Terrorist Watchlist: Routinely Assessing Impacts of Agency Actions since the December 25, 2009, Attempted Attack Could Help Inform Future Efforts
Released: 2012-05-31T00:00:00

Letter

Background

Overview of the Watchlisting and Screening Processes

Pursuant to Homeland Security Presidential Directive 6, TSC was established to create and maintain the U.S. government’s consolidated watchlist—the Terrorist Screening Database (TSDB)—and to provide for the use of watchlist records during security-related and other screening processes. The watchlisting and screening processes are intended to support the U.S. government’s efforts to combat terrorism by consolidating the terrorist watchlist and providing screening and law enforcement agencies with information to help them respond appropriately during encounters with known or suspected terrorists, among other things.

TSC receives watchlist information for inclusion in the TSDB from two sources: NCTC and the FBI. TSC receives the vast majority of its watchlist information from NCTC, which compiles information on known or suspected international terrorists. NCTC receives this information from executive branch departments and agencies—such as the Central Intelligence Agency (CIA), State, and the FBI—and maintains the information in its Terrorist Identities Datamart Environment (TIDE) database. Agencies that submit nominations to NCTC are to include pertinent derogatory information and any biographic information—such as name and date of birth—needed to establish the identity of individuals on the watchlist. The FBI provides TSC with information about known or suspected domestic terrorists.who are subjects of ongoing FBI counterterrorism investigations to TSC for inclusion in the TSDB, including persons the FBI is preliminarily investigating to determine if they have links to terrorism.

In general, the FBI nominates individuals In accordance with Homeland Security Presidential Directive 6—and built upon through Homeland Security Presidential Directives 11 and 24—the TSDB is to contain information about individuals known or suspected to be or have been engaged in conduct constituting, in preparation for, in aid Nominating agencies, of, or related to terrorism and terrorist activities. NCTC, and the FBI apply a reasonable-suspicion standard to determine which individuals are appropriate for inclusion in the TSDB. NCTC and the FBI are to consider information from all available sources to determine if there is a reasonable suspicion of links to terrorism that warrants a nomination. Once NCTC and the FBI determine that an individual meets the reasonable-suspicion standard and that minimum biographic information exists, they extract sensitive but unclassified information on the individual’s identity—such as name and date of birth— from their classified databases and send the information to TSC. TSC reviews these nominations—evaluating the derogatory and biographic information—to decide whether to add nominated individuals to the TSDB. Appendix II contains additional information on the watchlist nominations process.

To support agency screening processes, TSC sends applicable records from the TSDB to screening and law enforcement agency systems based on the agency’s mission responsibilities and other factors. For instance, applicable TSC records are provided to TSA for use in screening airline passengers, to CBP for use in inspecting and vetting persons traveling to and from the United States, and to State for use in screening visa applicants. Regarding individuals who are not citizens or nationals of the United States seeking to travel to and lawfully enter the United States, screening and law enforcement agencies rely on immigration laws that specify criteria for determining whether to issue visas to individuals and whether to admit them into the country. In many instances, individuals who are not citizens or nationals of the United States who have engaged in or are likely to engage in terrorist-related activities may be ineligible to receive visas or inadmissible for entry to the United States, or both. U.S. citizens returning to the United States from abroad are not subject to the admissibility requirements of the Immigration and Nationality Act, regardless of whether they are subjects of watchlist records. In general, these individuals only need to establish their U.S. citizenship to the satisfaction of the examining officer—by, for example, presenting a U.S. passport—to obtain entry into the United States. U.S. citizens are subjected to inspection by CBP before being permitted to enter and additional actions may be taken, as appropriate.

Weaknesses Exposed by the December 2009 Attempted Attack

On December 25, 2009, Umar Farouk Abdulmutallab, a 23-year old Nigerian man, attempted to detonate a concealed explosive device on Northwest Airlines Flight 253 en route from Amsterdam to Detroit as the plane descended into the Detroit Metropolitan Wayne County Airport.

According to the Executive Office of the President’s and Senate Select Committee on Intelligence’s inquiries into events that led to the attempted attack, failures across the intelligence community—including human errors, technical problems, and analytic misjudgments—contributed to the government’s failure to identify the subject as a threat that would qualify him for inclusion on the terrorist watchlist. The inquiries concluded that the intelligence community held information on Mr. Abdulmutallab—he was included in TIDE at the time of the attempted attack—but that it was fragmentary and ultimately not pieced together to form a coherent picture of the threat he posed (see fig. 1).

The government inquiries also raised issues regarding how agencies used and interpreted the 2009 watchlisting protocol for nominating individuals to the watchlist. For example, according to the Executive Office of the President’s review, although Mr. Abdulmutallab was entered into TIDE in November 2009, NCTC determined that the associated derogatory information did not meet the criteria for nominating him to the terrorist watchlist. Therefore, NCTC did not send the nomination to TSC. Also, according to the Senate Select Committee on Intelligence report, agencies may have interpreted the 2009 watchlisting protocol’s standards for placing individuals on the watchlist too rigidly, thereby preventing Mr. Abdulmutallab from being nominated for inclusion on the watchlist.

Under the auspices of the Information Sharing and Access Interagency Policy Committee, TSC—in coordination with watchlisting and screening agencies—reviewed the 2009 watchlisting protocol and made recommendations regarding whether adjustments to the protocol were warranted. The Deputies Committee—a senior interagency forum that considers policy issues affecting national security—initially approved new watchlisting guidance for issuance to the watchlisting and screening communities in May 2010. After a multiagency classification review was completed, the Deputies Committee approved a final version of the Watchlisting Guidance in July 2010, which TSC issued to the watchlisting and screening communities.

2010 Guidance Addresses Weaknesses in Nominations Process, but Agencies Face Challenges in Managing Increased Volumes of Information

Changes to Watchlisting Guidance and Impacts on Agencies

The July 2010 Watchlisting Guidance includes changes that were intended to address weaknesses in the nominations process that were exposed by the December 2009 attempted attack and to clarify how agencies are to nominate individuals to the watchlist. Since the guidance was approved, nominating agencies have expressed concerns about the increasing volumes of information and related challenges in processing this information and noted that the long-term impacts of the revisions may not be known for some time. For example, the watchlisting unit director from one agency reported that the agency is experiencing an increasing intake of information from its sources, which has impacted its analysts’ reviews of this information. Also, officials from some agencies reported that at times they have had to temporarily add personnel to review and process the large volumes of information.

Data from the nominating agencies we contacted show that the agencies sent more nominations-related information to NCTC after the attempted attack than before the attack. According to NCTC officials, the center experienced receiving an increase in nominations beginning in February 2010. The officials noted that in May 2010, the volume of incoming nominations exceeded NCTC’s ability to process it, resulting in a backlog. NCTC has applied additional resources—both staffing and technological—to address its backlog. As a result, in October 2011, NCTC officials noted that the center had virtually eliminated its backlog. Moreover, unless TSC has the ability to process the information it receives, it cannot add information to the TSDB for use by screening and law enforcement agencies. Overall, the volume of nominations TSC is receiving from the FBI and NCTC has generally increased since the attempted attack. According to TSC officials, the center has avoided backlogs by employing a variety of strategies to address its workload, including management of personnel resources and use of more advanced technology.

