The President’s national strategy for homeland security and the Homeland Security Act of 2002 provide for securing our national borders against terrorists. Terrorist and criminal watch lists are important tools for accomplishing this end. Simply stated, watch lists can be viewed as automated databases that are supported by certain analytical capabilities. To understand the current state of watch lists, and the possibilities for improving them, it is useful to view them within the context of such information technology management disciplines as database management and enterprise architecture management. Since the September 11th terrorist attacks, homeland security—including securing our nation’s borders—has become a critical issue. To mobilize and organize our nation to secure the homeland from attack, the administration issued, in July 2002, a federal strategy for homeland security. Subsequently, the Congress passed and the President signed the Homeland Security Act, which established DHS in January 2003. Among other things, the strategy provides for performance of six mission areas, each aligned with a strategic objective, and identifies major initiatives associated with these mission areas. One of the mission areas is border and transportation security. For the border and transportation security mission area, the strategy and the act specify several objectives, including ensuring the integrity of our borders and preventing the entry of unwanted persons into our country. To accomplish this, the strategy provides for, among other things, reform of immigration services, large-scale modernization of border crossings, and consolidation of federal watch lists. It also acknowledges that accomplishing these goals will require overhauling the border security process. This will be no small task, given that the United States shares a 5,525 mile border with Canada and a 1,989 mile border with Mexico and has 95,000 miles of shoreline. Moreover, each year, more than 500 million people legally enter our country, 330 million of them noncitizens. More than 85 percent enter via land borders, often as daily commuters. Our nation’s current border security process for controlling the entry and exit of individuals consists of four primary functions: (1) issuing visas, (2) controlling entries, (3) managing stays, and (4) controlling exits. The federal agencies involved in these functions include the Department of State’s Bureau of Consular Affairs and its Bureau of Intelligence and Research, as well as the Justice Department’s Immigration and Naturalization Service (INS), the Treasury Department’s U.S. Customs Service (Customs), and the Transportation Department’s Transportation Security Administration (TSA). The process begins at the State Department’s overseas consular posts, where consular officers are to adjudicate visa applications for foreign nationals who wish to enter the United States. In doing so, consular officials review visa applications, and sometimes interview applicants, prior to issuing a visa. One objective of this adjudication process is to bar from entry any foreign national who is known or suspected to have engaged in terrorist activity, is likely to engage in such activity, or is a member or supporter of a known terrorist organization. Foreign nationals (and any other persons attempting to enter the United States, such as U.S. citizens) are to be screened for admission into the United States by INS or Customs inspectors. Generally, this consists of questioning the person and reviewing entry documents. Since October 2002, males aged 16 or over from certain countries (for example, Iran, Iraq, Syria, and the Sudan) are also required to provide their name and U.S. address and to be photographed and fingerprinted. In addition, airline officials use information provided by TSA to screen individuals attempting to travel by air. As discussed in the next section, requirements for checking a person against a watch list differ somewhat, depending upon whether the person arrives at a land-, air-, or seaport. After foreign nationals are successfully screened and admitted, they are not actively monitored unless they are suspected of illegal activity and come under the scrutiny of a law enforcement agency, such as the Department of Justice’s Federal Bureau of Investigation (FBI). Also, when foreign nationals depart the country, they are not screened unless they are males aged 16 years or over from certain countries referenced above, or are leaving by air. According to TSA, all passengers on departing flights are screened prior to boarding the plane. Figure 1 is a simplified overview of the border entry/exit process. Watch lists are important tools that are used by federal agencies to help secure our nation’s borders. These lists share a common purpose—to provide decisionmakers with information about individuals who are known or suspected terrorists and criminals, so that these individuals can either be prevented from entering the country, apprehended while in the country, or apprehended as they attempt to exit the country. As shown in figure 2, which builds on figure 1 by adding watch list icons and associating them with the agencies that maintain the respective lists, watch lists collectively support nine federal agencies in performing the four primary functions in the border security process. Specifically: When a person applies for a visa to enter the United States, State Department consular officials are to check that person against one or more watch lists before granting a visa. When a person attempts to enter