An October 8 "60 Minutes" report on watch lists confirms the warnings that the ACLU has been making for several years: the current administration is pinning Americans’ security on a system of watch lists that is bloated, inefficient, ineffective, and unfair. For example:

• The current terrorist database maintained by the National Counterterrorism Center (NCTC) contains a reported 350,000-400,000 names.^[1] The aviation lists contain 119,000 of those names – but nobody believes that there are that many people walking around plotting to blow up or hijack of an airliner.
• The aviation lists ("no-fly" and "selectee" lists) contain the names of many thousands of innocent Americans, who now encounter problems when they try to fly. Those innocent Americans have generally found it impossible to get their names cleared.
• The aviation lists actually do not contain the names of many of the worst suspected terrorists, because the government is fearful that its secrecy will be compromised.
• As CBS has discovered, the lists contain many names of people who are dead, in prison, or are foreign dignitaries, including the President of Bolivia, Saddam Hussein, and 14 of the 9/11 hijackers.^[2]

The risks of identity-based systems such as watch lists are high, and their likely security benefits low.

The ACLU does not object to the concept of the government using terrorist watch lists made up of genuine terrorists, but the actual implementation of such a list in a free democratic society is fraught with pitfalls. It needs to be fair, and it needs to actually be effective at making our air transportation system safer, and not just make people feel better through a false sense of security.

Unfortunately, the TSA has moved headlong toward implementing these watch lists without ironing out the fundamental problems with the underlying data. The agency needs to rethink this program from the ground up. That means:

• Building focused systems that concentrate on alerting screeners to true terrorists who pose genuine threats to aviation safety
• Building carefully bounded systems that will not grow over time into something that brings fundamental new incursions on freedom in America
• Building robust, carefully crafted due process protections and other checks and balances to protect innocent travelers.
• Understanding that identity-based security dragnets are inherently difficult, problematic, and unlikely to provide a good return on security dollars compared to spending those resources on physical security and targeted anti-terror investigations.

Watch Lists Have Been Mismanaged

Everyone likes the idea that "Osama Bin Laden should not be let on an airplane." But the U.S. government’s security establishment record in managing watch lists to actually try to implement that idea has been a disaster. Partly that has been a result of mismanagement, and partly a result of the deceptive difficulty of creating identity-based systems for providing security.

In the years since 9/11, the U.S. government’s watchlists have been consistently mismanaged:

• Because of the bureaucratic problems and failure to share intelligence that contributed to the 9/11 attack, that disaster prompted security officials to begin seeking to centralize terrorist watch lists.
• In 2002 the General Accounting Office was asked to investigate which federal agencies maintained watch lists and whether watch list information was being shared. In an April 2003 report, the GAO reported a "decentralized and nonstandard" approach to the lists in the government. It uncovered 12 separate watch list systems maintained by 9 federal agencies, and recommended that "the Secretary of DHS take a series of steps aimed at ensuring that watch lists are appropriately and effectively standardized, consolidated, and shared."^[3]
• An August 2004 report by the DHS’s own Inspector General documents a chain of problems that have bedeviled the government’s attempts to create a unified watch list, including the DHS’s continued failure to assume responsibility for creating the list, with the result that responsibility continued to shift among agencies, as well as "an absence of central oversight and a strategic approach to watch list consolidation."^[4]

The no-fly documents obtained by the ACLU through the FOIA reinforce the conclusion that the government has failed to properly maintain the watch lists. In one e-mail, an FBI agent, apparently reacting to a TSA official’s rationale for the lists, wrote that "Unfortunately, eggheaded thinking like this muddies the waters to the point where the no-fly list and selectee lists become virtually worthless (garbage in, garbage out)."^[5] In another e-mail, an FBI agent complained that " These lists are not comprehensive and not centralized. Some subjects appear on one list but not the others. Some of the lists are old and not current. We are really confused."

These documents reveal much confusion and lack of leadership, but they also reveal many good government employees sincerely trying to fix the system and make it more effective at stopping true terrorists. Yet those employees are trapped in a system that is bigger than themselves, and the disastrous experience with the no-fly list has shown the results. But that only serves as a reminder that the danger posed by improperly controlled watch lists is not simply that they will be abused (either by a single "bad apple" or by more systematic, J. Edgar Hoover-style political misuse). There is also the danger that individuals on a list will be bounced around within a Kafkaesque nightmare where no one is responsible, no one is accountable, and no one can help.

The DHS has not even gotten its own house in order on watch lists, and yet through its troubled Secure Flight program has proposed to hurdle forward with the construction of giant machinery that will extend the reach and impact of watch lists outward into everyday American life to an unprecedented degree. The lists that are supposed to lie at the core of Secure Flight appear to be utterly unready for that role. The result is the likelihood that Secure Flight will simply continue to throw inaccurate lists at hapless passengers as well as the frontline security personnel who must interact with them and deal with the consequences of bad data.

