24 October 2007

Terrorist Watch Lists Broken

The GAO via Unbossed, has the scoop:

As of May 2007, the consolidated watch list contained approximately 755,000 records.

From December 2003 through May 2007, screening and law enforcement agencies encountered individuals who were positively matched to watch list records approximately 53,000 times. Many individuals were matched multiple times. The outcomes of these encounters reflect an array of actions, such as arrests; denials of entry into the United States; and, most often, questioning and release. . . .

[S]ome subjects of watch list records have passed undetected through agency screening processes and were not identified, for example, until after they had boarded and flew on an aircraft or were processed at a port of entry and admitted into the United States. . . . the government lacks an up-to-date strategy and implementation plan for optimizing use of the terrorist watch list. Also lacking are clear lines of authority and responsibility.

Just 1% of nominations to put someone on the list are rejected (GAO report, pdf page 27). About 596,000 records have been added to the list since June 2004. Since the system's inception about 100,000 records have been removed from the list (pdf page 29).

The administration agrees that using the list may be useless or counterproductive (at pdf pages 41-42, emphasis added):

According to TSA, the administration has concluded that non-use of the full watch list does not constitute a security vulnerability; however, TSA did not explain the basis for this determination. Also, DHS’s Office for Civil Rights and Civil Liberties emphasized that there is a strong argument against increasing the number of watch list records TSA uses to prescreen passengers. Specifically, the office noted that if more records were used, the number of misidentifications would expand to unjustifiable proportions, increasing administrative costs within DHS, without a measurable increase in security. The office also noted that an expansion of the No Fly and Selectee lists could even alert a greater number of individuals to their watch list status, compromising security rather than advancing it. Further, according to the office, as the number of U.S. citizens denied and delayed boarding on domestic flights increases, so does the interest in maintaining watch list records that are as accurate as possible. Also, the office noted that an increase in denied and delayed boarding of flights could generate volumes of complaints or queries that exceed the current capabilities of the watch list redress process.

The report notably doesn't identify what percentage of the 53,000 watch list related matches were false positives, but implies that the percentage is high, and expressly notes that many people are repeatedly dogged by false positive matches.

[T]he number of matches has increased each year—from 4,876 during the first 10-month period of TSC’s operations to 14,938 during fiscal year 2005, to 19,887 during fiscal year 2006. This increase can be attributed partly to the growth in the number of records in the consolidated terrorist watch list and partly to the increase in the number of agencies that use the list for screening purposes. Our analysis of TSC data also indicates that many individuals were encountered multiple times. For example, a truck driver who regularly crossed the U.S.-Canada border or an individual who frequently took international flights could each account for multiple encounters.

I'll also state the obvious. The United States government does not know the name of 775,000 terrorists in the United States and there aren't remotely that many terrorists who come anywhere near the United States. I very much doubt that there are even 7,750 terrorists in the United States. And, I very much doubt that the United States has any awareness of the threat posed by a majority of the terrorists in the United States. Also, few potential terrorists pose a theat to civil aviation after the passenger screening process is completed. There probably aren't even 775 people on that list who are actual threats to civil aviation or public safety.

Moreover, because the list is disproportionately of suspected "international terrorists" rather than of suspected "domestic terrorists", the percentage of foreign and immigrant persons who trigger false positives is astoundingly high. It doesn't help that in many parts of the word, certain names are very common. Everybody and their brother in the Islamic world has a name from the Koran. The vast majority of people in East Asia share fewer than forty last names. Latin America, similarly, is dominated by a small number of surnames (sociologists regularly use them as a proxy for Hispanic heritage) and has many common first names. One Jose Garcia or Fatima (no last name used) in the terrorist watch list puts a lot of people in a world of hurt.

A 99.9% inaccurate terrorist watch list is worse than nothing.

No comments: