchlist 

analyst training and certification program. However, USCIS officials from the 

Refugee and Asylum Offices said the USCIS terrorism-related caseload is smaller, 

more complex, and it is likely that most of the derogatory terrorist information 

would fall within the jurisdiction of another Federal department or agency. 

USCIS officials said they would continue to share information with ICE where 

there is no other record owner on KSTs, and will continue to coordinate through 

local Joint Terrorism Task Forces on these issues and through USCIS intelligence 

report publications.23 

How decentralization will affect ICE’s caseload is not clear. 

 ICE officials said they would
 

continue to respond to WLC requests for information, and value WLC review of 

intelligence reports, but do not consider developing their own nominations to be 

a priority. 

TSA officials said they would welcome direct responsibility for their caseload, 

and are in a better position to advocate for TSA nominations than the WLC. 

However, TSA analysts do not routinely use most of the DHS data systems that 

the WLC checks in preparing nominations, and may require assistance with 

system access, training, and technical support. 

I&A officials said they would continue to provide nominator certification training 

to all the DHS operational components, and believe components would begin 

submitting additional nominations as more officers and analysts are trained and 

certified. As of January 2013, however, it is not clear whether most DHS 

operational components can assume a significant portion of the WLC’s caseload. 

The WLC should survey operational components to determine which have the 

operational capacity and resources necessary to manage a portion of the WLC’s 

caseload. This information will enable I&A officials to evaluate the effect 

decentralization would have on the WLC’s caseload. 

Recommendation 

We recommend that the Acting Under Secretary for the Office of Intelligence 

and Analysis: 

23 A Joint Terrorism Task Force is a multiple-agency effort led by the Department of Justice and the FBI, 

and is designed to promote regional information sharing to combat terrorism by combining Federal, State, 

and local law enforcement resources. 

www.oig.dhs.gov 25 OIG-13-105 
 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Recommendation #5: 

Survey DHS operational components to determine which components have the 

operational capacity and resources to manage a watchlist nomination caseload, 

and determine how the Watchlisting Cell will prioritize the remaining caseload. 

Management Comments and OIG Analysis 

Management Response: I&A officials concurred with Recommendation 5. In its 

response, I&A said all DHS Watchlisting Enterprise members have demonstrated 

an interest and commitment to either performing or supporting watchlisting 

activities, but I&A understands that watchlisting is an additional duty for 

component analysts, and additional time will be required to determine actual 

component capabilities. 

 I&A said the other participating components are 

continuing to develop their own programs. The WLC will continue its 

Watchlisting Analyst Course and outreach efforts. 

This model is already showing its value. 

In addition to this caseload, the WLC was able to 

reduce its backlog of DHS-published intelligence reports, expand advanced 

analysis on subjects identified in current intelligence as posing a threat to the 

homeland, increase the number of encounter packages exploited, and perform 

quality assurance on nominations submitted by analysts seeking watchlist 

analyst certification. 

OIG Analysis: We consider I&A’s proposed actions responsive to the intent of 

this recommendation, which is resolved and open. 

 

www.oig.dhs.gov 26 OIG-13-105 
 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Procedures For Training, Quality Assurance, and Oversight Programs 

Are Needed 

DHS operational component watchlisting nomination skills and experience vary. 

As a result, the WLC needs to develop an effective process for providing 

component personnel with watchlist analyst training and certification. The WLC 

also needs to develop a process for providing oversight to certified watchlist 

analysts and a quality assurance methodology for reviewing operational 

component nominations. 

Training Should Reflect Skills and Experience of Operational Component 

Personnel 

The WLC should develop appropriate training for DHS operational component 

analysts who will process watchlist nominations. During our review, the WLC 

had completed its first certification training program. Based on comments the 

WLC received from officers and analysts who attended the training, the skills, 

experience, and mission requirements of personnel from operational 

components vary too widely, and training all components in the same course 

would not have the same expected outcome. As a result, WLC officials 

determined that experience using DHS data systems would need to be a course 

prerequisite, because following the WLC’s standard operating procedures 

requires access to and training on multiple, complex DHS data systems. For the 

remaining coursework, some students have prior experience or no operational 

need to be certified or trained on certain modules. For example, officers from 

USCIS and CBP’s NTC-P are already proficient on the Immigration and Nationality 

Act, as amended.24 OPS officials said training on writing narrative intelligence 

reports was not relevant to their mission, and intelligence analysts in many 

operational components have already received extensive training on Intelligence 

Community requirements for safeguarding information. However, I&A officials 

said that they could not exempt students from certain portions of the training 

based on prior experience or operational need. 

The WLC should coordinate with CBP’s NTC-P as it develops its training 

curriculum. The NTC-P is currently the only operational component prepared to 

assume a substantial caseload—that of the NTC-P—after its officers are trained 

and certified. Because the NTC-P personnel rotate to other CBP assignments, 

frequent training, or a train-the-trainer program, may be necessary to maintain a 

sufficient number of certified CBP analysts. NTC-P officials have raised concerns 

24 8 U.S.C. 1101 et seq. 

www.oig.dhs.gov 27 OIG-13-105 
 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

that the WLC is not providing a sufficient number of training courses within the 

year, and would prefer a train-the-trainer option for NTC-P staff. 

Oversight and Quality Assurance Programs Need Development 

The WLC needs to develop a plan for performing oversight on DHS operational 

component certified watchlist analysts, and a quality assurance review 

methodology for nominations from DHS operational components. Officials from 

both CRCL and SCO raised concerns about maintaining privacy and civil liberties 

protections and accurate interpretation of information in DHS data systems after 

WLC decentralizes some nominations. The WLC will need to coordinate closely 

with CRCL, SCO, Privacy, and General Counsel to ensure that relevant laws, 

regulations, and policies are integrated into the oversight and quality assurance 

methodology. The oversight and quality assurance program for each operational 

component will need to be adapted to the volume and complexity of 

nominations processed, and to the component’s level of expertise in interpreting 

information in DHS data systems. 

Recommendations 

We recommend that the Acting Under Secretary for Intelligence and Analysis: 

Recommendation #6: 

Develop and document a process with CBP that ensures CBP has a sufficient 

number of trained and certified analysts to maintain CBP’s watchlisting 

operations to include consideration of a train-the-trainer option. 