Focused Watch Lists: Good For Security And Liberty

To be effective, terrorist watch lists must be exactly that: lists focused on true terrorists who pose a genuine threat of taking over or taking down an aircraft. Bloated watch lists are bad not only because they cast many innocent travelers as suspected terrorists, but also because they dissipate the focus that those screeners should be keeping on true terrorists. A terrorist watch list that is discrete and focused has a greater chance of being productive, and a lesser chance of being unfair; not only is it better for civil liberties, but more likely to provide a security benefit. False accusations hassle and humiliate individuals; false positives divert security resources. This is truly a case where good security and civil liberties are aligned.

In 2004, then-TSA chief David M. Stone actually boasted to Congress about the rapidity with which the no-fly list was being expanded, as if that were automatically something good:

Prior to 9/11, there were fewer than 100 names on the "no-fly" list. Today, TSA provides carriers with "no-fly" and "selectee" lists that have been dramatically expanded. New names are being added every day as intelligence and law enforcement agencies submit new names for consideration. . . . Continued expansion will be possible as integration and consolidation of various watchlists by the Terrorist Screening enter (TSC) progresses. . . ^[6]

"Continued expansion" of watch lists is not itself helpful, and unless the names being added to the list are of high quality, is likely to be a bad thing. Swamping the names of truly dangerous terrorists in a sea of other names is not good for security. Watch lists become bloated because security workers have every incentive to add names, and no incentives to clear them. Everyday bureaucratic bungling and pure sloppiness is inevitably a factor. But lists can also grow too large because the agencies that maintain them have lost sight of the scope of such lists and the purposes for which they are being maintained. The rapid consolidation of watch lists touted by Stone and other officials only reinforces our concern that this is already the case.

Of the 12 watch lists reported by the GAO in a April 2003 report, only one (the State Department’s TIPOFF database) was purely a terrorist watch list. The other databases included other information – on violent gangs, individuals suspected of drug trafficking, and other non-terrorist criminals and perceived threats.^[7] We do not know how all this extraneous information is being handled as terrorism information is ostensibly being combined into a single repository at the TSC. Consolidation of 12 bloated, inaccurate, out-of-date watch lists would only lead to a single bloated, inaccurate, out-of-date watch list. And it is worrisome that the TSA seems to consider the goal to make these lists as long as possible, rather than to keep them as short and as "threat-rich" as possible. The fact that the TSA’s own no-fly and selectee lists are also being added to the TSC database, despite the rampant problems with those lists, further undermines confidence in the composition of the watch list that will lie at the core of Secure Flight.

The attitude that "no potential threat shall go unlisted" leads naturally to bloated watch lists. After all, every single person boarding an airplane is a potential threat; for watchlists to have a chance at being effective, they must be created and administered with the discipline to remain focused on terrorists truly intent on taking over or bringing down an airliner.

We worry about reports that there are so many lists, not consolidated, full of extraneous information about people no one would consider a terrorist. The uncontroversial contention that Osama Bin Laden should not be allowed on an aircraft is being used to create and to justify watch lists that appear to be far broader than that image would imply. If the list sweeps so broadly at the outset, we can only imagine how broadly it will sweep as it becomes susceptible over time to the inevitable mission creep.

Due process and redress: still no fairness after 5 years

The ability of individuals to receive fair treatment when caught up in this system is still lacking after 5 years. Innocent victims cannot discover if they are a victim of the inaccuracies that riddle government and private databases, have been falsely accused of wrongdoing by someone, or have been discriminated against because of their religion, race, ethnic origin, or political beliefs.

There is no doubt that the task facing security agencies is challenging indeed, and the ACLU does not object to the idea of trying to identify and keep off aircraft genuine terrorists. But in actual practice, the government’s list appear to be so large and bloated that it is inevitably sweeping in many innocent people. Adequate protections must be built in to deal with the problems that will result.

In a democratic society, the act of maintaining a list of people who are considered suspect and are denied some of the freedoms of others must be scrutinized closely. The power to impose denial of access to common-carrier services such as airlines (which are integral to the free and normal conduct of life for many in today’s society) as well as the government’s power to stigmatize individuals through the authority and credibility that its designations can hold within a community make it vital that checks and balances be instituted to govern the power to enforce a watch list.

The importance of such checks and balances is made clear by the experience that many Americans have had since 9/11 in their encounters with the TSA’s current "no-fly" and "selectee" lists (which restrict individuals from boarding aircraft, or single them out for particularly intense security screening, respectively). Hundreds if not thousands of innocent passengers have been routinely stopped, questioned and searched while trying to fly. Many have been detained and humiliated in front of other passengers.