the United States by air or sea, INS or Customs officials are required to check that person against watch lists before the person is allowed to enter the country. In addition, when a person attempts to enter the United States by air, INS or Custom officials check him or her against watch lists provided by TSA prior to allowing him or her to board the plane. Persons arriving at land borders may be checked, but there is no requirement to do so. The exception, as previously discussed, is for males aged 16 or over from certain countries, who are required to be checked. Once a watch list identifies a person as a known or suspected terrorist, INS, Customs, or airline officials are to contact the appropriate law enforcement or intelligence organization (for example, the FBI), and a decision will be made regarding the person’s entry and the agency’s monitoring of the person while he or she is in the country. When a person exits the country by plane, airline officials are to check that person against watch lists. In performing these roles, the agencies use information from multiple watch lists. For example, U.S. National Central Bureau for Interpol officials told us that they provide information to the agencies involved in entry control, exit control, and stay management. In addition to highlighting the importance of watch lists for border security, the President’s national strategy cites problems with these lists, including limited sharing. According to the July 2002 strategy, in the aftermath of the September 11th attacks it became clear that vital watch list information stored in numerous and disparate federal databases as not available to the right people at the right time. In particular, federal agencies that maintained information about terrorists and other criminals had not consistently shared it. The strategy attributed these sharing limitations to legal, cultural, and technical barriers that resulted in the watch lists being developed in different ways, for different purposes, and in isolation from one another. To address these limitations, the strategy calls for integrating and reducing variations in watch lists and overcoming barriers to sharing the lists. It also calls for developing an enterprise architecture for border security and transportation (see next section for a description of an enterprise architecture). More specifically, the strategy provides for developing a consolidated watch list that would bring together the information on known or suspected terrorists contained in federal agencies’ respective lists. If properly developed, enterprise architectures provide clear and comprehensive pictures of an entity, whether it is an organization (for example, a federal department, agency, or bureau) or a functional or mission area that cuts across more than one organization (for example, grant management, homeland security, or border and transportation security). These architectures are recognized as essential tools for effectively and efficiently engineering business operations and the systems and databases needed to support these operations. More specifically, enterprise architectures are systematically derived and captured blueprints or descriptions—in useful models, diagrams, and narrative—of the mode of operation for a given enterprise. This mode of operation is described in both (1) logical terms, such as interrelated business processes and business rules, information needs and flows, data models, work locations, and users, and (2) technical terms, such as hardware, software, data, communications, and security attributes and performance standards. They provide these perspectives both for the enterprise’s current, or “as is,” environment and for its target, or “to be,” environment, as well as a transition plan for moving from the “as is” to the “to be” environment. Using enterprise architectures is a basic tenet of effective IT management, embodied in federal guidance and commercial best practices. When developed and used properly, these architectures define both business operations and the technology that supports these operations in a way that optimizes interdependencies and interrelationships. They provide a common frame of reference to guide and constrain decisions about the content of information asset investments in a way that can ensure that the right information is available to those who need it, when they need it. As discussed in the previous section, enterprise architectures facilitate delivery of the right information to the right people at the right time. To this end, these architectures include data models, or logical representations of data types and their relationships, which are used to engineer physical data “stores,” or repositories. When engineered properly, these data stores are structured in a way that effectively and efficiently supports both shared and unique enterprise applications, functions, and operations. The structure of these data stores, whether they are paper records or automated databases, can take many forms, employing varying degrees of centralization and standardization. Associated with the structures being employed are opportunities and limitations to effective and efficient information exchange and use. Generally, these structures can be viewed along a continuum. At one extreme, databases can be nonstandard, both in terms of metadata and the technologies that manage the data, and they can be decentralized, meaning that they were built in isolation from one another to support isolated or separate, “stovepiped” applications, functions, and operations.