Recommendation #7: 

Develop and implement, in collaboration with the DHS Offices for Civil Rights and 

Civil Liberties, Privacy, General Counsel, and Screening Coordination Office, an 

oversight plan for certified DHS operational component analysts conducting 

watchlisting operations. 

Recommendation #8: 

Develop and implement a quality assurance review methodology for DHS 

operational components conducting watchlisting operations. 

www.oig.dhs.gov 28 OIG-13-105 
 

 

 

 

 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Management Comments and OIG Analysis 

Management Response: I&A officials concurred with Recommendation 6. In its 

response, I&A said it is working with CBP as CBP develops its program, but that it 

is too early to determine CBP’s needs. In addition, I&A is still developing the 

Watchlist Analyst Course, which will likely be programmed in FY 2014. 

in an additional pilot Watchlist Analyst Course scheduled to 

begin in mid-September 2013; and two to four courses are planned for FY 2014. 

Upon completion of the pilot course in September 2013, I&A will work with CBP 

on a Memorandum of Understanding that develops a train-the-trainer program. 

OIG Analysis: We consider I&A’s proposed actions responsive to the intent of 

this recommendation, which is resolved and open. We will close this 

recommendation when we receive the signed Memorandum of Understanding 

between I&A and CBP. 

Management Response: I&A officials concurred with Recommendation 7. In its 

response, I&A said the WLC has drafted and implemented a standard operating 

procedure as part of its pilot DHS Watchlisting Training and Certification 

program. Included in the standard operating procedure are plans for obtaining 

watchlist analyst certification and for providing oversight of analyst compliance 

with departmental and Intelligence Community policies and procedures. I&A has 

certified watchlist analysts using this standard operating procedure; however, as 

this is a pilot program, adjustments may be made after consulting with DHS 

Watchlisting Enterprise members. In addition, the WLC has coordinated with 

NCTC to ensure that its feedback on DHS component submissions is funneled 

through the WLC. 

OIG Analysis: We consider I&A’s proposed actions responsive to the intent of 

this recommendation, which is resolved and open. During the draft report 

comment period, this recommendation was revised to require collaboration with 

CRCL, Privacy, General Counsel, and SCO. As such, documentation of this 

collaboration should be provided. In addition, the sample size and methodology 

for selecting cases the WLC will review should be addressed to ensure adequate 

oversight of cases that involve civil rights and civil liberties issues, application of 

complex legal standards, and interpretation of data in DHS data systems. Other 

issues that should be addressed are oversight of analysts who do not routinely 

submit nominations, and criteria and procedures for decertification. In its 

response, NCTC officials stated they want to partner with DHS in implementing 

this recommendation. 

www.oig.dhs.gov 29 OIG-13-105 
 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Management Response: I&A officials concurred with Recommendation 8. In its 

response, I&A said the WLC developed, trained, and certified watchlist analysts 

via standard operating procedures for the DHS watchlisting program. Standard 

Operating Procedures: 11-Quality Assurance, a supplemental document to the 

overarching WLC standard operating procedures, contains requirements for 

watchlist analysts performing quality assurance. The WLC identified quality 

assurance requirements during its development of the DHS Watchlisting 

Program. The WLC-developed Watchlist Analyst Course included blocks of 

instruction in both its Basic and Advanced modules to emphasize standards and 

methodologies. DHS component analysts that pursue analyst certification are 

required to submit 20 terrorist nominations to the WLC for quality assurance and 

scoring on a rubric designed to emphasize departmental standards. This scoring 

rubric, and associated feedback on the submission, is returned to the analysts. 

In addition, the WLC lead visits each component and verifies processes and 

procedures prior to authorizing initiation of component nomination programs. 

The WLC lead will also make periodic site visits and verify that scheduled reviews 

are conducted. 

OIG Analysis: We consider I&A’s proposed actions responsive to the intent of 

this recommendation, which is resolved and open. To close this 

recommendation, we require additional information on the quality assurance 

review methodology. For example, we need information on quality assurance 

standards and processes for components developing and submitting 

nominations, including processes to ensure that the quality assurance process is 

independent. In addition, we need more information on the schedule and 

criteria for periodic WLC quality assurance reviews. In its response, NCTC 

officials stated they want to partner with DHS in implementing this 

recommendation, and we believe that NCTC can provide valuable suggestions on 

developing the WLC’s methodology. 

WLC Needs Sustainability and Resource Allocation Plans 

I&A officials did not estimate the additional expenses that would be incurred, or 

potential savings realized, before initiating its plan to train and certify officers 

and analysts and delegate certain authorities to them. The WLC needs to 

develop a sustainability plan to describe and prioritize its current and planned 

goals, operations, and resources. Doing so would be prudent and serve as a 

framework to support DHS’ role and contributions to the Federal Government’s 

watchlisting community. 

www.oig.dhs.gov 30 OIG-13-105 
 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Develop an Effective Methodology for Resource Planning


 This funding augmentation ended in 

September 2012, after which I&A sustained the program within its base budget. 

During this period, I&A did not track its expenses or estimate its funding 

requirements. WLC funding continued within I&A’s base budget at a reduced 

level commensurate with available resources. At the time of our review, with 

the exception of Federal employee salaries, I&A could not itemize its expenses. 

I&A officials did not estimate the additional expenses that would be incurred, or 

potential savings realized, before initiating its plan to train and certify officers 

and analysts and delegate certain authorities to them. I&A officials said that the 

plan was developed to reduce dependence on contractors. The four full-time 

WLC contractors and two contractors who assist with watchlist analyst training 

and certification were funded from a larger I&A contract, and there was no 

dedicated funding for WLC technological enhancements or investments. 

This situation was not unique to the WLC, as few I&A programs and operations 

tracked expenses or operated with a defined budget at this organizational level 

prior to the enactment of the FY 2013 DHS appropriation.25 I&A officials said the 

first itemized budget I&A submitted was for FY 2013 funds. WLC funding was 

included in this budget request, based on its current staffing levels, not on 

analysis of current or projected expenses. I&A officials said that they are 

committed to maintaining WLC funding, but have not planned to request 

additional National Intelligence Program funding. Determining WLC costs, based 

on more complete performance metrics for its projects and initiatives, as well as 

tracking expenses better, will enable I&A to make informed decisions about staff 

allocation and potential savings from technological enhancements and 

investments. 