TSA officials have implied that they have an internal process in place for adjudicating the problems caused by these watch lists. For example, when Senator Ted Kennedy described in a hearing the problems that he himself experienced in getting his name removed from the list, and asked what that implied about the ability of average citizens to do so, a top DHS official at the time, Asa Hutchison, responded that:

It is important for the average citizen to know the process – that they can call our TSA ombudsman, who will take the information down, verify that they – their name is not the same as what’s confusingly similar on the list, and we can actually enter into the database

that they have been cleared so that that should be prevented in the future, and so there is a process to clear names.^[8]

However, this does not comport with experience. First, individuals who have been repeatedly stopped because their name appears on the no-fly or selectee lists have not consistently been informed of the existence of this ombudsman. Second, those individuals who have discovered it have been instructed to submit to the TSA a written complaint describing in detail the events that occurred. But the TSA states that it will respond to such complaints only if "circumstances warrant it" – with no hint about what those circumstances might be, and no recourse when TSA appears to decide that circumstances do not warrant response. And in fact, many innocent passengers who follow TSA’s procedures – filling out forms, providing multiple copies of identification documents, and so on – receive no response from the TSA and continue to be flagged by the No-Fly list.^[9]

Even these troubling experiences represent only one aspect of the problem: instances in which individuals not suspected of ties to terrorist organizations are mistaken for other individuals who are. But there are also the cases that arise when an individual is correctly identified as being on a watch list, but claims that he or she is innocent of ties to terrorist organizations or other allegations and does not belong on the list. (An example of such a case, abeit in the context of an international flight, was the widely publicized detention and expulsion of the Yusuf Islam, the ex-pop star formerly known as Cat Stevens.)

In fact, documents obtained by the ACLU through the Freedom of Information Act (and a lawsuit that had to be filed to force compliance therewith) provide a behind-the-scenes glimpse into the uphill battle that individuals currently face in trying to remove their names from the list. One document states that

TSA will only remove a name from the No-Fly list if the originator of the request to watch list provides, in writing, a request for the individual to be removed from the list, as well as a sufficient justification for the removal. . . . Additionally, TSA will consider any threat information that other agencies may have presented concerning the individual before deciding whether to remove the person from the No-Fly list."^[10]

In short, the current process for seeking redress for watch list problems appears to require that a government agency other than the one administering the list (the TSA) initiate a request for removal, and that such a request not be contradicted by information provided by other agencies (a situation that would presumably require simultaneous self-initiated removal requests from both agencies). Even then, it is up to the TSA to judge, based on unstated criteria and without appeal, whether the justification for removal is "sufficient."

Another document advises FBI field offices that "there have been occasions when agencies have failed to remove names from TSA’s lists, even after the individuals were determined by the entering agency to be . . . no threat to commercial aviation." The document then goes on to discuss attempts to remedy this confusion.^[11]

The ACLU-obtained documents state that placement on the list is based on whether an individual presents "a threat to U.S. civil aviation," and is sufficiently well identified for their inclusion to be useful. However, it states that these principles are "guidelines, not ‘hard and fast’ rules," and appears to describe exceptional cases of people placed on the list even though the guidelines would not support such a determination (the precise descriptions of these exceptions were redacted from the documents provided to the ACLU).^[12] Clearly, placement on the list is a highly subjective process subject to enormous discretion by invisible, unaccountable security workers.

For an innocent person placed on one of these lists, this all could add up to a situation from which it is, for all practical purposes, impossible to escape.

It is inconceivable that a democratic nation can allow the creation of a vast infrastructure for denying individuals their full freedoms, without tight checks and balances on that machinery. Those checks and balances are well established in other areas where individuals are subject to what amounts to punishment, such as the criminal justice system:

• Meaningful due process. Individuals must be provided with a meaningful, participatory process by which they can challenge their inclusion on a watch list in an adversarial proceeding before a neutral arbiter.
• Access to and a right to challenge the data on which inclusion on a list is based. Before any individuals lose the rights and privileges that other members of society enjoy (such as the right to travel by air) then they must have the same rights to confront their accuser and be told of the charges being leveled against them as individuals currently possess in criminal proceedings. Of course, in some circumstances genuinely justified by true national security imperatives, it may be necessary for data to be reviewed in camera by a neutral arbiter.
• Tight criteria for adding identities to watch lists. Security officials must be tightly constrained in their ability to add names to watch lists, and the natural incentive to add a name to a list ("better safe then sorry") must be institutionally counterbalanced.
• Rigorous procedures for removing names from watch lists. When the government begins keeping lists of individuals for the purposes of lessening those individuals’ freedom, it assumes the responsibility to keep that list up to date by regularly reviewing and reassessing each person’s inclusion on that list.

Without such controls, the inevitable result will be a capricious and unpredictable security bureaucracy that will trample on individuals, leaving them no recourse and accepting no accountability.