The President’s national strategy for homeland security and the Homeland Security Act of 2002 provide for securing our national borders against terrorists. Terrorist and criminal watch lists are important tools for accomplishing this end. Simply stated, watch lists can be viewed as automated databases that are supported by certain analytical capabilities. To understand the current state of watch lists, and the possibilities for improving them, it is useful to view them within the context of such information technology management disciplines as database management and enterprise architecture management. Since the September 11th terrorist attacks, homeland security—including securing our nation’s borders—has become a critical issue. To mobilize and organize our nation to secure the homeland from attack, the administration issued, in July 2002, a federal strategy for homeland security. Subsequently, the Congress passed and the President signed the Homeland Security Act, which established DHS in January 2003. Among other things, the strategy provides for performance of six mission areas, each aligned with a strategic objective, and identifies major initiatives associated with these mission areas. One of the mission areas is border and transportation security. For the border and transportation security mission area, the strategy and the act specify several objectives, including ensuring the integrity of our borders and preventing the entry of unwanted persons into our country. To accomplish this, the strategy provides for, among other things, reform of immigration services, large-scale modernization of border crossings, and consolidation of federal watch lists. It also acknowledges that accomplishing these goals will require overhauling the border security process. This will be no small task, given that the United States shares a 5,525 mile border with Canada and a 1,989 mile border with Mexico and has 95,000 miles of shoreline. Moreover, each year, more than 500 million people legally enter our country, 330 million of them noncitizens. More than 85 percent enter via land borders, often as daily commuters. Our nation’s current border security process for controlling the entry and exit of individuals consists of four primary functions: (1) issuing visas, (2) controlling entries, (3) managing stays, and (4) controlling exits. The federal agencies involved in these functions include the Department of State’s Bureau of Consular Affairs and its Bureau of Intelligence and Research, as well as the Justice Department’s Immigration and Naturalization Service (INS), the Treasury Department’s U.S. Customs Service (Customs), and the Transportation Department’s Transportation Security Administration (TSA). The process begins at the State Department’s overseas consular posts, where consular officers are to adjudicate visa applications for foreign nationals who wish to enter the United States. In doing so, consular officials review visa applications, and sometimes interview applicants, prior to issuing a visa. One objective of this adjudication process is to bar from entry any foreign national who is known or suspected to have engaged in terrorist activity, is likely to engage in such activity, or is a member or supporter of a known terrorist organization. Foreign nationals (and any other persons attempting to enter the United States, such as U.S. citizens) are to be screened for admission into the United States by INS or Customs inspectors. Generally, this consists of questioning the person and reviewing entry documents. Since October 2002, males aged 16 or over from certain countries (for example, Iran, Iraq, Syria, and the Sudan) are also required to provide their name and U.S. address and to be photographed and fingerprinted. In addition, airline officials use information provided by TSA to screen individuals attempting to travel by air. As discussed in the next section, requirements for checking a person against a watch list differ somewhat, depending upon whether the person arrives at a land-, air-, or seaport. After foreign nationals are successfully screened and admitted, they are not actively monitored unless they are suspected of illegal activity and come under the scrutiny of a law enforcement agency, such as the Department of Justice’s Federal Bureau of Investigation (FBI). Also, when foreign nationals depart the country, they are not screened unless they are males aged 16 years or over from certain countries referenced above, or are leaving by air. According to TSA, all passengers on departing flights are screened prior to boarding the plane. Figure 1 is a simplified overview of the border entry/exit process. Watch lists are important tools that are used by federal agencies to help secure our nation’s borders. These lists share a common purpose—to provide decisionmakers with information about individuals who are known or suspected terrorists and criminals, so that these individuals can either be prevented from entering the country, apprehended while in the country, or apprehended as they attempt to exit the country. As shown in figure 2, which builds on figure 1 by adding watch list icons and associating them with the agencies that maintain the respective lists, watch lists collectively support nine federal agencies in performing the four primary functions in the border security process. Specifically: When a person applies for a visa to enter the United States, State Department consular officials are to check that person against one or more watch lists before granting a visa. When a person attempts to enter the United States by air or sea, INS or Customs officials are required to check that person against watch lists before the person is allowed to enter the country. In addition, when a person attempts to enter the United States by air, INS or Custom officials check him or her against watch lists provided by TSA prior to allowing him or her to board the plane. Persons arriving at land borders may be checked, but there is no requirement to do so. The exception, as previously discussed, is for males aged 16 or over from certain countries, who are required to be checked. Once a watch list identifies a person as a known or suspected terrorist, INS, Customs, or airline officials are to contact the appropriate law enforcement or intelligence organization (for example, the FBI), and a decision will be made regarding the person’s entry and the agency’s monitoring of the person while he or she is in the country. When a person exits the country by plane, airline officials are to check that person against watch lists. In performing these roles, the agencies use information from multiple watch lists. For example, U.S. National Central Bureau for Interpol officials told us that they provide information to the agencies involved in entry control, exit control, and stay management. In addition to highlighting the importance of watch lists for border security, the President’s national strategy cites problems with these lists, including limited sharing. According to the July 2002 strategy, in the aftermath of the September 11th attacks it became clear that vital