The WLC would benefit from developing a sustainability plan to describe and 

prioritize its current and planned goals, operations, and resources. The WLC 

should develop a plan to manage its caseload to anticipate increases or 

fluctuations in component requests, coordination requests, or DHS intelligence 

reports available for review. It may be necessary for the WLC to restructure or 

scale back some of its projects and procedures, but several recommendations in 

this report can assist the WLC in managing its limited resources more effectively. 

25 In March 2013, after our fieldwork ended, DHS’ FY 2013 budget was approved. I&A’s approved FY 2013 

budget includes dedicated funding for the WLC, and fixed amounts for such expenses as training, travel, 

contracts, and supplies as well as salaries and benefits. 

www.oig.dhs.gov 31 OIG-13-105 
 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Metrics designed to measure overall performance effectiveness may help the 

WLC prioritize its resources. 

More complete information about the certification program results may enable 

the WLC to determine whether extending the program to all operational 

components simultaneously is the best use of I&A resources, given operational 

component capacity, and training, quality assurance, and oversight requirements. 

The WLC can identify opportunities to streamline its internal standard operating 

procedures, while ensuring that CBP has sufficient trained and certified analysts. 

This will benefit the WLC as CBP invests in technologies to automate the 

nomination process. Each of these measures will enable the WLC to identify and 

sustain activities that provide the greatest value to DHS screening operations 

and the DHS role and contribution to the Federal Government’s watchlisting 

community. 

Recommendations 

We recommend that the Acting Under Secretary for Intelligence and Analysis: 

Recommendation #9: Develop and implement a financial plan that addresses 

funding, staffing, and resources to sustain the Watchlisting Cell’s operations for 

the next 5 years. 

Recommendation #10: Develop and implement a sustainability plan for the 

Watchlisting Cell that describes and prioritizes current and planned goals, 

operations, and resources for the next 5 years. 

Management Comments and OIG Analysis 

Management Response: I&A officials concurred with Recommendation 9. In its 

response, I&A said that in collaboration with other DHS components, I&A will 

use FY 2013 financial and throughput data for the WLC, and data gathered for 

the other recommendations in this report, to build a financial plan that 

addresses funding, staffing, and other resources to sustain the WLC’s operations 

for the next 5 years. WLC resource requirements, consistent with the predicted 

workload and ability to sustain the WLC training and certification efforts, are 

included in the FY 2014 President’s Budget. 

OIG Analysis: We consider I&A’s proposed actions responsive to the intent of 

this recommendation, which is resolved and open. We will close this 

recommendation when we receive and have reviewed the financial plan. 

www.oig.dhs.gov 32 OIG-13-105 
 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Management Response: I&A officials concurred with Recommendation 10. In 

its response, I&A said that in collaboration with other DHS components, I&A will 

use FY 2013 financial and throughput data, as well as information gathered to 

address this report’s recommendations, to build a sustainability plan. The 

sustainability plan will describe and prioritize current and planned goals, 

operations, and resources for the next 5 years, and serve as an input to the FY 

2016 President’s Budget. 

OIG Analysis: We consider I&A’s proposed actions responsive to the intent of 

this recommendation, which is resolved and open. We will close this 

recommendation when we receive and have reviewed the sustainability plan. 

Conclusion 

The WLC has made positive contributions to the Federal Government’s 

watchlisting community. As a result of WLC initiatives, the number of 

nominations made by DHS components has increased, as has the accuracy and 

level of detail in nominations. The WLC has provided training and guidance to 

DHS operational components regarding Intelligence Community standards. 

Given the WLC’s resource constraints, and CBP NTC-P’s mission and commitment 

to technological improvements to the watchlisting process, DHS would benefit 

from delegating authority to CBP and certifying its analysts. However, the WLC 

should evaluate the effect of delegating authority and its caseload to all 

operational components. The WLC should develop performance metrics, a 

sustainability plan, and a financial plan to identify and prioritize the activities, 

projects, and initiatives that provide the greatest value to DHS screening 

operations and the Intelligence Community. 

www.oig.dhs.gov 33 OIG-13-105 
 

 

 

 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Appendix A 

Objectives, Scope, and Methodology 

The Department of Homeland Security (DHS) Office of Inspector General (OIG) was 

established by the Homeland Security Act of 2002 (Public Law 107-296) by amendment 

to the Inspector General Act of 1978. This is one of a series of audit, inspection, and 

special reports prepared as part of our oversight responsibilities to promote economy, 

efficiency, and effectiveness within the Department. 

We assessed I&A’s efforts to manage and operate DHS’ WLC as part of our Fiscal Year 

2012 Annual Performance Plan. Our objectives were to determine whether (1) the WLC 

is timely, effective, and efficient in submitting DHS nominations to the NCTC; (2) the 

information provided to external partners is complete, accurate, and timely; 

(3) establishing the WLC has had an effect on the DHS component nomination process; 

and (4) the WLC has developed and communicated effective policies and procedures for 

coordinating nomination submissions within DHS. Because the WLC announced in July 

2012 that it proposed to decentralize its watchlist nomination process, we also reviewed 

whether the WLC has developed an effective process for providing the training, quality 

assurance, and oversight necessary for decentralization and has developed an effective 

methodology for planning and coordinating its resources. 

To accomplish our objectives, we interviewed Federal officials and contractor WLC 

analysts, and reviewed and analyzed related documents and data. Specifically, we 

interviewed officials and staff from I&A, CBP, OPS, USCIS, TSA, Coast Guard, Secret 

Service, Office of Policy’s SCO, CRCL, Privacy, and US-VISIT. We also met with NCTC and 

Government Accountability Office officials to gain their perspectives on the WLC. In 

addition, we reviewed and analyzed more than 125 related documents, including WLC 

guidelines and procedures, and applicable laws, regulations, and policies. We also 

assessed WLC resources and staffing information, as well as training and DHS’ 

Watchlisting Working Group materials. We also analyzed data in the WLC Tracking 

Spreadsheet. We did not assess the quality of individual nominations or the 

certification training. 