Since the December 25, 2009, attempted attack, agencies involved in the watchlist nominations process have pursued staffing, technology, working groups, and other solutions to strengthen the process and manage increasing volumes of information. Specifically, officials from four of the seven agencies we contacted reported that they are in the process of developing and implementing certain technological solutions to address watchlisting issues. For example, NCTC, in consultation with other members of the intelligence community, reported that it is developing information technology tools to strengthen analysts’ abilities to identify potential links to terrorism. The government has also created interagency working groups to address watchlist-related issues. Further, NCTC reported that training programs have been developed and administered to its watchlisting analysts, as well as nominating and screening agency personnel.

Our review of the July 2010 Watchlisting Guidance and discussions with relevant agency officials indicated that in drafting the guidance, the watchlist community emphasized quality-assurance mechanisms as well as civil rights and civil liberties protections that should be considered when nominating individuals.

Assessing Impacts of Guidance Could Help Ensure That Challenges Are Resolved and Inform Future Efforts to Strengthen the Watchlisting Process

While agencies are pursuing actions to strengthen the watchlisting process, no single entity is accountable for routinely assessing the overall impacts the July 2010 Watchlisting Guidance is having on the watchlisting community, the extent to which these impacts are acceptable and manageable from a policy perspective, and if the impacts indicate the need for any adjustments. Further, no entity is routinely collecting and analyzing data needed to conduct such governmentwide assessments over time. In general, officials from the nominating agencies we contacted and from NCTC and TSC said that they participated in developing the July 2010 Watchlisting Guidance and agreed with the changes, but noted that they did not know at the time how changes implemented through the 2010 guidance would impact them. Routinely assessing these impacts could help agencies address any challenges they are having in implementing the watchlisting guidance.

Agencies involved in the nominations process are taking actions to address challenges related to implementing the 2010 guidance. For example, officials from the Information Sharing and Access Interagency Policy Committee’s Subcommittee on Watchlisting noted that departments and agencies within the watchlisting community are responsible for assessing the impacts of their individual watchlisting efforts and for bringing issues, as needed, to the subcommittee. They explained that agencies react to and address issues and challenges as they arise. However, this approach has not allowed them to proactively and systematically assess the watchlisting process and identify emerging issues; achieve consensus on solutions to potential challenges before they manifest themselves; and determine if adjustments to the watchlisting guidance are needed.

Because of the collaborative nature of the watchlisting process, any assessment of impacts must be an interagency effort. However, none of the interagency entities we contacted were routinely performing these assessment functions. In February 2011, officials from the Subcommittee on Watchlisting noted that the subcommittee was preparing a report on watchlisting efforts since the December 2009 attempted attack and had requested that subcommittee members provide input. At that time, the subcommittee officials noted that the Information Sharing and Access Interagency Policy Committee did not plan to conduct routine assessments of the watchlisting processes. In August 2011, a representative of the National Security Staff informed us that the Information Sharing and Access Interagency Policy Committee recently began performing an assessment function related to the July 2010 Watchlisting Guidance. The representative noted that the depth and frequency of specific reviews will vary as necessary and appropriate. The staff did not provide us details on these efforts, so we could not determine to what extent the assessments will be routine or involve collecting and analyzing data needed to conduct such assessments over time.

Since we found no single entity that is responsible and accountable for routinely assessing the overall impacts the 2010 guidance is having on the watchlisting community—and collecting the data needed to conduct such assessments—the Assistant to the President for Homeland Security and Counterterrorism may be best positioned to ensure that governmentwide assessments are conducted. The President tasked this individual to be responsible and accountable for ensuring that agencies carry out actions to strengthen the watchlisting process after the December 2009 attempted attack. Thus, it likewise follows that this individual could be responsible and accountable for ensuring that the impacts from these actions are routinely assessed and that the results of the assessments are used to inform future watchlisting changes.

According to Standards for Internal Control in the Federal Government, ongoing monitoring of programs and activities should occur during the course of normal operations.appropriate agencies routinely evaluate or assess the impact of the 2010 guidance on the watchlisting community could help decision makers determine if the guidance is achieving its intended outcomes or needs any adjustments, and help inform future efforts to strengthen the watchlisting process. Such assessments could also help the Information Sharing and Access Interagency Policy Committee and the watchlisting community understand longer-term impacts of changes to the watchlisting guidance, such as how increasing volumes of information are creating resource demands. Finally, such assessments could help to improve transparency and provide an accurate accounting to the Executive Office of the President and other stakeholders, including Congress, for the resources invested in the watchlisting process.

The Number of Individuals on the Watchlist and Aviation-Related Subsets Increased after the Attempted Attack

Immediately after the December 2009 attempted attack, federal agencies took steps that resulted in an increase in the number of individuals in the TSDB and its aviation-related subsets—the No Fly and Selectee lists— based on new intelligence and threat information. Specifically, in the months following the attempted attack, agencies added these individuals to the TSDB from TIDE or from the TSDB to the No Fly or Selectee lists. Also, upon completion of this initiative, the number of U.S. persons on the No Fly List more than doubled and the number of U.S. persons on the Selectee List increased by about 10 percent. According to TSC data, the number of individuals on the No Fly List generally continued to increase during the remainder of 2010, while the number of individuals on the Selectee List remained relatively constant.

To carry out these upgrades, TSC and NCTC—at the direction of the Deputies Committee and in consultation with other intelligence agencies—reviewed available intelligence and threat information that existed on certain individuals. At the same time, TSC worked with NCTC and intelligence community agencies to ensure that (1) the information that supported changing the watchlist status of the individuals was as complete and accurate as possible and (2) the individuals were placed in the TSDB and, when applicable, on the No Fly or Selectee lists, in accordance with standards and criteria for inclusion on these lists.

Screening Agencies Are Addressing Vulnerabilities Exposed by the Attempted Attack, but Assessing Their Impacts Could Help Inform Future Efforts

Agencies that screen individuals against TSDB records are addressing vulnerabilities and gaps in processes that were exposed by the December 2009 attempted attack to enhance homeland security. For example, TSA actions have resulted in more individuals being denied boarding aircraft or subjected to enhanced screening before boarding. The number of U.S. persons (U.S. citizens and lawful permanent residents) denied boarding has also increased and, for such persons abroad, required the government to develop procedures to facilitate their return. TSA is also screening airline passengers against additional TSDB records to mitigate risks. CBP has implemented a program to build upon its practice of evaluating the risk posed by individuals attempting to enter the United States before they board flights bound for the United States. As a result, air carriers have permitted fewer individuals in the TSDB to board such flights, particularly nonimmigrant aliens. State took actions to revoke hundreds of U.S. visas immediately after the attempted attack because it determined that the individuals could present an immediate threat. These and other agency actions are intended to enhance homeland security, but no entity is routinely assessing governmentwide issues, such as how the changes have impacted agency resources and the traveling public, whether watchlist screening is achieving intended results, or if adjustments to agency programs or the watchlisting guidance are needed.