watch list information stored in numerous and disparate federal databases as not available to the right people at the right time. In particular, federal agencies that maintained information about terrorists and other criminals had not consistently shared it. The strategy attributed these sharing limitations to legal, cultural, and technical barriers that resulted in the watch lists being developed in different ways, for different purposes, and in isolation from one another. To address these limitations, the strategy calls for integrating and reducing variations in watch lists and overcoming barriers to sharing the lists. It also calls for developing an enterprise architecture for border security and transportation (see next section for a description of an enterprise architecture). More specifically, the strategy provides for developing a consolidated watch list that would bring together the information on known or suspected terrorists contained in federal agencies’ respective lists. If properly developed, enterprise architectures provide clear and comprehensive pictures of an entity, whether it is an organization (for example, a federal department, agency, or bureau) or a functional or mission area that cuts across more than one organization (for example, grant management, homeland security, or border and transportation security). These architectures are recognized as essential tools for effectively and efficiently engineering business operations and the systems and databases needed to support these operations. More specifically, enterprise architectures are systematically derived and captured blueprints or descriptions—in useful models, diagrams, and narrative—of the mode of operation for a given enterprise. This mode of operation is described in both (1) logical terms, such as interrelated business processes and business rules, information needs and flows, data models, work locations, and users, and (2) technical terms, such as hardware, software, data, communications, and security attributes and performance standards. They provide these perspectives both for the enterprise’s current, or “as is,” environment and for its target, or “to be,” environment, as well as a transition plan for moving from the “as is” to the “to be” environment. Using enterprise architectures is a basic tenet of effective IT management, embodied in federal guidance and commercial best practices. When developed and used properly, these architectures define both business operations and the technology that supports these operations in a way that optimizes interdependencies and interrelationships. They provide a common frame of reference to guide and constrain decisions about the content of information asset investments in a way that can ensure that the right information is available to those who need it, when they need it. As discussed in the previous section, enterprise architectures facilitate delivery of the right information to the right people at the right time. To this end, these architectures include data models, or logical representations of data types and their relationships, which are used to engineer physical data “stores,” or repositories. When engineered properly, these data stores are structured in a way that effectively and efficiently supports both shared and unique enterprise applications, functions, and operations. The structure of these data stores, whether they are paper records or automated databases, can take many forms, employing varying degrees of centralization and standardization. Associated with the structures being employed are opportunities and limitations to effective and efficient information exchange and use. Generally, these structures can be viewed along a continuum. At one extreme, databases can be nonstandard, both in terms of metadata and the technologies that manage the data, and they can be decentralized, meaning that they were built in isolation from one another to support isolated or separate, “stovepiped” applications, functions, and operations. In this case, integrating the databases to permit information exchange requires the development of unique, and potentially complex and costly, point-to-point interfaces (hardware and software) that translate the data or bridge incompatibilities in the technology. Further, the sheer number of databases involved can exponentially increase the number of relationships, and thus interfaces, that have to be built and maintained. Structuring databases in this way can quickly evolve into an overly complex, unnecessarily inefficient, and potentially ineffective way to support mission operations. (See fig. 3 for a simplified diagram conceptually depicting this approach to structuring databases.) At the other extreme, databases can be structured to recognize that various enterprise applications, functions, and operations have a need for the same data or sets of data, even though they may need to use them in different ways to support different mission applications, functions, and operations. If engineered properly, these database structures allow for greater use of standards, in terms of both data definitions and technology, and are more centralized, although the option exists to create subsidiary databases— known as data warehouses and data marts—to permit more uniquely configured and decentralized data sources to support specific and unique mission needs. Further, since the core data in these subsidiary databases are received from a corporate database(s), the need for interfaces to translate data or connect incompatible technologies is greatly reduced. Structuring databases in this way can minimize complexity and maximize efficiency and mission effectiveness. (See fig. 4 for a simplified diagram conceptually depicting this approach to structuring databases.) Terrorist watch lists are developed, maintained, or used by federal, state, and local government entities, as well as by private-sector entities, to secure our nation’s borders. Twelve such lists are currently maintained by federal agencies. These lists contain various types of data, from biographical data—such as a person’s name and date of birth—to biometric data—such as fingerprints. Nine federal agencies, which prior to the establishment of DHS spanned five different cabinet-level departments, currently maintain 12 terrorist and criminal watch lists. These lists are also used by at least 50 federal, state, and local agencies. The above-mentioned departments are the Departments of State, Treasury, Transportation, Justice, and Defense. Table 1 shows the departments, the associated nine agencies that maintain watch lists, and the 12 watch lists. The 12 watch lists support the federal agencies involved in the border security process. Figure 5, which builds on figure 2, provides a graphical representation identifying the name of each of the lists and relating them to the agencies that maintain the lists and are involved in performing the four border security functions: issuing visas, controlling entries, managing stays, and controlling exits. The 12 watch lists do not all contain the same types of data, although some types are included