How the Terrorist Watchlist Works
In the wake of recent domestic terrorist incidents, the spotlight has once again fallen on the terrorist watchlist. What is it, how does the system actually work — and could the watchlist have been a means to prevent the attacks?
The gunman in the Orlando Pulse nightclub shooting, who killed 49 people, was on a watchlist from 2013 to 2014 and interviewed twice, but the FBI removed him from the database after closing its investigation. Meanwhile, the New York Times recently reported that the father of the suspect in September’s New York and New Jersey bombings shared some concerns about his son and terrorism with the FBI two years ago that spurred a review that allegedly did not turn anything up to demand further investigation.
The father’s comment was brought up at last week’s Senate Homeland Security committee hearing, where FBI Director James Comey said that “your facts are wrong about what his father told the FBI,” although he would not elaborate due to the active investigation and forthcoming trial. Comey, however, noted that in the respective cases, the FBI is reviewing the investigations. “Where we make mistakes, we will admit them, we will be transparent and we will get better,” he said.
Some civil liberties experts say the watchlist system is beyond repair.
“The watchlist system is broken, and in trying to watch too many people, we sometimes miss the glaring threats right in front of us,” said Arjun Singh Sethi, a writer, civil rights lawyer and an adjunct professor of law at Georgetown University Law Center and Vanderbilt University Law School. “If the government must use a watchlist, the standards should be narrow, the evidence relied upon credible, and watchlists must be based upon a presumption of innocence so that individuals can challenge their placement.”
Former government officials who worked closely with the watchlist system, however, say it is a deeply scrutinized process that is backed up by multiple levels of review and a constant concern for the balancing act of safeguarding civil liberties against protecting the American people.
“People have to understand that there is a standard that has to be met before someone is watchlisted, for lack for a better word, and that’s really important,” Elaine Lammert, a former Deputy General Counsel with the FBI, said.
What is the watchlist?
The Terrorist Screening Database (TSDB), better known as the terrorist watchlist, is a single, consolidated database that populates the terrorist screening systems used by various agencies such as U.S. Customs and Border Protection, Transportation Security Administration, and the State Department, for instance. The federal Terrorist Screening Center serves as the central body that maintains the list of information about “known” or “suspected” terrorists and also shares information with local law enforcement and international partners.
“The Terrorist Screening Center, it’s the only organization of its kind in the world. We have taken all of our known or suspected terrorists, put it into one database,” Timothy Healy, former director of the TSC from 2009-2013, said. “There are some other countries that are very interested in doing it, but no one does it and has one coordinated approach.”
A “known terrorist” is someone who the U.S. government determines “is engaged, has been engaged, or who intends to engage in terrorism and/or terrorist activity,” according to the 2013 NCTC watchlisting guidance leaked to and published by The Intercept. A “suspected terrorist,” meanwhile is an individual who is “reasonably suspected to be, or has been engaged in conduct constituting, in preparation for, in aid of, or related to terrorism and/or terrorist activities based on an articulable and reasonable suspicion.”
How does the watchlist process work?
The TSDB is a database of all known or suspected terrorists, both international and domestic. A number of different agencies nominate people for inclusion onto the list.
The FBI is concerned with purely domestic terrorism, according to Healy. Domestic-only would be, for instance, individuals connected with white supremacist movements in the United States. The international distinction applies to any kind of international association — an al Qaeda-connected domestic individual would still be considered international, Healy noted.
The National Counterterrorism Center maintains the classified database of known or suspected international terrorists and their networks, dubbed the Terrorist Identities Datamart Environment (TIDE). Unclassified data from TIDE is given to the TSC to populate the terrorist watchlist that is provided to screening agencies.
Just opening a file on an individual does not mean they are watchlisted. To score a place on the watchlist maintained by the TSC, a person must reach the “reasonable suspicion” standard, and agencies must “rely upon articulable intelligence or information which, taken together with rational inferences from those facts, reasonably warrants a determination that an individual is known or suspected to be or has knowingly engaged in conduct constituting, in preparation for, in aid of, or related to terrorism or terrorist activities,” according to the 2013 NCTC watchlisting guidance.
“Think of it like a bucket,” Healy said. “Think on that bucket there’s a line that says reasonable suspicion. So somebody does a Tweet, somebody sees it and goes, this guy’s a bad guy. So what do we do about it? The agency picks it up and says, we’ve got this information on this guy, and they submit it to NCTC. So NCTC looks at it and goes, ok, we’re going to start a bucket. Nothing happens to the guy, because they just start a file on him to see, ok, what have we got?”
Information is gathered and if NCTC — which handles international terrorism — or the FBI —for the purely domestic — believes it has reached that level of the reasonable suspicion standard, the nominating agency will send it over to the TSC. Before a nomination can make it onto the watchlist, it will have been reviewed three to four times, Healy noted, as both the nominating agency and TSC have their own review processes.
Once in the database, the information provided for terrorist screeners, like Customs and Border Protection (CBP) and the State Department, is unclassified, Healy said — name, date of birth and identifying information. The information from the Terrorist Identities Datamart Environment database is first scrubbed of any classified information before it is provided to the agencies screening for terrorists.
Who is on the watchlist?
The “vast majority” of the watchlist is made up of non-U.S. persons, or an individual who does not have U.S. citizenship, a green card, or political asylum in the United States, according to Healy.
According to a response this year from the NCTC and FBI to congressional questions, there are approximately 1.5 million person records in TIDE, and about one percent of that total, or fewer than 15,000 records, are U.S. persons. On the TSDB, there are approximately 1 million person records, and .5 percent, or fewer than 5,000 records, are U.S. persons.
The information, as of June 2016, states that there are about 81,000 No-Fly records in the TSDB and U.S. persons make up about percent, or fewer than 1,000 records, on the list.