TSA Has Encountered More Individuals on the No Fly and Selectee Lists and Is Screening against More Watchlist Records

No Fly and Selectee List Encounters

After the attempted attack, TSA continued implementation of the Secure Flight program, which enabled TSA to assume direct responsibility for determining if individuals are matches to the No Fly or Selectee lists from air carriers. Secure Flight requires that air carriers collect—and that passengers provide—full name and date-of-birth and gender information, thereby improving TSA’s ability to correctly determine whether individuals are on these lists. Before Secure Flight, air carriers were not required to collect date-of-birth and gender information, and each airline conducted watchlist matching differently with varying effectiveness. According to TSA, the increase in individuals added to the No Fly and Selectee lists, combined with the implementation of Secure Flight, resulted in an increase in the number of times airlines encountered individuals on these lists. TSA data show that the encounters involved both domestic flights (flights to and from locations within the United States) and international flights (flights to or from the United States or over U.S. air space).

Since the December 2009 attempted attack and subsequent increase in the number of U.S. persons nominated to and placed on the No Fly List, there have been instances when U.S. persons abroad have been unable to board an aircraft bound for the United States. Any individual— regardless of nationality—can be prohibited from boarding an aircraft if the threat represented by the individual meets the criteria for inclusion on the No Fly List. In general, however, U.S. citizens are permitted to enter the United States at a U.S. port of entry if they prove to the satisfaction of a CBP officer that they are in fact U.S. citizens. Lawful permanent residents, who in limited circumstances independent of the No Fly List may be rendered an applicant for admission, are usually entitled to removal proceedings prior to having their status as a lawful permanent resident terminated for immigration purposes.

In our October 2007 watchlist report, we recommended that DHS assess to what extent security risks exist by not screening against more watchlist records and what actions, if any, should be taken in response. DHS generally agreed with our recommendation but noted that increasing the number of records that air carriers used to screen passengers would expand the number of misidentifications to unjustifiable proportions without a measurable increase in security. In general, misidentifications occur when a passenger’s name is identical or similar to a name in the TSDB but the passenger is not the individual on the watchlist. Since then, TSA assumed direct responsibility for this screening function through implementation of the Secure Flight program for all flights traveling to, from, or within the United States. According to TSA, Secure Flight’s full assumption of this function from air carriers and its use of more biographic data for screening have improved watchlist matching. This includes TSA’s ability to correctly match passenger data against TSDB records to confirm if individuals match someone on the watchlist and reduce the number of misidentifications. Appendix III contains additional information on how Secure Flight has reduced the likelihood of passengers being misidentified as being on the watchlist and related inconveniences.

TSA’s actions discussed below fully respond to the recommendation we made in our October 2007 report. Specifically, TSA has implemented Secure Flight such that as circumstances warrant, it may expand the scope of its screening beyond the No Fly and Selectee lists to the entire TSDB. According to the program’s final rule, in general, Secure Flight is to compare passenger information only to the No Fly and Selectee lists because, during normal security circumstances, screening against these components of the TSDB will be satisfactory to counter the security threat. However, the rule also provides that TSA may use the larger set of “watch lists” maintained by the federal government when warranted by security considerations, such as if TSA learns that flights on a particular route may be subject to increased security risk.

Also, after the attempted bombing in December 2009, DHS proposed and the Deputies Committee approved the Secure Flight program’s expanded use of TSDB records on a routine basis to screen passengers before they board flights. In April 2011, TSA completed the transition of the Secure Flight program to conduct watchlist matching against this greater subset of TSDB records and notify air carriers that those passengers who are determined to be a match should be designated for enhanced screening prior to boarding a flight. According to TSA, the impact on screening operations has been minimal given the relatively low volume of matches against these additional records each day.

TSA noted that the entire TSDB is not used for screening since matching passenger data against TSDB records that contain only partial data could result in a significant increase in the number of passengers who are misidentified as being on the watchlist and potentially cause unwarranted delay or inconvenience to travelers. TSA also noted that as with potential misidentifications to the No Fly and Selectee lists, passengers who feel that they have been incorrectly delayed or inconvenienced can apply for redress through the DHS Traveler Redress Inquiry Program (DHS TRIP). DHS noted that TSA regularly monitors the Secure Flight program and processes and makes adjustments as needed.

In fiscal year 2011, TSA reprogrammed $15.9 million into Secure Flight to begin screening against the additional TSDB records. TSA’s fiscal year 2012 budget request proposed funding to make screening against the additional records permanent. According to TSA, for fiscal year 2012, Secure Flight requested an increase of $8.9 million and 38 full-time personnel to continue supporting this expanded screening effort. According to TSA, the funding will be used for information technology enhancements that will be required to implement this expanded screening and will allow TSA to handle the increased workload.

CBP Expansion of PreDeparture Vetting Has Kept Hundreds More Aliens in the TSDB off Airplanes Bound for the United States

For individuals traveling by air to the United States, CBP has established programs whereby it assesses individuals before they board an aircraft to determine whether it is likely they will be found inadmissible at a port of entry. The following sections discuss how CBP’s Pre-Departure Targeting Program and Immigration Advisory Program handle the subset of travelers who are in the TSDB. Other high-risk and improperly documented passengers handled by these programs include passengers who have criminal histories; have had their visas revoked; are in possession of fraudulent, lost, or stolen passports; or otherwise appear to be inadmissible.

In response to the attempted attack in December 2009, and as part of its border and immigration security mission, CBP implemented the Pre- Departure Targeting Program in January 2010 to build upon its process of assessing if individuals would likely be found inadmissible at a port of entry before they board an aircraft to cover all airports worldwide with direct flights to the United States. Before the attempted attack, CBP assessed individuals who were departing from airports that had CBP Immigration Advisory Program officers on site. At airports without such a program, passengers in the TSDB but not on the No Fly List generally were allowed to board flights and travel to U.S. airports. Upon arrival at a U.S. port of entry, CBP would inspect the passengers and determine their admissibility. CBP continues to assess passengers through the Immigration Advisory Program for flights departing from airports that have a program presence.

For both the Pre-Departure Targeting Program and the Immigration Advisory Program, if CBP determines that a passenger would likely be deemed inadmissible upon arrival at a U.S. airport, it recommends that the air carrier not board that passenger (that is, it makes a no board recommendation). CBP generally makes these no board recommendations based on provisions for admissibility found in the Immigration and Nationality Act. U.S. citizens are generally not subject to these recommendations since they are generally permitted to enter the United States at a U.S. port of entry if they prove to the satisfaction of a CBP officer that they are in fact U.S. citizens. CBP may also decide to not issue such recommendations for aliens in the TSDB if, for example (1) CBP officers determine that, based on a review of all available information, the individual is not likely to be denied admission to the United States, or (2) the individual was granted a waiver of inadmissibility by DHS, if such a waiver is available.