in all of the lists. At the same time, some types of data are included in only a few of the lists. More specifically, all of the lists include the name and date of birth; 11 include other biographical information (for example, passport number and any known aliases); 9 include criminal history (for example, warrants and arrests); 8 include biometric data (for example, fingerprints); 3 include immigration data (for example, visa type, travel dates, departure country, destination country, country visited, arrival dates, departure dates, and purpose of travel); and 2 include financial data (for example, large currency transactions). Figure 6 shows the data types that are included in each watch list. Effective sharing of information from watch lists and of other types of data among multiple agencies can be facilitated by agencies’ development and use of well-coordinated and aligned policies and procedures that define the rules governing this sharing. One effective way to implement such policies and procedures is to prepare and execute written watch list exchange agreements or memorandums of understanding. These agreements would specify answers to such questions as what data are to be shared with whom, and how and when they are to be shared. Not all of the nine agencies have policies and procedures governing the sharing of watch lists. In particular, two of the agencies reported that they did not have any policies and procedures on watch list sharing. In addition, of the seven that reported having such policies and procedures, one did not require any written agreements. Further, the policies and procedures of the seven have varied. For example, one agency’s policies included guidance on sharing with other federal agencies as well as with state and local governments, but another’s addressed sharing only with other federal agencies. In addition, each agency had different policies and procedures on memorandums of understanding, ranging from one agency’s not specifying any requirements to others’ specifying in detail that such agreements should include how, when, and where data would be shared with other parties. The variation in policies and procedures governing the sharing of information from watch lists can be attributed to the fact that each agency has developed its own policies and procedures in response to its own specific needs. In addition, the agencies reported that they received no direction from the Office of Homeland Security identifying the needs of the government as a whole in this area. As a result, federal agencies do not have a consistent and uniform approach to sharing watch list information. The President’s homeland security strategy and recent legislation call for increased sharing of watch lists, not only among federal agencies, but also among federal, state, and local government entities and between government and private-sector organizations. Currently, sharing of watch list data is occurring, but the extent to which it occurs varies, depending on the entities involved. Further, these sharing activities are not supported by systems with common architectures. This is because agencies have developed their respective watch lists, and have managed their use, in isolation from each other, and in recognition of each agency’s unique legal, cultural, and technological environments. The result is inconsistent and limited sharing. According to the President’s homeland security strategy, watch list data sharing has to occur horizontally among federal agencies as well as vertically among federal, state, and local governments in order for the country to effectively combat terrorism. In addition, recent federal homeland security legislation, including the Homeland Security Act, USA PATRIOT ACT of 2001, and the Enhanced Border Security and Visa Entry Reform Act of 2002 require, among other things, increased sharing of homeland security information both among federal agencies and across all levels of government. The degree to which watch list data are being shared is not consistent with the President’s strategy and recent legislative direction on increased data sharing. Specifically, while federal agencies report that they are generally sharing watch list data with each other, they also report that sharing with organizations outside of the federal government is limited. That is, five of the nine agencies reported that they shared data from their lists with state and local agencies, and three reported that they shared data with private industry. Figure 7 visually summarizes the extent to which federal agencies share watch list data with each level of government (federal, state, and local) and with the private sector. As noted above, federal agencies are sharing either all or some of their watch list data with each other. However, this sharing is the result of each agency’s having developed and implemented its own interfaces with other federal agencies’ watch lists. The consequence is the kind of overly complex, unnecessarily inefficient, and potentially ineffective network that is associated with unstructured and nonstandard database environments. In particular, this environment consists of nine agencies—with 12 watch lists—that collectively maintain at least 17 interfaces; one agency’s watch list alone has at least 4 interfaces. A simplified representation of the number of watch list interfaces and the complexity of the watch list environment is provided in figure 8. A key reason for the varying extent of watch list sharing is the cultural differences among the government agencies and private-sector organizations involved in securing U.S. borders. According to the President’s strategy, cultural differences often prevent agencies from exchanging or integrating information. We also recently reported that differences in agencies’ cultures has been and remains one of the principal impediments to integrating and sharing information from watch lists and other information. Historically, legal requirements have also been impediments to sharing, but recent legislation has begun addressing this barrier. Specifically, the President’s strategy and our past work have reported on legal requirements, such as security, privacy, and other civil liberty protections, that restrict effective information sharing. To address this problem, Congress has recently passed legislation that has significantly changed the legal framework for information sharing, which, when fully implemented, should diminish the effect of existing legal barriers. In particular, Congress has enacted legislation providing for agencies to have increased access to other agencies’ information and directing more data sharing among agencies. For example, section 701 of the USA PATRIOT ACT broadened the goals of regional law enforcement’s information sharing to cover terrorist activities. The Enhanced Border Security and Visa Entry Reform Act expanded law enforcement and intelligence information sharing about aliens seeking to enter or stay in the United States. Most recently, the Homeland Security Act provides the newly created DHS with wide access to information held by federal agencies