How does the No-Fly List play into this?
The TSDB is used to populate a number of different watchlists and screening systems. There are five major government agencies that use the consolidated database for screening purposes — it goes to the State Department for passport and visa screening; the FBI’s National Crime Information Center, which is available to every law enforcement officer and criminal justice agency; CBP for when people come across a border; the Department of Defense to check anyone who may come onto a base; and, most famously, to TSA for aviation security screening.
The No-Fly List is a list within the larger list, however. The No-Fly List requires the nominated individual reach an even higher standard than it takes to get placed in the overall TSDB, and is a “very small percentage of the watchlist,” Healy said.
“That name has been reviewed five or six different times. It’s reviewed specifically by a TSA person who works at the TSC, and then it’s specifically a supervisor at the TSC that looks at it and gives it a thumbs up and says this guy warrants being on the No Fly List. So it’s been reviewed and seen at least five to seven times, and the No Fly List is a very scrutinized list,” Healy said.
Inclusion onto this subset means that the person has been connected with credible information showing that the person “poses a threat of committing a violent act of terrorism with respect to civil aviation, the homeland, United States interests abroad, or is operationally capable of doing so,” a FAQ from the screening center states.
To be placed into the TSDB, “you literally get screened by five or six different agencies at different times — and for the No-Fly List, it’s absolutely scrutinized,” Healy said.
“With the No-Fly List, if you’re a U.S. person, you get scrutinized monthly to make sure, because we know that it is a significant challenge and a significant restriction. So that gets reviewed on a monthly, if not daily, basis to say ok, this guy still warrants being on the No-Fly List. And if you don’t have information to keep them on the No-Fly List, he gets off of it,” Healy said.
With the No-Fly List, “the worst that could happen if a guy gets on the watchlist that shouldn’t be on the watchlist is he may miss a flight,” Healy added. “That’s the worst that could happen. But on the other side, if you’ve got a bad guy that gets a plane, the worst that could happen is he takes it down and kills a bunch of people.”
How are civil liberties safeguarded?
From inclusion to removal, one of the key controversies with the terrorist watchlist, and perhaps most notably the No-Fly List, is the issue of protecting civil liberties. “For any law enforcement agency, navigating the First Amendment part is important,” Lammert said.
Nominations to the TSDB are not permitted solely based on “race, ethnicity, national origin, religious affiliation, or First Amendment-protected activities,” the TSC’s FAQ page states.
Perhaps one of the biggest questions is what happens if a person has been mistakenly included on the No-Fly List. The Department of Homeland Security has a redress program, the DHS Traveler Redress Inquiry Program, commonly referred to as DHS TRIP, where a person can challenge being on the list. Often if it is a clear mistake, the person can be quickly removed.
But the government refuses to provide notice of the reasons individuals are placed on a watchlist — which means people cannot petition for meaningful redress before a judge or neutral party, according to Sethi.
The overall watchlist system is “based on over-inclusive and vague standards,” he said, adding that “your connection to terrorism can be extraordinarily remote and you can still be on the master terrorist watchlist.”
Can a single social media post get you placed on the watchlist? According to Sethi, a person can be “branded a terrorist based on a single Facebook, Twitter or social media post.”
But the former official said that is not the case — “Never. Somebody does a Tweet, ‘I hate America, I want to blow it up’ and you get on the watchlist? No. That’s not how it works,” Healy said. A social media post, however, can be one way a person comes to the attention of an agency, but then the nominating process must be followed and the reasonable standard suspicion must be met before someone is placed onto the watchlist, Lammert said.
The NCTC guidance states that a person cannot be proposed to the watchlist “based on source reporting that nominating personnel identify as, or know to be, unreliable or not credible. Single source information, including but not limited to ‘walk-in’, ‘write-in’, or postings on social media sites, however, should not automatically be discounted merely because of the manner in which it was received.” The agency instead should “evaluate the credibility of the source, as well as the nature and specificity of the information, and nominate even if that source is uncorroborated, assuming the information supports a reasonable suspicion that the individual is a known or suspected or there is another basis for watchlisting the individual.”
Sethi also criticized the watchlist system as discriminatory, pointing out that The Intercept’s leaked documents showed that the Detroit suburb of Dearborn — with a significant number of Muslim residents within its population of under 100,000 people — has more people on the terrorist watchlist than any city in the United States other than New York City.
At the Terrorist Screening Center, “it’s a very difficult challenge because you’ve got to balance civil liberties against protecting the American people,” Healy said, but it is key to U.S. counterterrorism efforts.
The bottom line, Healy said, is that “if the complaint about the Orlando guy is he was watchlisted and they pulled him off because there wasn’t enough information, that’s how the process works. You don’t get watchlisted forever,” he said.
“It is constantly scrutinized by the case agent to say, is the information valid? Should this guy continue to be watchlisted? And at the end of it, if they don’t see him do anything, they pull him off,” Healy said. “And no one would argue that. The only time they would argue that is if the guy blows something up and they go, oh, you should have read his mind. We can’t do that. Whether you like it or not, there are constitutional protections for people in this country.”
Mackenzie Weinger is a national security reporter at The Cipher Brief.
Tanwa Ashiru
Tanwa Ashiru is a U.S Airforce veteran, and the CEO of Bulwark Intelligence Solutions. She holds an M.A in Intelligence Studies from American Military University (AMU) and is a Fellow of the Association of Enterprise Risk Management Professionals (AERMP).
Tanwa has provided services for various public and private sector organizations including: NATO, Nigerian DIA, U.S Army Africa Forces (USARAF), Total E&P, IBM Nigeria, U.S Embassy Abuja and many more.
She has featured in several international media publications including: BBC World, Arise News, CNBC Africa, The Guardian Nigeria, Channels Television, Financial Times, and many more.