Our review was limited to DHS’ watchlisting process. We did not review the DHS HSIC or 

its decisions on intelligence policies and authorities. We did not assess the quality of 

Intelligence Community guidance and procedures. We interviewed NCTC officials on the 

quality and timeliness of DHS nominations, but did not review non-DHS Intelligence 

Community departments or agencies, or the joint programs in which DHS participates, 

such as the TSC or Joint Terrorism Task Forces. We discussed DHS data systems in this 

report, but did not review these systems or the data systems used by the Intelligence 

Community, such as TIDE, ACS, and the TSDB. 

www.oig.dhs.gov 34 OIG-13-105 
 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Our fieldwork began in August 2012 and concluded in December 2012. We conducted 

this review under the authority of the Inspector General Act of 1978, as amended, and 

according to the Quality Standards for Inspections issued by the Council of the 

Inspectors General on Integrity and Efficiency. 

www.oig.dhs.gov 35 OIG-13-105 
 

 

 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Appendix B 

Recommendations 

We recommend that the Acting Under Secretary for Intelligence and Analysis: 

Recommendation #1: Develop additional performance metrics that document all 

Watchlisting Cell operations accurately and demonstrate program effectiveness. 

Recommendation #2: Evaluate current watchlisting processes to identify opportunities 

to improve information sharing and ensure information integrity. At a minimum, this 

evaluation should include measures to streamline processes that are labor intensive and 

susceptible to human error. 

Recommendation #3: Survey DHS operational components to determine which 

components have sufficient intelligence reporting quality controls to enable the 

Watchlisting Cell to reduce its duplicative quality assurance review. 

Recommendation #4: Identify and incorporate procedures and capabilities to 

streamline the Watchlisting Cell’s internal quality assurance process to improve 

timeliness. 

Recommendation #5: Survey DHS operational components to determine which 

components have the operational capacity and resources to manage a watchlist 

nomination caseload, and determine how the Watchlisting Cell will prioritize the 

remaining caseload. 

Recommendation #6: Develop and document a process with CBP that ensures CBP has 

a sufficient number of trained and certified analysts to maintain CBP’s watchlisting 

operations to include consideration of a train-the-trainer option. 

Recommendation #7: Develop and implement, in collaboration with the DHS Offices for 

Civil Rights and Civil Liberties, Privacy, General Counsel, and Screening Coordination 

Office, an oversight plan for certified DHS operational component analysts conducting 

watchlisting operations. 

Recommendation #8: Develop and implement a quality assurance review methodology 

for DHS operational components conducting watchlisting operations. 

Recommendation #9: Develop and implement a financial plan that addresses funding, 

staffing, and resources to sustain the Watchlisting Cell’s operations for the next 5 years. 

www.oig.dhs.gov 36 OIG-13-105 
 

 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Recommendation #10: Develop and implement a sustainability plan for the 

Watchlisting Cell that describes and prioritizes current and planned goals, operations, 

and resources for the next 5 years. 

www.oig.dhs.gov 37 OIG-13-105 
 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Appendix C 

Management Comments to the Draft Report 

u.s. u.".r1/01U I 0(11. _ ..... 5«".iI1 

8; 

WIl>h;npo.. I>C 2O,S21 

Homeland 

"'" Security 

June 7. 20 13 

MEMORANDUM FOR, Deborah L. Outten-Mills 

FROM, 

SUBJECT, Response to Draft Report 01 ,.12·005.ISP·I&A, DHS' 

W(uchlislil1g Cel/'s Efforts 10 Coordinale Deparlmelltal 

Nomi/lt/lions 

The Department of Ilomcland Security Office of Intelligence and Analysis (I&A) appreciates the 

opportunity to review and comment on the Omce of Inspector General (OIG) Draft Report OIG· 

12·005-ISP-I&A, DIlS' WOlchlisli"g Cell's t.JJorls 10 Coordinate DepclTfmental Nominariofls. 

1&/\ is activcly resolving the issues identifi ed in the draft repon, and provides the following 

responses to the recommendations in the repon. 

Recommendation II I: Develop performance metric, tbat document Wlltchlisting Cell 

openltions accuratdy Il.nd demonstrate program effectiveness. 

'¥. ~~;;o~Co ur. The I&A Watch listing Cell (I&A WLC) has :l! rales since December 20 I O. Component metrics were 

combined I&A WlC metri cs, however, current reponing shows production 

by component. TSA has developed nnd shared an interim tool solution with the I&A 

WLC, and that tool is being adaplI.:d to ensure the I&A WlC can document Watchlisting 

Cell operations accurately and demonstrate program effectiveness. Testing and 

implementation is anticipated to be complete by March 2014. 

Rccommendlltion #12: Eva luate current watch listin g processes to identify opportunilies 10 

iOlprove information sha ring and ensure information Inlegrhy, At a minimum, tb ls 

evaluation should include mCllsures to streamlin e processes thllt a re labor intensive and 

susceptible to human error. 

DRS Response: Concur. The I&A WlC, and now participating 

Watchlisting Enterprise members, continually evaluate processes and procedures 10 

ensure that methods in place arc cffective and efficient. In 2011 and 2012 the I&A WlC 

worked with Ie and Departmental partners to develop requirements for a OHS 

Wutchlisting Enterprise nomi nation tool. Earlier this year, the I&A WLC selected a 

www.oig.dhs.gov 38 OIG-13-105 
 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

nomination tool and has since taken steps to acquire funding for its development. lbe 

tool selected is expected to eliminate most labor intensive activities, reduce thc potential 

for human crror, and improvc Enterprise visibility. in the meantime, TSA has developed 

and shared an interim tool solution with the l&A WLC that wiJl streamline some, but Dot 

all, processes by March 2014. 

Recommendation #3: Survey DUS operational components to determine which components 

bave .'l ufficien. intelligence r eJX)rling quality controls to enable the Watchlisting Cell 10 

reduce its duplicative q uality usurance r eview. 

_ PHS Response: Concur. The l&A WLC has demonstrated its commitment 

to ensunng that effective procedures are developed and communicated. Beginning in 

September 2012 and continuing in 2013, the J&A WLC developed and delivered training 

to Watchlisling Enterprise intelligence and vetting analysts in a Walehlist Analyst 

Course. The training course comprised three modu les: basic watchlisting; a lrelining 

environment; and advanced concepts. Component personnel dedicated time and effort, 

spanning several months. towards certification. In advance of receiving their certification, 

Component 

and 

W',lChlistingWorking Group, led 

discussions on ways fo r the Enterprise 10 maximize efficiencies and avoid redundant 

activities. As a result of this training, oversight and communication, Departmenta1 

production increased, the I&A WLC was able to shift resources, and redundancies were 

avoided. It is important to note that, message releaser activities are not part of the I&A 

WLC's quality assurance review, The I&A WLC does not have "three levels of quality 

assurance review" as indicated in the Draft Report the training and certification program 

has already had the effect called for in the recommendation. 