relating to “threats of terrorism” against the United States. Section 891 expresses the “sense of Congress” that “Federal, state, and local entities should share homeland security information to the maximum extent practicable.” Further, section 892 of the Act requires the President to prescribe and implement procedures for the sharing of “homeland security information” among federal agencies and with state and local agencies, and section 895 requires the sharing of grand jury information. The President’s homeland security strategy stresses the importance of information sharing and identifies, among other things, the lack of a common systems architecture—and the resultant incompatible watch list systems and data—as an impediment to systems’ interoperating effectively and efficiently. To address this impediment, the strategy proposes developing a “system of systems” that would allow greater information sharing across federal agencies as well as among federal agencies, state and local governments, private industry, and citizens. In order for systems to work more effectively and efficiently, each system’s key components have to meet certain criteria. In particular, their operating systems and applications have to conform to certain standards that are in the public domain, their databases have to be built according to explicitly defined and documented data schemas and data models, and their networks have to be connected. More specifically, critical system components would have to adhere to common standards, such as open systems standards, to ensure that different systems interoperate. One source for open system standards is the International Organization for Standardization. Also, these systems’ data would have to have common— or at least mutually understood—data definitions so that data could, at a minimum, be received and processed, and potentially aggregated and analyzed. Such data definitions are usually captured in a data dictionary. Further, these systems would have to be connected to each other via a telecommunications network or networks. When system components and data do not meet such standards, additional measures have to be employed, such as acquiring or building and maintaining unique system interfaces (hardware and software) or using manual workarounds. These measures introduce additional costs and reduce efficiency and effectiveness. The 12 automated watch list systems do not meet all of these criteria (see table 2). For example, they use three different types of operating systems, each of which stores data and files differently. Overcoming these differences requires the use of software utilities to bridge the differences between systems. Without such utilities, for example, a Windows-based system cannot read data from a diskette formatted by a UNIX-based system. Also, nine of the systems do not have software applications that comply with open system standards. In these cases, agencies may have had to invest time and resources in designing, developing, and maintaining unique interfaces so that the systems can exchange data. Further, five of the systems’ databases do not have a data dictionary, and of the remaining seven systems that do have data dictionaries, at least one is not sharing its dictionary with other agencies. Without both the existence and sharing of these data dictionaries, meaningful understanding of data received from another agency could require an added investment of time and resources to interpret and understand what the received data mean. Moreover, aggregation and analysis of the data received with the data from other watch lists may require still further investment of time and resources to restructure and reformat the data in a common way. Last, seven of the systems are not connected to a network outside of their agencies or departments. Our experience has shown that without network connectivity, watch list data sharing among agencies can occur only through manual intervention. According to several of these agencies, the manual workarounds are labor-intensive and time-consuming, and they limit the timeliness of the data provided. For example, data from the TIPOFF system are shared directly with the National Automated Immigration Lookout System through a regular update on diskette. Those data are then transferred from the National Automated Immigration Lookout System to the Interagency Border Inspection System. The President’ s strategy attributes these differences to the agencies’ building their own systems to meet agency-specific mission needs, goals, and policies, without knowledge of the information needs and policies of the government as a whole. As noted and depicted in figure 6, this approach has resulted in an overly complex, unnecessarily inefficient, and potentially ineffective federal watch list sharing environment. As addressed in the preceding sections of this report, federal watch lists share a common purpose and support the border security mission. Nevertheless, the federal government has developed, maintains, and— along with state and local governments and private entities—uses 12 separate watch lists, some of which contain the same types of data. However, this proliferation of systems, combined with the varying policies and procedures that govern the sharing of each, as well as the architectural differences among the automated lists, create strong arguments for list consolidation. The advantages of doing so include faster access, reduced duplication, and increased consistency, which can reduce costs and improve data reliability. Most of the agencies that have developed and maintain watch lists did not identify consolidation opportunities. Of the nine federal agencies that operate and maintain watch lists, seven reported that the current state and configuration of federal watch lists meet their mission needs, and that they are satisfied with the level of watch list sharing. However, two agencies supported efforts to consolidate these lists. The State Department’s Bureau of Consular Affairs and the Justice Department’s U.S. Marshals Service agreed that some degree of watch list consolidation would be beneficial and would improve information sharing. Both cited as advantages of consolidation the saving of staff time and financial resources by limiting the number of labor-intensive and time-consuming data transfers, and one also cited the reduction in duplication of data that could be realized by decreasing the number of agencies that maintain lists. The President’s strategy also recognizes that watch list consolidation opportunities exist and need to be exploited. More specifically, the strategy states that the events of September 11th raised concerns regarding the effectiveness of having multiple watch lists and the lack of integration and sharing among them. To address these problems, the strategy calls for integrating the numerous and disparate systems that support watch lists as a way to reduce the variations in watch lists and remove barriers to sharing them. To implement the strategy, Office of Homeland Security officials have stated in public settings that they were developing an enterprise