For flights departing from airports without an Immigration Advisory Program officer on site, CBP is leveraging the capabilities of its officers within its Regional Carrier Liaison Groups to issue no board recommendations to air carriers. These groups were established in 2006 to assist air carriers with U.S. entry-related matters—with a primary focus on verifying the authenticity of travel documents—and to work directly with commercial air carriers on security-related matters. Regional Carrier Liaison Group staff who are located in the United States handle Pre- Departure Targeting Program no board recommendations to air carriers remotely by delivering the recommendations via phone, fax, or e-mail. CBP policy instructs staff to give no board recommendations priority over other duties, given the time and security sensitivities involved.

There are three Regional Carrier Liaison Groups, which are located in Honolulu, Hawaii; Miami, Florida; and New York City, New York. Each of the three locations has authority over a region of the world, with the Honolulu location covering U.S.-bound flights from Asia and the Pacific; the New York City location covering flights from Africa, Europe, and the Middle East; and the Miami location covering flights from Latin America and the Caribbean.

United States who does not have a valid passport and visa, if a visa is required. When CBP does not recommend that an individual in the TSDB be denied boarding and the passenger boards a flight bound for the United States, CBP inspects the passenger upon arrival at a U.S. airport. For aliens seeking admission to the United States, determinations on admissibility are generally made by CBP officers during this inspection in accordance with applicable provisions of the Immigration and Nationality Act. In general, aliens who are deemed inadmissible are detained by DHS until the individual can board a return flight home.

Since the attempted attack, CBP predeparture vetting programs—the Pre-Departure Targeting Program and the Immigration Advisory Program—have resulted in hundreds more aliens being kept off flights bound for the United States because CBP determined that they likely would be deemed inadmissible upon arrival at a U.S. airport and made corresponding no board recommendations to air carriers. In addition to the increase in no board recommendations that resulted from implementing the Pre-Departure Targeting Program in January 2010, the increase during 2010 was in response to the new threats made evident by the attempted attack, according to CBP officials. CBP data also show that there have been instances when individuals have boarded flights bound for the United States and arrived at U.S. airports. According to CBP officials, the vast majority of these cases involved either (1) U.S. citizens and lawful permanent residents who generally may enter the United States, and therefore, CBP generally does not recommend that air carriers not board these passengers, or (2) aliens in the TSDB who were deemed inadmissible but were granted temporary admission into the United States under certain circumstances, such as DHS granting a waiver of inadmissibility.

At the time of our review, CBP did not have readily available data on how often aliens in the TSDB boarded flights bound for the United States— information that could help CBP assess how its predeparture programs are working and provide transparency over program results, among other things. According to CBP officials, the agency was working on adding data fields to CBP systems to capture more information related to these programs. The officials noted that these changes will allow CBP to break down and retrieve data by U.S. citizens, lawful permanent residents, and aliens, and that related reports will be produced. At our request, CBP conducted a manual review of data it compiled on the results of its processing of passengers at U.S. airports from April 2010 through September 2010. During this period, CBP data show that there were instances when aliens in the TSDB boarded flights bound for the United States and were admitted into the country. These occurrences are in addition to instances where aliens in the TSDB were able to board flights bound for and enter the United States because they had been granted admission to the country on a temporary basis under certain circumstances, such as by DHS granting a waiver of inadmissibility. According to CBP officials, for each of these occurrences, CBP officers determined—based on a review of all available and relevant information—that the derogatory information on the individual was not sufficient to render that person inadmissible under the Immigration and Nationality Act.

CBP officials stated that the Pre-Departure Targeting Program increased the workload for Regional Carrier Liaison Group staff and that two of the three groups increased the number of CBP officers assigned to handle this workload. facility that supports these programs experienced increased workloads, which they handled through additional hiring, overtime hours, and assignment of temporary duty personnel.

Regional Carrier Liaison Group positions are not specifically funded but are staffed from existing CBP port personnel, with CBP port management determining the staffing levels required at each location. individual any law enforcement sensitive information. Rather, the CBP officers or air carrier personnel are to advise the individual to go to the U.S. consulate or the person’s home country passport office, as appropriate, to address the issue. CBP officials also noted that individuals who have travel-related concerns are advised to file an inquiry through DHS TRIP. According to DHS TRIP officials, about 20 percent of all requests for redress that it receives involve CBP inspections conducted at land, sea, or air ports of entry.

State Revoked Hundreds of Visas Held by Individuals on the Watchlist after the Attempted Attack

State Revoked Hundreds of Visas after Attempted Attack

After the December 2009 attempted attack, the Executive Office of the President directed TSC to determine the visa status of all known or suspected terrorists in the TSDB. TSC then worked with State to determine whether individuals who held U.S. visas should continue holding them in light of new threats made evident by the incident. Specifically, in January 2010, State revoked hundreds of visas because it determined that the individuals could present an immediate threat to the United States. State officials noted that these revocations were largely related to individuals who were added to the TSDB—or moved to the No Fly or Selectee lists—after the attempted attack based on new intelligence and threat information.

In March 2010, TSC and State initiated another review and identified hundreds of cases in which individuals in the TSDB held U.S. visas. These cases included individuals who were in the TSDB at the time of the December 2009 attempted attack but did not have their visas revoked during the January 2010 review. According to State officials, all individuals who could present an immediate threat to the United States had their visas revoked within 24 hours. In cases involving a less clear nexus to terrorism, the officials noted that visas were not immediately revoked. The officials explained that investigating these cases can take several months and involve extensive coordination with law enforcement and intelligence officials. According to State officials, of these remaining cases, the department revoked a number of visas based on intelligence community recommendations and determined that other visas had been issued properly following the completion of an interagency review process and, in applicable cases, ineligibility waivers provided by DHS.

Regarding the cases in which State determined that individuals could continue to hold visas, State officials noted that an individual’s presence in the TSDB does not itself render that person ineligible for a visa. For example, State will issue a visa if it determines that the available information supporting the TSDB record does not meet the statutory conditions under which an individual may be deemed ineligible for a visa to the United States, and the individual is not otherwise ineligible for a visa. The officials added that in those instances where State finds that an individual is ineligible for a visa—based on provisions in the Immigration and Nationality Act that define terrorist activities—the department may still, in certain circumstances, issue a visa if DHS agrees to grant a waiver of inadmissibility, if such a waiver is available. According to State officials, reasons an individual found ineligible for a visa may receive a waiver include significant or compelling U.S. government interests or humanitarian concerns. According to State officials, while the department consulted with law enforcement and intelligence community officials regarding whether to revoke the visas, State has final authority over all visa decisions.

In addition to the hundreds of visa revocations involving individuals in the TSDB that were related to the reviews directed by the Executive Office of the President, State data show that the department revoked hundreds more visas based on terrorism-related grounds during 2010. The total number of visas State revoked during 2010 was more than double the number of visas the department revoked based on terrorism-related grounds during 2009. According to State, as of May 2011, a number of individuals in the TSDB continued to hold U.S. visas because the department found that (1) they were ineligible to hold a visa under the terrorism-related provisions of the Immigration and Nationality Act but received waivers of that ineligibility or (2) they were not ineligible to hold visas under the terrorism-related provisions of the act following standard interagency processing of the visa applications.