J&A believes these actions, and clarification adt/rel·s Ihe recommendalion and 

rl!lpt!cl/ulfy reqllesls Ihis recommellllal;on be closed. 

Recommendation #4: Identify and incorporate opportunities to streamline tbe Wateblisting 

Cell's internal quality assurance process to impr ove timeliness. 

_DHS Response: Concur. Thc I&A WLC fo llows a "two" person rule for all 

terranst nomination activities. This rule ensures that thc same watehlis1 analyst does not 

perform consecutive activities in the nomination process. The nomination process is labor 

intensive and the potential for human error is great. Because of this, it is necessary for the 

Department to continue with its current quality assurance process. The I&A WLC's 

success, low error rate and protection of civil ri ghts and civil liberties, is directly 

attributed to this rule. As indicated previously, development of new software tools and 

increased Enterprise communication wiJl enable the I&A WLC, and Enterprise members, 

to improve the timeliness of its nominations and ensure the future success of the 

Departments watchlisting program by March 2014. 

www.oig.dhs.gov 39 OIG-13-105 
 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Recommendation #5: SUn'cy DHS operational components to determine which components 

have tbe operational capacity and resources to manage a watcblist nomination case load, 

a nd determine how tbe WatcblisHng Ccll will prioritize the remaining u~elo d. 

_OMS Response: Concur. All DHS Watchlisting Enterprise members have 

dc on st and commitment to either performing or supporting watchlisting activities, 

but key to determining Enterprise capabilities is 1&A'5 understanding that watchlisting is an 

additiona l duty for 

expand advanced analysis on subjects identified in current intelligence as posing threat to the 

homeland, increase the number of encounter packages exploited, perform quality assurance on 

nominations submitted by analysts seeking watchlist analyst certification,. 

I&A believej' Illis action, addresses th e recommelldalion and respectfully requests Ihis 

recommendation be closed. 

Recommendation #6: Develop and document a process with CBP that ensures it hils a 

sufficient number of trained and certified an alysts to maintain CBP's watchlisting 

operations. 

: CODcur,l&A is working with COP as it develops its 

program, tlut it is too carly to determine CBP's needs. In addition, I&A is still developing 

the Watehlist Analyst Course, which will likely be programmed in FY I4. An additional 

st Course is scheduled to begin in mid-September 20 13 _ 

____ and between two and four courses are planned for FY14. upon 

completion of the pilot course in September 2013, we will work with COP on anMOU 

that develops a train the tminer progmm. 

Recommendation #7: Develop and implement an oversight plan for certified DHS 

operational component analysts conducting watehlisting operations. 

~H

~ 

S Response: Concur. The I&A WLC has drafted and implemented an 

Watchlisting Trainjng and Cenification program 

(Attachment 1). Included in the SOP are plans for obtaining watchlist analyst certification 

and for providing oversight of analyst compliance with Departmental and Ie policies and 

procedures. l&A has certified watchlist analysts using this SOP, but, as this program is in 

pilot, adjustments may be made after consulting with the DHS Watchlisting Enterprise 

www.oig.dhs.gov 40 OIG-13-105 
 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

members. In addition, the I&A WLC has coordi nated with NCTC to ensure that its 

feedback on Component submissions is funneled through the I&A WLC. 

I&A believes this actio"J addresses the recommendation and respect/lilly 

reqllests this recommendotio" be clol'ed. 

Recommendation #8: Devclop and implement a qua lity assurance review methodology (or 

OIlS operational component.s conducting watcblisting operations. 

_nHS Response: Concur. The I&A WLC developed, trained, and certified 

watchJist analysts via standard operating procedures for the DHS Watchlisting program. 

In "Standard Operating Procedures: I I-Quality Assurance" , a supplemental document to 

the overarching program SOP, are requirements for watch list analysts performing quality 

assurance (QA) (Altachment 2). The I&A WLC identified QA requirements during its 

development ofthe DHS Watchlisting Program and confinned them during operations. 

The I&A WLC-developed Watchlist Analyst Course included blocks o f instruction in 

both its Basic and Advanced modules to emphasi7..e standards and methodologies. DHS 

component analysts that pursue certification as watchHst analysts are required to submit 

20 terrorist nomi nations to the r&A WLC fOf quality assurance and scoring on a rubric 

designed to emphasize Departmental standards. This scoring rubric, and associated 

feedback on the submission, is returned to the analysts, In addition, the I&A WLC lead 

visits cach Component and verifies processes and procedures prior to authorizing 

initiation of Component nomination programs. The I&A WLC lead will also make 

periodic site visits and verify scheduled reviews are conducted. 

l&A believes this action. addresses the recommendation and respect/ully 

reqllests this recommelldotion be closed. 

Recommendation #9: Develop and implement a financia l plan that addn:lilicS (unding, 

staffing, and resources to sustain the Watcblistiog C~ s operations (or the next 5 years. 

DB'S Response: Concur. I&A, in collaboration with other OHS Components, will use 

FY 13 fi nancial and throughput data ror the I&A WLC and data gathered for the other 

recommendations in this report to build a financial plan that addresses fund ing, staffing, and 

other resources to sustain the I&A WLC's operations for the next li ve years. I&A WLC 

requirements consistent with the predicted workload and ability to sustain the I&A WLC training 

and certification efforts are included in the FY 2014 President's Budget. 

. Recommendation #10: Develop and implement a sustainability plan (or the Walchlilting 

Cell tha t describes aDd prioritizes currenl and planned goals, operations, and r esources (or 

the ned 5 years. 

DMS Resnonse: Concur. I&A, in collaboration with other DHS Components, will use FY 13 

finaneia1 and throughput data for the I&A WLC and data gathered for the other 

recommendations in this report to build a sustainability plan for the J&A WLC that describes and 

www.oig.dhs.gov 41 OIG-13-105 
 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

prioritizes current and plaJUled goals, operations, and resources for thc next five years as an input 

to the FY 20 16 Presidcnt's Budget. 

Wc look forward to contin uing Our work with you to ensure all required actions are completed. 