architecture for border and transportation security, which is one of the six key mission areas of the newly created DHS. They also reported the following initial projects under this architecture effort: (1) developing a consolidated watch list that brings together information on known or suspected terrorists in the federal agencies’ watch lists, and (2) establishing common metadata or data definitions for electronic watch lists and other information that is relevant to homeland security. However, the Office of Homeland Security did not respond to our inquiries about this effort, and thus we could not determine the substance, status, and schedule of any watch list consolidation activities. Since then, the DHS Chief Information Officer told us that DHS has assumed responsibility for these efforts. Our nation’s success in achieving its homeland security mission depends in large part on its ability to get the right information to the right people at the right time. Terrorist and criminal watch lists make up one category of such information. To date, the federal watch list environment has been characterized by a proliferation of systems, among which information sharing is occurring in some cases but not in others. This is inconsistent with the most recent congressional and presidential direction. Our experience has shown that even when sharing is occurring, costly and overly complex measures have had to be taken to facilitate it. Cultural and technological barriers stand in the way of a more integrated, normalized set of watch lists, and agencies’ legal authorities and individuals’ civil liberties are also relevant considerations. To improve on the current situation, central leadership—spanning not only the many federal agencies engaged in maintaining and using watch lists, but also the state and local government and the private-sector list users—is crucial to introducing an appropriate level of watch list standardization and consolidation while still enforcing relevant laws and allowing agencies to (1) operate appropriately within their unique mission environments and (2) fulfill their unique mission needs. Currently, the degree to which such leadership is occurring, and the substance and status of consolidation and standardization efforts under way, are unclear. In our view, it is imperative that Congress be kept fully informed of the nature and progress of such efforts. To promote better integration and sharing of watch lists, we recommend that DHS’s Secretary, in collaboration with the heads of the departments and agencies that have and use watch lists, lead an effort to consolidate and standardize the federal government’s watch list structures and policies. To determine and implement the appropriate level of watch list consolidation and standardization, we further recommend that this collaborative effort include 1. updating the watch list information provided in this report, as needed, and using this information to develop an architectural understanding of our nation’s current or “as is” watch list environment; 2. defining the requirements of our nation’s target or “to be” watch list architectural environment, including requirements that address any agency-unique needs that can be justified, such as national security issues and civil liberty protections; 3. basing the target architecture on achievement of the mission goals and objectives contained in the President’s homeland security strategy and on congressional direction, as well as on opportunities to leverage state and local government and private-sector information sources; 4. developing a near-term strategy for implementing the target architecture that provides for the integration of existing watch lists, as well as a longer-term strategy that provides for migrating to a more consolidated and standardized set of watch lists; 5. ensuring that these strategies provide for defining and adopting more standard policies and procedures for watch list sharing and addressing any legal issues affecting, and cultural barriers to, greater watch list sharing; and 6. developing and implementing the strategies within the context of the ongoing enterprise architecture efforts of each of the collaborating departments and agencies. In addition, we recommend that the Secretary report to Congress by September 30, 2003, and every 6 months thereafter, on the status and progress of these efforts, as well as on any legislative action needed to accomplish them. In commenting on a draft this report, three of the six departments provided either written (Justice and State) or oral (DHS) comments. The remaining three departments (Defense, Transportation, and Treasury) said that they had reviewed the draft but had no comments. The Office of Homeland Security was also provided with a draft but said that it would not comment. The departments that provided comments generally agreed with our findings and recommendations. They also (1) provided technical comments, which we have incorporated as appropriate in the report, and (2) offered department-unique comments, which are summarized and evaluated below. In his oral comments, DHS’s Chief Information Officer stated that the department now has responsibility for watch list consolidation. Additionally, the Chief Information Officer generally described DHS’s plans for watch list consolidation and agreed that our recommendations were consistent with the steps he described. In light of DHS’s assumption of responsibility for watch list consolidation, we have modified our recommendations to direct them to the DHS Secretary. In its written comments, Justice stated that, in addition to cultural differences, there are other reasons why agencies do not share watch list information, such as national security and civil liberty requirements, and that these requirements complicate the consolidation of watch list information. Justice also stated that, while it agrees that there is a need to establish a common watch list architecture to facilitate sharing, this need should not impede short-term efforts to improve sharing. We agree with Justice’s first point, which is why our recommendations provide for ensuring that all relevant requirements, which would include pertinent national security and civil liberty protections, are taken into consideration in developing our nation’s watch list architectural environment. To make this more explicit, we have modified our recommendations to specifically recognize national security and civil liberty requirements. We also agree with Justice’s second point, and thus our recommendations also provide for pursuing short-term, cost-effective initiatives to improve watch list sharing while the architecture is being developed. (Justice’s comments are reprinted in app. II.) In its written comments, State said that our report makes a number of valuable points concerning the benefits of watch list consolidation, enterprise architecture, and information sharing. However, State also said that our report (1) attributed watch list differences solely to varying agency cultures, (2) seemed to advocate a “one size fits all approach,” and (3) often makes the