Under current procedures, State screens visa applicant data against sensitive but unclassified extracts of biographical information drawn from TSDB records as part of its evaluation process for issuing U.S. visas. If an applicant for a visa is identified as a possible match with a TSDB record, consular officers are to initiate a process to obtain additional information on the individual’s links to terrorism, including information maintained by law enforcement and intelligence agencies. State data show that the department denied about 55 percent more nonimmigrant visas based on terrorism-related grounds during 2010 than it did during 2009, which includes denials involving individuals in the TSDB. Further, State found that in cases where individuals were ineligible to hold nonimmigrant visas based on terrorism-related grounds—but evinced significant or compelling U.S. government interest or humanitarian concern—the department recommended, and DHS granted, waivers of ineligibility.

According to State officials, the department’s automated systems do not capture data on the number of individuals in the TSDB who applied for visas—or the related outcomes of these applications (e.g., issued or denied)—because this information is not needed to support the department’s mission. State officials noted that it would be costly to change department databases to collect information specific to individuals applying for visas who are in the TSDB, but the department is working with TSC on a process to make these data more readily available through other means. State is also partnering with other agencies to develop a new, more automated process for reviewing visa applications that is intended to be more efficient than the current process. The new process is also intended to help minimize the inconvenience of protracted visa processing times for applicants incorrectly matched to TSDB records, among other things.

Assessing Outcomes and Impacts of Screening and Vetting Agency Programs Could Help Ensure That the Watchlist Is Achieving Intended Results

Since the December 2009 attempted attack, agencies have taken actions to strengthen their respective processes for screening and vetting individuals against TSDB records. However, no entity has acknowledged that it is responsible and accountable for routinely conducting governmentwide assessments of how agencies are using the watchlist to make screening or vetting decisions and related outcomes or the overall impact screening or vetting programs are having on agency resources and the traveling public. Also, no entity is assessing whether watchlist- related screening or vetting is achieving intended results from a policy perspective, or if adjustments to agency programs or the watchlisting guidance are needed. Further, no entity is routinely collecting and analyzing data needed to conduct such governmentwide assessments over time. According to the TSC Director, conducting such assessments and developing related metrics will be important in the future.

The actions screening and law enforcement agencies have taken since the attempted attack have resulted in more individuals in the TSDB being denied boarding flights, being deemed inadmissible to enter the United States, and having their U.S. visas revoked, among other things. These outcomes demonstrate the homeland security benefits of watchlist-related screening or vetting, but such screening or vetting and related actions have also had impacts on agency resources and the traveling public. For example, new or expanded screening and vetting programs have required agencies to dedicate more staff to check traveler information against TSDB records and take related law enforcement actions. Also, any new or future uses of the watchlist for screening or vetting may result in more individuals being misidentified as the subject of a TSDB record, which can cause traveler delays and other inconveniences. Agencies are independently taking actions to collect information and data on the outcomes of their screening or vetting programs that check against TSDB records, but no entity is routinely assessing governmentwide issues, such as how U.S. citizens and lawful permanent residents are being affected by screening or the overall levels of misidentifications that are occurring. Routinely assessing these outcomes and impacts governmentwide could help decision makers determine if the watchlist is achieving its intended results without having unintended consequences or needs further revisions.

Because watchlist-related screening or vetting is a governmentwide function, any effort to assess the overall outcomes and impacts must be an interagency effort. The federal government has established interagency working groups to address screening and related issues. However, according to agency officials we contacted, these groups have not conducted governmentwide assessments because they have been focused on implementing new or expanding screening or vetting programs and revising related policies and procedures, among other things.

Similar to watchlisting issues, in August 2011, a representative of the National Security Staff informed us that the Information Sharing and Access Interagency Policy Committee recently began performing an assessment to support its oversight of new screening processes. The representative noted that the depth and frequency of specific reviews will vary as necessary and appropriate. The staff did not provide us details on these efforts, so we could not determine to what extent the assessments will be routine or involve collecting and analyzing data needed to conduct such governmentwide assessments over time. As discussed previously, the President tasked the Assistant to the President for Homeland Security and Counterterrorism to be responsible and accountable for ensuring that agencies carry out actions to strengthen the watchlisting process after the December 2009 attempted attack. As such, the Assistant to the President may be best positioned to ensure that governmentwide assessments of the outcomes and impacts of agency screening programs are conducted.

According to Standards for Internal Control in the Federal Government, ongoing monitoring of programs and activities should occur during the course of normal operations. These standards also note that performance data on agency programs be available as a means to hold public service organizations accountable for their decisions and actions, including stewardship of public funds, fairness, and all aspects of performance.

Routine, governmentwide assessments of screening agency programs could help the government determine if the watchlist is achieving its intended results, identify broader issues that require attention, and improve transparency and provide an accurate accounting to the Executive Office of the President and other stakeholders, including Congress, for the resources invested in screening processes.

Conclusions

The attempt on December 25, 2009, to detonate a concealed explosive on board a U.S.-bound aircraft highlights the importance of the U.S. government placing individuals with known or suspected ties to terrorism on its watchlist. The Executive Office of the President’s review of the attempted attack found that the U.S. government had sufficient information to have uncovered and potentially disrupted the attempted attack, but shortcomings in the watchlisting process prevented the attempted bomber from being nominated for inclusion on the watchlist. The July 2010 Watchlisting Guidance includes changes that were intended to address weaknesses in the nominations process. Since the guidance was approved, agencies have expressed concerns about the increasing volumes of information and related challenges in processing this information. The federal entities involved in the nominations process are taking actions to address challenges related to implementing the guidance. However, no single entity is routinely assessing the overall impacts of the watchlisting guidance or the steps taken to strengthen the nominations process. Working collaboratively to ensure that the watchlisting community periodically evaluates or assesses the impacts of the revised guidance on the watchlisting community could (1) help decision makers determine if the guidance is achieving its intended outcomes or needs any adjustments, (2) inform future efforts to strengthen the watchlisting process, (3) help the watchlisting community understand longer-term impacts of changes to the watchlisting guidance, and (4) improve transparency and provide an accurate accounting to the Executive Office of the President and other stakeholders, including Congress, for the resources invested in the watchlisting process.

Just as agencies are not routinely assessing the impacts of the revisions made to the watchlisting guidance or the steps taken to strengthen the nominations process, no single entity is routinely assessing information or data on the collective outcomes or impacts of agencies’ watchlist screening operations to determine the effectiveness of changes made to strengthen screening since the attempted attack or how changes to the watchlisting guidance have affected screening operations. Routine, governmentwide assessments of the outcomes and impacts of agencies’ watchlist screening or vetting programs could help ensure that these programs are achieving their intended results or identify if revisions are needed. Such assessments could also help identify broader issues that require attention, determine if impacts on agency resources and the traveling public are acceptable, and communicate to key stakeholders how the nation’s investment in the watchlist screening or vetting processes is enhancing security of the nation’s borders, commercial aviation, and other security-related activities.