Should you require additional infonnation, please do not hesitate to contact me or have your slafT 

contact Keith Jones at 202-282-9553. 

www.oig.dhs.gov 42 OIG-13-105 
 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

DIRECTOR 

NATIONAL COUNTERTERRORISM CENTER 

WashmgtOIl DC 2U505 

JUN 0 5 1013 

Mr. Charles K. Edwards 

Deputy Inspector Gcncrul 

Office of the Inspector General 

Departmenl tlf Homeland Security 

Washington, DC 20528 

Dear ML Edwards: 

On behalf of the National Counterterrorism Center (NCTC). I would like to thank the 

Department of Homeland Security's (DHS) Office of the inSpel:LOf General (IG) ror pmviding its 

April 2013 draft report for our review and comment. We appreciatc DHS's efforts on terrorism 

watchlisting and the extensive effort you undertake to coordinate departmental nominations. 

Our officc has reviewed your draft report, Department of Homeland Sccurity, Officc of 

the Inspector General, DHS' Watchhsting Cell's Efforts to Coordinate Departmental 

Nominations, and its associated recommendations, NCTC appreciates the DHS efforts in 

providing a significant quantity. as well as quality, of nominations to the Tcrrorist Identity 

Datamart Environment (TIDE). 

Overall comment: NCTC wants to cmphasize and would like to partner with DHS in 

implemcnting recommendations #2, 3, 7, and 8. While the operational DHS components are 

responsive to Watchlisting Cell requests, more examination of their process, metrics, and their 

proactive posture should be conducted to ensurc DHS information is being added to TIDE in a 

timely, effective, und streamlined process to reduces labor intensive processes susceptible to 

human errors. 

Specific Recommendations: 

• Page 3, third paragraph - Remove the term "evidentiary" - often, this is intelligence 

based information and not tied to evidentiary standards. 

• Page 3, third paragraph - Request DHS add term "Addendums" in the paragraph the two 

limes where they list terms "Modificalion/Enh(lncement", 

o Rationale - we need to continually usc the same tcrminology a(.TIlS~ the 

conununity and bring terms togcther across the Intelligence and the Law 

Enforcement communities. If the nominator tool I TIDE Online SUbmit, etc. are 

(0 be for everyone, they need to see the lenns they expect in it. 

• Page 5, first paragraph - Change "TSC" to "community". 

www.oig.dhs.gov 43 OIG-13-105 
 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Mr. Charles K. Edwards 

• Page 7, first paragraph - Change "watchlis!" in the first sentence to ''TIDE'' and add the 

words "and TIDE" to the end of the final sentence in the paragraph after "in Ihe TSDB". 

• Page 7, first paragraph, la:;t line. Finally, DHS is rcspon:;iblc for offering redre~s, or 

timely and fair review of complaints, to identify and correct errors in the TSDB." Add 

"and TI DE." to Lhe em1 of this sentence. 

We appreciate the DHS IG's independent review of the Watchlisting Cell's processes and 

procedures and the Department's commitmenl 10 continuous impruvement through the IG 

process. NCfC values our critical relationship with DHS an~ recognizes the strides the 

Watchlisting Cell has made: since its establishment in Decemper 2010. We look forward to a 

continued partnership in thi~ critical National Security mission. 

Sincerely, 

Matthew G. Olsen 

cc: Office of the Inspector General of the 

tnlelligem.:e COIllIllunity 

2 

 

www.oig.dhs.gov 44 OIG-13-105 
 

 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Appendix D 

Roles of Components Involved In Watchlisting 

U.S. Coast Guard – Screens for KSTs in crew and passenger information on vessel 

manifests prior to a vessel's arrival in a U.S. port. Conducts interviews and, as 

appropriate, collects biometric, biographic, and documentary evidence during migrant 

interdictions at sea, vessel inspections, ship boarding, investigations, or licensing 

activities. 

CBP – Screens for KSTs at U.S. ports of entry, between ports of entry, and during the 

review of international flight and commercial vessel manifests. Conducts interviews and 

collects biometric, biographic, travel, and documentary evidence during in-person 

encounters with individuals seeking to enter or depart the United States. 

CBP Office of Intelligence and Investigative Liaisons – Develops, provides, 

coordinates, and implements intelligence capabilities to support CBP, acts as 

CBP’s liaison to the Intelligence Community. 

CBP National Targeting Center – Passenger (NTC-P) – Screens passenger 

manifests and related information prior to a passenger’s departure to or from 

the United States. Analyzes, assesses, and makes determinations of travel 

suitability based on TIDE, the TSDB, and other relevant immigration, intelligence, 

and law enforcement information. 

CRCL – Works with Department components and offices to ensure that civil rights and 

civil liberties protections are incorporated into the Department’s information and 

physical security programs, information sharing activities, and intelligence-related 

programs and products. 

OPS – Reviews information in DHS data systems to identify biometric, biographic, travel, 

immigration, and U.S. Person status information on KSTs. 

Office of the General Counsel – Implements the Department's statutory responsibilities 

and policies as set forth by the Administration, the Secretary, and senior officials within 

the Department. 

www.oig.dhs.gov 45 OIG-13-105 
 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

ICE – Serves as the principal law enforcement arm of DHS, and screens for KSTs during 

immigration and customs related investigations, security screening of visa applications, 

and detentions within the interior and at the borders of the United States. Conducts 

interviews and collects biometric, biographic, travel, and documentary evidence during 

in-person encounters with individuals seeking to remain in the United States. 

I&A – Ensures that information related to homeland security threats is collected, 

analyzed, and disseminated to DHS, State, local, and tribal governments, the private 

sector, and the Intelligence Community. Through the WLC, coordinates watchlisting 

efforts and information sharing policies and programs. 

National Protection and Programs Directorate – Protects and enhances the resilience of 

the nation’s physical and cyber infrastructure. 

US-VISIT – Provides biometric identification services to Federal, State, local, and 

tribal government officials. Stores, matches, and shares fingerprints and 

photographs of KSTs in the DHS Automated Biometric Identification System 

(IDENT), and collects some international arrival and departure information. 

Office of Policy’s SCO – Enhances screening and credentialing processes, programs, and 

technologies to facilitate legitimate travel and trade, including redress opportunities. 

Privacy Office – Assesses programs for privacy risks, and recommends privacy 

protections for handling personally identifiable information to mitigate privacy risks. 

Evaluates Department programs, systems, and initiatives for potential privacy impacts, 

and provides mitigation strategies to reduce the privacy impact. 