assumption that software and systems architecture differences necessarily obstruct information sharing. With respect to State’s first point, our report states clearly that watch list differences are attributable not only to varying cultural environments, but also to each agency’s unique mission needs and its legal and technical environments as well. Concerning State’s second point, our report does not advocate a “one size fits all” solution. Rather, our recommendation explicitly calls for DHS to lead a governmentwide effort to, among other things, determine the appropriate degree of watch list consolidation and standardization needed and to consider in this effort the differences in agencies’ missions and needs. Regarding State’s last point, our report does not state or assume that differences in software and system architecture categorically obstruct or preclude information sharing. Instead, we state that those differences requiring additional measures—such as building and maintaining unique system interfaces or using manual workarounds—introduce additional costs and reduce efficiency and effectiveness. (State’s comments are reprinted in app. III.) As agreed with your office, unless you publicly announce its contents earlier, we plan no further distribution of this report until 15 days from the date on the report. At that time, we will send copies of the report to other congressional committees. We will also send copies to the Directors of the Offices of Homeland Security and Management and Budget, and the Secretaries of the Departments of Defense, Homeland Security, Justice, State, Transportation, and the Treasury. Copies will also be made available at our Web site at www.gao.gov. Should you or your offices have questions on matters discussed in this report, please contact me at (202) 512-3439. I can also be reached by E-mail at hiter@gao.gov. An additional GAO contact and staff acknowledgments are listed in appendix V. Our objectives were to identify (1) federal databases and systems that contain watch lists, the agencies that maintain and use these watch lists in protecting our nation’s borders, and the kinds of data these watch lists contain; (2) whether federal agencies’ sharing of watch list data is governed by policies and procedures; (3) whether watch lists are (a) being exchanged among federal agencies and between federal agencies and state, local, and private organizations and (b) supported by common system architectures (system hardware, software, and data characteristics); and (4) whether opportunities exist for consolidating watch lists. The scope of our work was based on the federal government’s agency structure before the formation of the Department of Homeland Security. We focused on the agencies that use or maintain watch lists in performing border security functions. We identified these departments and agencies through discussions with federal government officials knowledgeable about the U.S. border security mission area. The specific departments and agencies included in our scope were: U.S. National Central Bureau for Interpol Bureau of Intelligence and Research Air Force Office of Special Investigations Transportation Security Administration. To address our objectives, we surveyed each of the agencies cited above, using a data collection instrument. To develop this instrument, we reviewed, among other things, past GAO and other reports on watch lists and on the border security process, along with relevant guidance on such topics as systems interoperability, enterprise architecture management, database management, and information sharing. We used this research to develop a series of questions designed to obtain and aggregate information necessary to answer our objectives. We then incorporated these questions into the questionnaire (see app. IV for a copy of the questionnaire). We pretested the questionnaire at two federal agencies, made adjustments based on the pretest, and then transmitted it to the agencies cited above on July 29, 2002. Responses from agencies were received from August 2002 through October 2002. We did not independently verify agency responses. However, we did contact agency officials when necessary to clarify their responses. Next, we compiled the agencies’ responses to determine the number of watch lists being used, confirm the universe of agencies that have lists, and determine the number of organizations that use the lists and the kinds of data the lists contain. We also analyzed the agencies’ policies and procedures governing watch list sharing. In addition, we reviewed the survey responses to determine the degree of sharing among federal, state, local, and private-sector entities, and we compared the extent of sharing with the sharing goals contained in the President’s homeland security strategy and the Homeland Security Act of 2002. Moreover, we aggregated the agencies’ descriptions of their watch list systems architectures and analyzed them to identify similarities and differences. We also analyzed the architectural components of the watch list systems and compared them with the standards required for systems to interoperate and share data efficiently and effectively. Finally, we analyzed the agencies’ responses on watch list consolidation, to identify whether there were opportunities for consolidating watch lists and, if so, what the benefits were of doing so. Additionally, we reviewed the President’s homeland security strategy, homeland security legislation and agency budget requests, and other public documents to identify federal government efforts related to maintaining and sharing watch lists. We also attended conferences and other public events at which Office of Homeland Security officials spoke on homeland security enterprise architecture and watch list standardization and consolidation efforts. We attempted to meet with Office of Homeland Security officials, but they declined to meet with us. As a result, we submitted written questions to the Office of Homeland Security, but received no response. We conducted our work at the headquarters of the nine federal agencies identified above, in and around the Washington, D.C., metropolitan area, from July 2002 through March 2003, in accordance with generally accepted government auditing standards. The U.S. General Accounting Office (GAO), an we may have about your survey responses. Please note investigative agency of Congress, is studying federal that parts II, IV, and V should be answered for each agency “watch lists.” Our objectives are to identify: watch list developed, maintained, or used by your (1) databases and systems that contain watch lists of agency. Additional survey pages are provided at the domestic and international terrorists and criminals; end of the survey if you have more than one watch list. (2) agencies that maintain and use these databases and systems; (3) policies and procedures that govern the sharing of watch list data; (4) the kinds of data that are currently being exchanged among federal, state, and local governments and private sector firms and associations; (5) the architectural characteristics of watch list databases and systems; and (6) opportunities for consolidating these databases and systems. Fax: (202) 512-6450 to U.S. national security and welfare. Security Officer, at the GAO address given at the end and/or the databases and systems in which they reside of the survey. Ms. McGhee can be contacted at (202) could be productively consolidated. Please provide the 512-8116 if you have any questions or concerns. What is your agency’s definition of a “known or suspected domestic and/or international terrorist or criminal.” 