Recommendations for Executive Action

To help inform future efforts to strengthen watchlisting and screening processes, we recommend that the Assistant to the President for Homeland Security and Counterterrorism establish mechanisms or use existing interagency bodies to routinely assess how the watchlisting guidance has impacted the watchlisting community—including its capacity to submit and process nominations in accordance with provisions in the guidance—and whether any adjustments to agency programs or the guidance are needed, and whether use of the watchlist during agency screening processes is achieving intended results, including whether the overall outcomes and impacts of screening on agency resources and the traveling public are acceptable and manageable or if adjustments to agency programs or the watchlisting guidance are needed.

Agency Comments

We provided a draft of the classified version of this report for comment to the National Security Staff; the Office of the Director of National Intelligence; the Departments of Defense, Homeland Security, Justice, and State; and the CIA. In its written comments, DHS noted that it appreciated the report’s identification of enhancements the department has made to several screening programs to address vulnerabilities exposed by the December 25, 2009, attempted attack, including actions taken by CBP and TSA. DHS also noted that it is committed to working with interagency stakeholders, including the Interagency Policy Committee, to ensure that its use of the watchlist in its screening programs is achieving intended results. DHS also provided technical comments, in addition to its written comments. National Security Staff; the Office of the Director of National Intelligence; and the Departments of Defense, Justice, and State did not provide written comments to include in this report, but provided technical comments, which we have incorporated in this report where appropriate. The CIA did not provide any comments.

We are sending copies of this report to National Security Staff; the Attorney General; the Secretaries of the Departments of Defense, Homeland Security, and State; the Directors of National Intelligence and Central Intelligence; and appropriate congressional committees. This report is also available at no charge on the GAO website at http://www.gao.gov.

Should you or your staff have any questions about this report, please contact Eileen R. Larence at (202) 512-6510 or larencee@gao.gov. Key contributors to this report are acknowledged in appendix V. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report.

Appendix I: Objectives, Scope, and Methodology

Objectives

Our reporting objectives were to determine (1) the actions the federal government has taken since the December 25, 2009, attempted attack to strengthen the watchlist nominations process, the extent to which departments and agencies are experiencing challenges in implementing revised watchlisting guidance, and the extent to which agencies are assessing impacts of the actions they have taken; (2) how the composition of the watchlist has changed as a result of actions taken by departments and agencies after the attempted attack; and (3) how screening and law enforcement agencies are addressing vulnerabilities exposed by the attempted attack as well as the outcomes of related screening, and to what extent federal agencies are assessing the impacts of this screening.

Scope and Methodology

In general, we focused on the federal entities that were tasked by the Executive Office of the President to take corrective actions after the attempted attack: the Department of Homeland Security (DHS); Department of Justice’s Federal Bureau of Investigation (FBI) and Terrorist Screening Center (TSC); Department of State (State); Department of Defense; Office of the Director of National Intelligence’s National Counterterrorism Center (NCTC); Central Intelligence Agency (CIA); and Executive Office of the President’s National Security Staff.

Watchlist Nominations Process

To determine actions the federal government has taken to strengthen the watchlist nominations process, we analyzed postattack government reports, including reports issued by the Executive Office of the President and the Senate Select Committee on Intelligence. We analyzed the Watchlisting Guidance that was approved in July 2010 and compared it to the February 2009 watchlisting protocol—the last version that was published before the attempted attack—to identify changes that were intended to strengthen agencies’ abilities to nominate known or suspected terrorist to the watchlist. We interviewed officials from five entities that nominate individuals for inclusion on the terrorist watchlist, as well as NCTC’s Deputy Director for the Terrorist Identities and TSC’s Director. We also met with officials from the Executive Office of the President’s Information Sharing and Access Interagency Policy Committee and its Subcommittee on Watchlisting, which provides an interagency forum to which agencies can bring watchlist-related issues for discussion and resolution.

To identify to what extent agencies are experiencing challenges implementing changes to the watchlisting guidance, we analyzed data and documentation provided by seven federal entities involved in the nominations process—such as nominations data for the period January 2009 through May 2011—as well as the congressional testimony of NCTC, TSC, and FBI leadership and program directors. We also interviewed the watchlisting unit directors and program staff at each of the five nominating agencies, NCTC’s Deputy Director for the Terrorist Identities, and the TSC Director to discuss their nominations processes, the number of nominations they send to NCTC, and how, if at all, the changes to the nominations process have created challenges for each agency.

To determine to what extent agencies are assessing for the impacts of the actions they have taken, we interviewed officials from five federal entities who participate in the Information Sharing and Access Interagency Policy Committee’s Subcommittee on Watchlisting and related working groups.

Composition of the Watchlist

To identify how the composition of the watchlist has changed since the attempted attack, we reviewed TSC data from late December 2009 through March 2010 on the number of individuals who were added to TSC’s Terrorist Screening Database and its subset No Fly and Selectee lists that are used to screen airline passengers before boarding, and related efforts to determine whether the individuals should remain on these lists. To identify broader trends in the size and composition of the watchlist and subset lists, we reviewed TSC monthly data for 2009 and 2010 on the number of individuals on these lists, including U.S. citizens and lawful permanent residents. We also determined how the revised watchlisting guidance has impacted the size of these lists. Further, we interviewed senior-level officials from TSC and NCTC to identify factors that contributed to trends in the size of the lists during 2009 and 2010, and to obtain their perspectives on how changes in the watchlist guidance had impacted growth in the lists.

Screening and Law Enforcement Agency Actions

To identify how screening and law enforcement agencies have addressed vulnerabilities exposed by the attempted attack and how they are assessing the outcomes and impacts of screening or vetting, we focused on the departments and agencies that use the watchlist to screen individuals traveling to the United States—the Transportation Security Administration (TSA), which screens passengers before they board aircraft; U.S. Customs and Border Protection (CBP), which inspects travelers to determine their admissibility into the United States; and State, which screens individuals who apply for U.S. visas.

To determine agency actions to address vulnerabilities in screening or vetting and related outcomes, we analyzed TSA, CBP, and State documentation—such as documents that discuss new or expanded screening programs—as well as testimonies and inspector general reports. We obtained data—generally for 2009 and 2010 but in some cases through May 2011—on how often these agencies have encountered individuals on the watchlist and the outcomes of these encounters to help determine what impact changes in agency screening or vetting procedures has had on operations and the traveling public, among other things. We also interviewed senior-level officials from these agencies; these interviews included discussions about how agencies’ screening or vetting procedures have changed since the attempted attack and how they are assessing the impacts of the changes. Further, to better understand the impacts of watchlist screening or vetting on the traveling public, we analyzed data for 2009 and 2010 on individuals who had inquiries or sought resolution regarding difficulties they experienced during their travel-related screening or inspection and interviewed DHS officials who are responsible for providing redress for these individuals. Regarding federal government efforts to assess the outcomes and impacts of actions agencies have taken to strengthen screening or vetting processes since the December 2009 attempted attack, we obtained information on the extent to which federal monitoring activities and practices are consistent with GAO’s Standards for Internal Control in the Federal Government.