U.S. Secret Service – Screens for KSTs during investigative event management, such as 

National Special Security Events, political events, and large-scale sporting events. May 

conduct in-person interviews with international or domestic KSTs encountered in event 

screening or investigations, including financial investigations. 

TSA – Screens for KSTs on the aviation No Fly and Selectee lists and during the application 

process for a credential or benefit in the transportation or critical infrastructure 

environment. Collects biometric, biographic, and documentary evidence from 

individuals applying for a TSA benefit or credential. 

USCIS – Screens for KSTs who file petitions or applications for immigration benefits or 

protected status. Conducts interviews and collects biometric, biographic, and 

documentary evidence during in-person encounters with individuals seeking an 

immigration benefit or protected status. 

www.oig.dhs.gov 46 OIG-13-105 
 

 

 

 

 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Appendix E 

Watchlisting Legal Authorities 

The National Security Act of 1947 created the U.S. Intelligence Community to be a 

federation of Executive Branch agencies and organizations that work separately and 

together to perform intelligence activities necessary to conduct foreign relations and to 

protect the national security of the United States.26 Executive Order (E.O.) 12333, as 

amended, defines the goals and direction of U.S. intelligence efforts and describes the 

roles and responsibilities of individual Intelligence Community elements.27 The 

Intelligence Community is defined by the National Security Act, as amended, and E.O. 

12333 to include 16 executive-level elements with oversight provided by ODNI.28 The 

Homeland Security Act of 2002 created DHS, which has 2 of the 17 Intelligence 

Community members: I&A and the Coast Guard.29 

The Intelligence Reform and Terrorism Prevention Act of 2004 created the Director of 

National Intelligence to serve as the head of the Intelligence Community.30 In 

accordance with this act and E.O. 12333, the Director functions as the principal adviser 

to the President and the National Security Council for intelligence matters related to 

national security, and manages the National Intelligence Program budget.31 Within the 

ODNI, the NCTC was established by E.O. 13354 and codified by the Intelligence Reform 

and Terrorism Prevention Act of 2004 to serve as a center for joint operational planning 

and intelligence. This act further directed that the NCTC will be the central and shared 

knowledge bank on KSTs, and the primary organization analyzing and integrating 

intelligence pertaining to terrorism and counterterrorism.32 However, the tasks of 

collecting and analyzing intelligence pertaining exclusively to domestic terrorists and 

domestic counterterrorism investigations fall primarily under the purview of the FBI.33 

HSPD-6 instructed the U.S. Attorney General to establish an organization to consolidate 

the government’s approach to terrorism screening and to provide for the appropriate 

and lawful use of terrorist information in screening processes. To implement the 

26 50 U.S.C. § 401 et seq.
 

27 Executive Order 12333, as amended [hereinafter referred to as E.O. 12333].
 

28 50 U.S.C. § 401a (4) and E.O. 12333 § 3.5 (h).
 

29 6 U.S.C. § 101 et seq.
 

30 50 U.S.C. § 403 (b)(1).
 

31 The National Intelligence Program funds intelligence activities in several Federal departments and 


agencies, including DHS and the Central Intelligence Agency. Detailed funding requests for intelligence
 

activities are classified. Office of Management and Budget, National Intelligence Program, Fiscal Year 


2012 Budget. http://www.whitehouse.gov/omb/factsheet_department_intelligence.
 32 50 U.S.C. § 404o (d)(1).
 

33 E.O. 12333 § 2.3 (e).
 

www.oig.dhs.gov 47 OIG-13-105 
 

 

 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

directive, the U.S. Attorney General—acting through the Director of the FBI, and in 

coordination with the Secretary of State, Secretary of Homeland Security, and the 

Director of Central Intelligence—created the TSC.34 HSPD-6 also requires the NCTC to 

provide the TSC with access to all appropriate information or intelligence in its 

possession that the TSC needs to perform its functions.35 

HSPD-11 requires a systematic approach to terrorist-related screening that optimizes 

detection and interdiction of suspected terrorists and terrorist activities. HSPD-11 

defines the term “suspected terrorists” as individuals known or reasonably suspected to 

be or have been engaged in conduct constituting, in preparation for, in aid of, or related 

to terrorism. HSPD-11 also requires that terrorist-related screening be done in a 

manner that safeguards legal rights, including freedoms, civil liberties, and information 

privacy guaranteed by Federal law.36 

HSPD-24 “establishes a framework to ensure that Federal executive departments and 

agencies (agencies) use mutually compatible methods and procedures in the collection, 

storage, use, analysis and sharing of biometric and associated biographic and contextual 

information of individuals in a lawful and appropriate manner, while respecting their 

information privacy and other legal rights under United States law.” HSPD-24 directs 

the executive branch to integrate “biometrics to identify and screen KSTs and other 

persons who may pose a threat to national security.” HSPD-24 requires agencies and 

departments to make available to other agencies all biometric and associated biographic 

and contextual information associated with persons for whom there is an articulable 

and reasonable basis for suspicion that they pose a threat to national security, to the 

extent permitted by law.37 

The Delegation to the Under Secretary for Intelligence and Analysis/Chief Intelligence 

Officer vests authorities to the DHS Under Secretary for I&A, who also serves as the 

Department’s Chief Intelligence Officer. The delegation enables the Under Secretary, as 

the Executive Agent for DHS’s watchlisting process, to perform the duties and exercise 

the authority of the Secretary required in HSPD-6 to provide a mechanism for 

nominating all identifying or derogatory information about KSTs to the NCTC’s TIDE. The 

duties include: “(1) establishing, managing, and overseeing a unified watchlisting 

capability for the Department; (2) issuing DHS-wide terrorist watchlisting nomination 

policies, procedures, guidelines, and standards consistent with Federal watchlisting 

34 HSPD-6, Directive on Integration and Use of Screening Information to Protect Against Terrorism
 

(September 16, 2003).
 