4. Other (please specify): _________ 2. Is this list maintained electronically, manually (on paper), or by a combination of these methods? 2. Manually (on paper) only 3. Both electronically and manually 3. How many names are on this list as of August 1, 2002? __________ (number) each watch list developed and/or maintained 5. Describe how your agency determines the names by your agency. Name of Watch List: ______________________ determinations. If additional space is needed, add pages as necessary. Purpose of Watch List _____________________ 1. Is your watch list limited to terrorists, or does it include information on others? 2. Terrorists and others, such as criminals 4. Other (please specify): 6. What controls are in place to help ensure that the procedures for adding names to the watch list are consistently applied? 2. Is this list maintained electronically, manually (on paper), or by a combination of these methods? 2. Manually (on paper) only 3. Both electronically and manually 3. How many names are on this list as of August 1, 2002? __________ (number) A watch list—also referred to as lookout, target, or tip-off list—contains information on known and suspected domestic and international terrorists and criminals and is used by federal, state, and local agencies to identify, monitor, and apprehend these terrorists and criminals. 7. Describe how your agency determines the names that are removed from this watch list, including a 9. How often is this watch list updated? description of the criteria used to make such determinations. If additional space is needed, add pages as necessary. 8. Other (please specify): ________________ 10. For this list, what is the level of classification of data as specified by Executive Order 12958? 8. What controls are in place to help ensure that the procedures for deleting names from the watch list are consistently applied? 5. Other (please specify): 11. Does this watch list information allow individuals with false identities to be detected? 1. 2. 12. Does this watch list information allow individuals with false documents to be detected? 1. 2. Executive Order 12958 specifies how information related to national defense and foreign relations is to be maintained and protected against unauthorized disclosure. It provides a hierarchy of three levels, with different levels of protection depending on the sensitivity of the information. 13. Please tell us whether the list includes any of the 14. Do you share all or some of the information in this following items by placing a check () in the appropriate column. list with other federal, state, or local government agencies and/or others (e.g., private sector firms, associations, etc.)? Please check () yes or no for each type of organization. If you answered no to all of the categories above, please explain why you do not share this information with others, and then proceed to Part III. If additional space is needed, add pages as necessary. Other (please specify): Other (please specify): (e.g., student, Tourist, etc.) Other (please specify): Other (please specify): Other (please specify): Other Data Groups (please specify): _____________________________ 15. For each of the categories in question 14 that you answered yes to, please check all of the types of organizations you share data with: a. Federal Agencies: 3. Other (please specify): _____________ Please list the federal agencies you share data with. If additional space is needed, add pages as necessary. b. State Agencies: 3. Other (please specify): _____________ 3. Other (please specify): _____________ d. Private sector firms and associations: 3. Other (please specify): _____________ _______________________________ 16. Of the data items in your watch list, which ones do you share and with which organizations? For each item, please circle whether or not you share the item with the type of organization specified in the categories in the table below. Name of Country Issuing Passport/Visa Other (please specify): Other (please specify): Type of Visa Granted (e.g., student) data, please place a check () in the appropriate column(s) below. and Use Other Agencies’ Watch Lists Please provide the requested information for each watch list provided by another agency. If you do not receive others’ watch lists, please go directly to part V. telecommunications links (e.g., e-mail) Web Access (Hypertext Transfer Protocol (HTTP) or HTTP over Secure Socket Layer (HTTPS)) How does your agency use this watch list? Secure Community of Interest (such as Intel-Link) Other (please specify): 1. Does your agency receive and use watch list information on? 1. 2. Terrorists and others, such as 4. Does your agency have data sharing agreement(s) with the agencies you receive this list from? 3. 4. 1. 2. 2. By what mechanism(s) does your agency receive watch list information? 5. Check () the box showing how frequently you receive updated watch list information: 2. Manually (on paper) only (go to question 4) 3. Both electronically and manually 8. Other (please specify):____________ 6. Would receiving watch list information more 10. For this watch list, please check () the items frequently improve your agency’s ability to not provided and list the reason(s) the agency identify, monitor, and/or apprehend known and gave for not providing them. suspected terrorists and criminals? 1. 2. 7. Does this watch list information allow individuals with false identities to be detected? Other (please specify): 1. 2. 8. Does this watch list information allow individuals with false documents to be detected? 1. 2. 9. Does your agency receive all the data it requests from the agency providing this watch list? Other (please specify): 1. 2. Type of Visa Granted (e.g., student, tourist) If your answer is yes, please go directly to section V. If your answer is no, please proceed to question 10. Please provide the requested information for each watch list identified in parts II and IV. list resides on. In addition, where applicable, check () the standard your product is compliant with. Additional pages are provided in appendix III if you have more than one watch list. If your watch list does not reside in a computerized database or system, skip to part VI. give the agency name) Other (specify): protocols) Memory (bytes) protocols) Other (please specify): client-server) _____________________________________________ 3. For this watch list, please check () below any of 6. Is the database or system your list resides on the software infrastructure standards your system stand-alone or networked? or database is compliant with. If your system or database is compliant with a standard not listed, 1. Stand-alone only (go to question 8) please list it in the other category. (Check all that apply.) Yes () No () If Yes, List System(s) 5. Is the system on which your list resides built in compliance with open system standards? 