To assess the reliability of data on watchlist nominations, number of watchlist records in databases, and screening outcomes, we interviewed knowledgeable officials about the data and the systems that produced the data, reviewed relevant documentation, examined data for obvious errors, and (when possible) corroborated the data among the different agencies. We determined that the data were sufficiently reliable for the purposes of this report. We conducted this performance audit from February 2010 to May 2012 in accordance with generally accepted government auditing standards. to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

We issued a classified report on this work in December 2011.

Appendix II: Overview of the Watchlist Nominations Process

Pursuant to Homeland Security Presidential Directive 6, the Terrorist Screening Center (TSC) was established to develop and maintain the U.S. government’s consolidated watchlist—the Terrorist Screening Database (TSDB)—and to provide for the use of watchlist records during security-related screening processes. The watchlisting and screening processes are intended to support the U.S. government’s efforts to combat terrorism by consolidating the terrorist watchlist and providing screening and law enforcement agencies with information to help them respond appropriately during encounters with known or suspected terrorists, among other things.

TIDE is the U.S. government’s central repository of information on known or suspected international terrorists and is maintained by NCTC. benefit, false documentation or identification, weapons, explosives, or training; or are members of or represent a foreign terrorist organization.

In general, nominating agencies submit terrorism-related information to NCTC to add information to existing records in TIDE as well as to nominate new individuals to be included in TIDE, with the additional purpose of nominating known or suspected terrorists to the TSDB. Nominations are to include pertinent derogatory information and any biographic information—such as name and date of birth—needed to establish the identity of individuals on the watchlist.

The FBI provides TSC with information about known or suspected domestic terrorists. According to the FBI’s Domestic Terrorist Operations Unit, domestic terrorists engage in activities that (1) involve acts dangerous to human life that are a violation of the criminal laws of the United States or any state; (2) appear to be intended to intimidate or coerce a civilian population, influence the policy of a government by intimidation or coercion, or affect the conduct of a government by mass destruction, assassination, or kidnapping; and (3) occur primarily within the jurisdiction of the United States.

In general, the FBI nominates individuals who are subjects of ongoing FBI counterterrorism investigations to TSC for inclusion in the TSDB, including persons the FBI is preliminarily investigating to determine if they have links to terrorism. In determining whether to open an investigation, the FBI uses guidelines established by the Attorney General, which contain specific standards for opening investigations. The FBI also has a process for submitting requests to NCTC to nominate known or suspected international terrorists who are not subjects of FBI investigations.

In accordance with Homeland Security Presidential Directive 6—and built upon through Homeland Security Presidential Directives 11 and 24—the TSDB is to contain information about individuals known or suspected to be or have been engaged in conduct constituting, in preparation for, in aid of, or related to terrorism and terrorist activities. NCTC and the FBI apply a reasonable-suspicion standard to determine which individuals are appropriate for inclusion in the TSDB. Determining whether individuals meet this standard, however, can involve some level of subjectivity. NCTC and the FBI are to consider information from all available sources and databases—including information forwarded by nominating agencies as well as information in their own holdings—to determine if there is a reasonable suspicion of links to terrorism that warrants a nomination.

Once NCTC and the FBI determine that an individual meets the reasonable-suspicion standard and that minimum biographic information exists, they extract sensitive but unclassified information on the individual’s identity—such as name and date of birth—from their classified databases and send the information to TSC. TSC reviews these nominations—evaluating the derogatory and biographic information, in accordance with the watchlisting guidance—to determine whether to add nominated individuals to the TSDB. As TSC adds individuals to the watchlist, the list may include persons with possible ties to terrorism in addition to people with known links, thereby establishing a broad spectrum of individuals who are considered known or suspected terrorists. Figure 2 provides an overview of the process used to nominate individuals for inclusion in the TSDB.

Consistent with Homeland Security Presidential Directive 6, to ensure that watchlist information is current, accurate, and complete, nominating agencies generally are to provide information to remove an individual from the watchlist when it is determined that no nexus to terrorism exists.

To support agency screening or law enforcement processes, TSC sends applicable records from the TSDB to screening or law enforcement agency systems for use in efforts to deter or detect the movement of known or suspected terrorists. For instance, applicable TSC records are provided to TSA for use in screening airline passengers, to U.S. Customs and Border Protection (CBP) for use in vetting and inspecting persons traveling to and from the United States, and to State for use in screening visa applicants. Regarding individuals who are not citizens or nationals of the United States seeking travel to and entry into the United States, screening and law enforcement agencies rely on immigration laws that specify criteria and rules for deciding whether to issue visas to individuals or to admit them into the country. In many instances, individuals who are not citizens or nationals of the United States who have engaged in or are likely to engage in terrorist-related activities may be ineligible to receive visas or inadmissible for entry to the United States, or both. If a foreign citizen is lawfully admitted into the United States—either permanently or temporarily—and subsequently engages in or is likely to engage in a terrorist activity, the individual, in certain circumstances, may be removed to his or her country of citizenship. U.S. citizens returning to the United States from abroad are not subject to the admissibility requirements of the Immigration and Nationality Act, regardless of whether they are subjects of watchlist records. In general, these individuals only need to establish their U.S. citizenship to the satisfaction of the examining officer—by, for example, presenting a U.S. passport—to obtain entry into the United States. U.S. Citizens are subject to inspection by CBP before being permitted to enter, and additional actions may be taken, as appropriate.

Appendix III: Transportation Security Administration’s Secure Flight Program and Related Activities

This appendix presents an overview of the Transportation Security Administration’s (TSA) Secure Flight program, which began implementation before the December 25, 2009, attempted attack and is a key part of TSA’s efforts to address vulnerabilities that were exposed by the incident. This appendix also discusses how the program has reduced the likelihood of passengers misidentified as being on the watchlist and provides an update on the status of TSA efforts to validate the information that passengers report when making a reservation that is used in the watchlist-matching process.

Secure Flight Overview

The matching of airline passenger information against terrorist watchlist records is a frontline defense against acts of terrorism that target the nation’s civil aviation system. In general, passengers identified by the TSA as a match to the No Fly List are prohibited from boarding flights to, from, and within the United States, while those matched to the Selectee List are required to undergo additional screening prior to boarding such flights. Historically, airline passenger prescreening was performed by air carriers pursuant to federal requirements. However, in accordance with the Intelligence Reform and Terrorism Prevention Act of 2004, TSA developed an advanced passenger prescreening program known as Secure Flight that enabled TSA to assume from air carriers the function of watchlist matching.

Secure Flight is intended to eliminate inconsistencies in passenger watchlist matching procedures conducted by air carriers and use a larger set of watchlist records when warranted, reduce the number of individuals who are misidentified as being on the No Fly or Selectee lists, reduce the risk of unauthorized disclosure of sensitive watchlist information, and integrate information from DHS’s redress process into watchlist matching so that individuals are less likely to be improperly or unfairly delayed or prohibited from boarding an aircraft.

In January 2009, the Secure Flight program began initial operations— assuming the watchlist-matching function for a limited number of domestic flights for one airline—and subsequently phased in additional flights and airlines. TSA completed assumption of this function for all domestic and international flights operated by U.S. air carriers in June 2010 and completed assumption of this function for covered foreign air carriers flying to and from the United States in November 2010.