35 HSPD-6. The NCTC was formerly known as the Terrorist Threat Integration Center.
 

36 HSPD-11, Comprehensive Terrorist-Related Screening Procedures (August 27, 2004).
 37 HSPD-24, Biometrics for Identification and Screening to Enhance National Security (June 5, 2008).
 

www.oig.dhs.gov 48 OIG-13-105 
 

 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

guidance; and (3) representing the Secretary in all interagency forums relating to 

terrorist watch listing nominations.”38 

The National Strategy for Information Sharing and Safeguarding states that “[i]t is a 

national priority to efficiently, effectively, and appropriately share and safeguard 

information so any authorized individual (Federal, state, local, tribal, territorial, private 

sector or foreign partner) can prevent harm to the American people and protect 

national security. The [National] Strategy [for Information Sharing and Safeguarding] 

points toward a future in which information supports national security decisionmaking 

by providing the right information, at any time, to any authorized user, restricted only 

by law or policy, not technology; and where safeguarding measures, to include a 

comprehensive regimen of accountability, prevent the misuse of information.”39 

38 Delegation to the Under Secretary for Intelligence and Analysis / Chief Intelligence Officer, Department 


of Homeland Security Delegation Number: 08503 (August 10, 2012).
 

39 National Strategy for Information Sharing and Safeguarding, December 2012, pp. 3–4.
 

www.oig.dhs.gov 49 OIG-13-105 
 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Appendix F 

DHS Data Systems Used by Watchlist Analysts 

Owner 

CBP 

System 

Advance Passenger Information System (APIS) 

Function 

Receives air and sea passenger manifests 

Automated Targeting System-Passenger 

(ATS-P) 

Provides an enforcement and decision support tool 

Electronic System for Travel Authorization 

(ESTA) 

Screens applications from visa waiver travelers for 

travel authorization 

Targeting Framework Allows users to track risk assessment effectiveness 

and create reports 

TECS Collects, analyzes, and shares law enforcement 

information 

ICE 

Enforce Alien Removal Module 

(EARM) 

Tracks detained aliens, aliens in removal 

proceedings, and case histories 

Enforcement Case Tracking System 

(ENFORCE) 

Tracks immigration enforcement actions and cases 

Intelligence Fusion System 

(IFS) 

Provides access to TECS and ENFORCE, and 

alien encounters and arrests 

Student and Exchange Visitor Information 

System (SEVIS) 

Tracks and monitors students, exchange visitors, 

and dependents 

TSA Secure Flight Watchlist matching for flights into, out of, within, 

and over the United States 

USCIS 

Central Index System 

(CIS) 

Documents the existence and status of most aliens 

known to DHS and their alien file location 

Computer-Linked Application Information 

Management System 3 (CLAIMS 3) 

Tracks immigrant and nonimmigrant 

applications/petitions 

Computer-Linked Application Information 

Management System 4 (CLAIMS 4) 

Tracks naturalization applications 

Image Storage and Retrieval System (ISRS) Provides query and retrieval of biometric image 

sets and biographical data 

Person Centric Query System 

(PCQS) 

Aggregates information from USCIS data systems 

Refugees, Asylum, and Parole System (RAPS) Tracks affirmative applicants for asylum status 

US-VISIT 

Arrival and Departure Information System 

(ADIS) 

Matches biographic data on arrivals, departures, 

extensions, and changes or adjustments of status to 

identify foreign nationals who have overstayed 

authorized terms of admission 

US-VISIT Automated Biometric Identification 

System (IDENT) 

Enrolls and stores biometric and limited 

biographic information on both foreign nationals 

and U.S. citizens 

Source: Information Sharing on Foreign Nationals: Border Security (OIG-12-39), February 2012, Appendix 

C, Database Documentation, Demonstrations. 

www.oig.dhs.gov 50 OIG-13-105 
 

 

 

 

 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Appendix G 

Timeliness Standards 

www.oig.dhs.gov 51 OIG-13-105 
 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Appendix H 

Major Contributors to This Report 

Marcia Moxey Hodges, Chief Inspector 

Lorraine Eide, Lead Inspector 

Morgan Ferguson, Inspector 

www.oig.dhs.gov 52 OIG-13-105 
 

 

 

 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Appendix I 

Report Distribution 

Department of Homeland Security 

Secretary 

Deputy Secretary 

Chief of Staff 

Deputy Chief of Staff 

General Counsel 

Executive Secretary 

Director, GAO/OIG Liaison Office 

Assistant Secretary for Office of Policy 

Assistant Secretary for Office of Public Affairs 

Assistant Secretary for Office of Legislative Affairs 

Acting Chief Privacy Officer 

Acting Under Secretary, Office of Intelligence and Analysis 

Deputy Commissioner, U.S. Customs and Border Protection 

Director, U.S. Citizenship and Immigration Services 

Acting Officer, Office for Civil Rights and Civil Liberties 

Commandant, U.S. Coast Guard 

Director, U.S. Immigration and Customs Enforcement 

Director, Office of Operations Coordination and Planning 

Director, U.S. Secret Service 

Administrator, Transportation Security Administration 

Director, U.S. Visitor and Immigrant Status Indicator Technology 

Office of Management and Budget 

Chief, Homeland Security Branch 

DHS OIG Budget Examiner 

www.oig.dhs.gov 53 OIG-13-105 
 OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Office of the Director of National Intelligence 

Director, National Counterterrorism Center 

Chief, Homeland Security Branch 

DHS OIG Budget Examiner 

Congress 

Congressional Oversight and Appropriations Committees, as appropriate 

www.oig.dhs.gov 54 OIG-13-105 
 

ADDITIONAL INFORMATION AND COPIES 

To obtain additional copies of this document, please call us at (202) 254-4100, fax your 

request to (202) 254-4305, or e-mail your request to our Office of Inspector General 

(OIG) Office of Public Affairs at: DHS-OIG.OfficePublicAffairs@oig.dhs.gov. 

For additional information, visit our website at: www.oig.dhs.gov, or follow us on Twitter 

at: @dhsoig. 

OIG HOTLINE 

To expedite the reporting of alleged fraud, waste, abuse or mismanagement, or any 

other kinds of criminal or noncriminal misconduct relative to Department of Homeland 

Security (DHS) programs and operations, please visit our website at www.oig.dhs.gov 

and click on the red tab titled "Hotline" to report. You will be directed to complete and 

submit an automated DHS OIG Investigative Referral Submission Form. Submission 

through our website ensures that your complaint will be promptly received and 

reviewed by DHS OIG. 

Should you be unable to access our website, you may submit your complaint in writing 

to: 

Department of Homeland Security 


Office of Inspector General, Mail Stop 0305 


Attention: Office of Investigations Hotline 


245 Murray Drive, SW 


Washington, DC 20528-0305 


You may also call 1(800) 323-8603 or fax the complaint directly to us at 

(202) 254-4297. 

The OIG seeks to protect the identity of each writer and caller.