1. 2. 8. What fields can you use to search for individuals? (Check all that apply.) If yes, please specify which standard(s) you used to develop and/or implement your system. 2. Biometric fields (e.g., fingerprints) 3. Date of birth fields . Other (please specify): ______________ A stand-alone database/system is one that is not directly connected to other systems or networks. 9. Does your system include a “fuzzy” searchcapability? 12. Is your agency using document type definitions (DTDs) or schemas for requesting watch list information from another agency? If you answered yes, please provide a copy structure of your data. of the DTD/schema for requesting watch list information. 10. For this watch list, please describe below what type of standards, schema, or specifications 13. Is your agency using DTD/schemas for your agency uses to define the format and responding to a watch list information request content of your watch list data elements or records. from another agency? If you answered yes, please provide a copy of the DTD/schema for requesting watch list information. 14. Is your agency using DTDs/schema for automatically updating watch list information? 11. Has your agency created a metadata template for describing a terrorist? If you answered yes, please provide a copy of the DTD/schema. 15. Has your agency developed and institutionalized a watch list data dictionary that describes the elements used in the DTDs/schemas? If you answered yes, please provide documents identifying the number of elements, name of each element, data type of each element, and meaning of each element. If you answered yes, please provide a copy of the data dictionary. A search for data that finds answers that come close to the data being searched for. It can get results when the exact spelling is not known or help users obtain information that is loosely related to a topic. Metadata is definitional data that provides information about or documentation of data managed within an application or environment. For example, metadata would document data about data elements or attributes, such as the element name, size, and type. For example, state motor vehicle administrators use the American Association of Motor Vehicle Administrators’ XML Driver History Query System Specifications. A DTD or schema is a file that describes the structure of a document and defines how markup tabs should be interpreted. 16. Is your agency sharing its data dictionary with 20. Does your watch list database contain any of other agencies? the following security controls? (Check all that apply.) 1. 2. If you answered yes, please provide the 3. Vulnerability Assessments or Reviews names of the agencies you share with below. 5. Intrusion (Actual or attempted) Detection 6. Maintaining audit trails of all access to and 7. Investigation of suspicious access or Revision of access control policies and 4. Other (please specify): _______________________________________ 24. What controls are in place to help ensure data reliability? _______________________________________ 2. Additional fill-in boxes for question 6. 1. Additional fill-in boxes for question 5. 3. Additional fill-in boxes for question 7. 4. Additional fill-in boxes for question 8. Gary Mountjoy, (202) 512-6367. In addition to the individual named above, Elizabeth Bernard, Neil Doherty, Joanne Fiorino, Will Holloway, Tonia Johnson, Anh Le, Kevin Tarmann, and Angela Watson made key contributions to this report. The General Accounting Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. The fastest and easiest way to obtain copies of GAO documents at no cost is through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and full- text files of current reports and testimony and an expanding archive of older products. The Web site features a search engine to help you locate documents using key words and phrases. You can print these documents in their entirety, including charts and other graphics. Each day, GAO issues a list of newly released reports, testimony, and correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site daily. The list contains links to the full-text document files. To have GAO e-mail this list to you every afternoon, go to www.gao.gov and select “Subscribe to GAO Mailing Lists” under “Order GAO Products” heading.

Summary: Terrorist and criminal watch list systems--sometimes referred to as watchout, lookout, target, or tip-off systems--are important tools in controlling and protecting our nation's borders. The events of September 11, 2001, and other incidents since then, have highlighted the need to share these watch lists. In light of the importance of border security, GAO was asked to identify federal databases and systems that contain watch lists, the agencies that maintain and use them in protecting our nation's borders, the kind of data they contain, whether federal agencies are sharing information from these lists with each other and with state and local governments and private organizations, the structural characteristics of those lists that are automated, and whether opportunities exist to consolidate these watch lists. Generally, the federal government's approach to using watch lists in performing its border security mission is decentralized and nonstandard, largely because these lists were developed in response to individual agencies' unique missions, including their respective legal, cultural, and systems environments. Specifically, nine federal agencies--which prior to the creation of the Department of Homeland Security (DHS) spanned the Departments of Defense, Justice, State, Transportation, and the Treasury--develop and maintain 12 watch lists. These lists include overlapping but not identical sets of data, and different policies and procedures govern whether and how these data are shared with others. As a general rule, this sharing is more likely to occur among federal agencies than between federal agencies and either state and local government agencies or private entities. Further, the extent to which such sharing is accomplished electronically is constrained by fundamental differences in the watch lists' systems architecture (that is, the hardware, software, network, and data characteristics of the systems). Two agencies identified opportunities to standardize and consolidate these lists, which GAO believes would improve information sharing. The President's homeland security strategy further recognizes the need to address the proliferation of these lists. While the Office of Homeland Security was reportedly pursuing consolidation as part of an effort to develop a border and transportation security blueprint, referred to as an enterprise architecture, the DHS Chief Information Officer told us that the department had recently taken responsibility for the blueprint. However, we were not provided enough information to evaluate these efforts.