Secure Flight Has Reduced Misidentifications

Since the December 2009 attempted attack, TSA has completed its assumption of the watchlist-matching function from air carriers—under the Secure Flight program—which has reduced the likelihood of passengers misidentified as being on the watchlist. According to TSA data, Secure Flight is consistently clearing over 99 percent of passengers automatically (less than 1 percent of passengers are being misidentified as being on the No Fly List or Selectee List). When misidentifications occur, a passenger may not be able to print a boarding pass from a computer or an airport kiosk. Rather, the individual may have to go to the airline ticket counter to provide identifying information that is used to determine if the person is a positive match to the No Fly List or Selectee List. Before Secure Flight, more passengers had to go through this process to verify their identities, since each airline conducted watchlist matching differently with varying effectiveness.

The Secure Flight program increases the effectiveness of watchlist matching, applying an enhanced watchlist-matching system and process consistently across the airline industry. Under Secure Flight, air carriers are required to (1) collect full name and date-of-birth and gender information from airline passengers and (2) be capable of collecting redress control numbers from passengers.helps reduce misidentifications. According to TSA, Secure Flight is required to submit an annual report to the Office of Management and Budget certifying that the program has met its baseline goal for reducing misidentifications.

Further, people who have been denied or delayed airline boarding, have been denied or delayed entry into or exit from the United States at a port of entry or border crossing; or have been repeatedly referred to additional (secondary) inspection can file an inquiry to seek redress. After completing the redress process—which includes submitting all applicable documents—an individual will receive a redress control number that may facilitate future travel. For example, airline passengers who have completed the redress process and are determined by DHS as not being the subject of a watchlist record are put on the department’s list of individuals who are “cleared” to travel. Using the redress control number when making reservations for future travel may help to prevent misidentifications.

To mitigate future risks of performance shortfalls and strengthen management of the Secure Flight program moving forward, in May 2009, we recommended that TSA periodically assess the performance of the Secure Flight system’s matching capabilities and results to determine whether the system is accurately matching watchlisted individuals while minimizing the number of false positives, consistent with the goals of the program; document how this assessment will be conducted and how its results will be measured; and use these results to determine whether the system settings should be modified. TSA’s actions discussed below fully respond to the recommendation we made in our May 2009 report.

TSA has developed performance measures to report on and monitor Secure Flight’s name matching capabilities. According to TSA, Secure Flight leadership reviews the daily reports, which reflect quality, match rate, false positive rates, and other metrics. Reviews are to include analysis, discussion with program leadership, and identification of process and data quality improvements to increase efficiency and reduce possible false positive matches to the watchlist. In addition, DHS established a multidepartmental Match Review Board Working Group and a Match Review Board to, among other things, review the performance measures and recommend changes to improve system performance. According to TSA, the working group meets on a biweekly basis and the board meets monthly, or as required, to review working group findings and to make system change recommendations. For example, the board has recommended changes in the threshold used for determining whether an individual is a match to a watchlist record and has decided to implement additional search tools to enhance Secure Flight’s automated name-matching capabilities. Furthermore, TSA plans to periodically assess the extent to which the Secure Flight program fails to identify individuals who are actual matches to the watchlist.

Appendix IV: Redress Process for Individuals Experiencing Difficulties during Travel- Related Screening and Inspection

The DHS Traveler Redress Inquiry Program (DHS TRIP) is a single point of contact for individuals who have inquiries or seek resolution regarding difficulties they experienced during their travel screening at transportation hubs—like airports and train stations—or crossing U.S. borders, including watchlist issues; inspection problems at ports of entry; and situations where travelers believe they have been unfairly or incorrectly delayed, denied boarding, or identified for additional screening or inspection at our nation’s transportation hubs.

While serving as the point of contact for the receipt, tracking, and response to redress applications, DHS TRIP generally refers cases to the appropriate screening agency for review and adjudication.

Changes to DHS TRIP Watchlist-Related Procedures since the Attempted Attack

According to DHS TRIP officials, since the December 2009 attempted attack, the office implemented a new procedure to ensure that (1) the office is promptly notified when an individual who is determined by DHS TRIP as not being the subject a watchlist record—and, therefore, has been put on the department’s list of individuals who are “cleared” to travel—is subsequently added to the watchlist and (2) redress applicants are provided additional information regarding the resolution of their cases. Prior to the attempted attack, DHS TRIP would conduct electronic comparisons once each day to ensure that someone who had been cleared as a result of the redress process had not subsequently been added to the watchlist. Since the attempted attack, DHS TRIP now conducts continuous checks (on a 24/7 basis) of cleared individuals against the watchlist every time the watchlist is updated. According to DHS TRIP officials, this change provides the office immediate notification if an individual who is cleared through the redress process is subsequently added to the watchlist. In turn, DHS TRIP officials can alert screening agencies more quickly that an individual should not be cleared if encountered during screening.

Separately, DHS TRIP—at the direction of the Secretary of Homeland Security and in partnership with the Terrorist Screening Center (TSC), Departments of Justice and State, Federal Bureau of Investigation (FBI), and other members of the interagency redress community—has taken steps intended to help provide transparency to redress applicants regarding the resolution of their cases.

DHS TRIP Redress Data and Related Information

According to DHS TRIP data, individuals submitted approximately 32,000 applications for redress during 2009 and 36,000 applications during 2010. The DHS TRIP redress application asks travelers to identify their areas of concern, but the information collected generally does not allow DHS TRIP officials to determine if individuals were misidentified as being on the watchlist. DHS TRIP officials explained that since the application allows travelers to list multiple reasons for applying—and the individuals generally do not know why they were subject to additional screening, inspection, or delay—the office cannot conclude with certainty that being misidentified as being on the watchlist was the cause of an applicant’s inconvenience. In late 2009, as part of the rollout of TSA’s Secure Flight program, several air carriers instituted a public awareness campaign encouraging travelers to submit redress inquiries if they believed that they have been misidentified in the past. Finally, DHS TRIP officials noted that individual screening and law enforcement agencies are in the best position to understand if their screening and law enforcement systems and procedures incorrectly identify individuals as matches with watchlist records. The officials explained that these agencies have access to more detailed records that would identify reasons for a delay or inconvenience, including a misidentification to the watchlist.

According to DHS TRIP, less than 1 percent of individuals who apply for redress have been confirmed matches to the watchlist or have identifying information (e.g., name and date of birth) that closely matches someone on the watchlist. In such cases, DHS TRIP forwards the inquiry to TSC for resolution. TSC data show that the government has procedures in place to review the information that supports a watchlist record upon receipt of a redress inquiry and has revised the watchlist status of individuals based on these reviews. We did not review the effectiveness of these procedures.

Appendix V: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, Eric Erdman, Assistant Director; Mona Blake; Jeffrey DeMarco; Michele Fejfar; Lisa Humphrey; Richard Hung; Thomas Lombardi; Linda Miller; Victoria Miller; Jan Montgomery; Timothy Persons; and Michelle Woods made key contributions to this report.