UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORM AITON

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY 1NFORMAITON

WARNING: Tliis record contains Sensitive Security Information that is controlled under 49 CFR parts 15 and 1520. No part of this record may be disclosed to persons without a "need to know", as defined in 49 CFR parts 15 and 1520, except with the written permission of the

Administrator of the Transportation Security Administration or the Secretary of Transportation.

Unauthorized release may result in civil penalty or other action. For U.S. government agencies, public disclosure is governed by 5 U.S.C. 552 and 49 CFR parts 15 and 1520.

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

2013 WATCHLISTING GUIDANCE TABLE OF CONTENTS

CHAPTER 1: WATCHLISTING PROCESS AND PROCEDURES 5

I. INTRODUCTION 5

II. WATCHLISTING AUTHORITIES 6

III. CONSTITUTIONALLY PROTECTED ACTIVITIES 10

IV. WATCHLISTING POLICIES I ,

V. WATCHLISTING STANDARD: IDENTIFYING AND SUBSTANTIVE DEROGATORY CRITERIA )2

VI.

WATCHLISTING PROCESS OVERVIEW 13

VII. ROLES AND RESPONSIBILITES FOR THE WATCHLISTING AND SCREENING COMMUNITY ,6

VIII. QUALITY CONTROL MEASURES 17

IX. NOMINATION PROCEDURES 20

X. PROCEDURES TO REMOVE AN INDIVIDUAL FROM THE WATCH LI ST ...27

XI. REDRESS PROCEDURES 28

XII. PERIODIC REVIEW OF THE WATCHLISTING GUIDANCE 29

CHAPTER 2: MINIMUM IDENTIFYING CRITERIA 30

I. BIOMETRIC NOMINATIONS 30

II. MINIMUM BIOGRAPHIC NOMINATION REQUIREMENT 30

III. MINIMUM BIOGRAPHIC INFORMATION REQUIRED FOR EXCEPTIONS TO TI IE

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | I

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

MINIMUM SUBSTANTIVE DEROGATORY STANDARDS FOR TERRORIST WATCHLISTING 32

CHAPTER 3: MINIMUM SUBSTANTIVE DEROGATORY CRITERIA 33

[. INTRODUCTION AND PURPOSE 33

II. REASONABLE SUSPICION 33

III. KNOWN TERRORISTS 35

IV. SUSPECTED TERRORISTS 37

V. EXCEPTIONS TO SUPPORT IMMIGRATION AND VISA SCREENING ACTIVI TIES BY DHS AND DOS 42

VI. SPECIAL CONSIDERATIONS 45

VII. EXAMPLES OF TERRORISM AND/OR TERRORIST ACTIVITIES 47

CHAPTER 4: NO FLY, SELECTEE AND EXPANDED SELECTEE LISTS IMPLEMENTATION GUIDANCE 50

I. BACKGROUND 50

II. PRE-CONDITIONS FOR PLACEMENT ON THE NO FLY OR SELECTEE LIST. 50

III. NO FLY LIST CRITERIA 51

IV. FURTHER CLARIFICATION OF NO FLY CRITERIA 51

V. SELECTEE LIST CRITERIA 54

VI. EXPANDED SELECTEE LIST CRITERIA 54

VII. ACTIONS BASED UPON POSITIVE MATCHES TO THE NO FLY, SELECTEE, OR EXPANDED SELECTEE LISTS 54

VIII. IMPLEMENTA TION GUIDELINES 55

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 2

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

IX. SPECIAL SITUATIONS 56

X. NOMINATIONS THA T ARE INELIGIBLE/NOT SUITABLE FOR EITHER THE NO FLY OR THE SELECTEE LIST 57

CHAPTER 5: ENCOUNTER MANAGEMENT AND ANALYSIS 58

I. INTRODUCTION AND PURPOSE 58

II. PROCESSING TERRORISM INFORMATION FROM ENCOUNTERS WITH POSITIVELY IDENTIFIED KNOWN OR SUSPECTED TERRORISTS 59

III. CATEGORIES OF TERRORISM INFORMATION FROM ENCOUNTERS WITH POSITIVELY IDENTIFIED KNOWN OR SUSPECTED TERRORISTS OF POTENTIAL INTEREST 65

IV. ENCOUNTER MANAGEMENT ACTIONS 69

V. ROLES AND RESPONSIBILITIES FOR UPDATING EXISTING KNOWN OR SUSPECTED TERRORIST RECORDS AND NOMINATING NEW KNOWN OR SUSPECTED TERRORISTS BASED ON INFORMATION FROM POSI TIVE ENCOUNTERS 71

VI. RESPONSIBILITY TO COORDINATE ANY AC TIONS CONTEMPLATED BASED ON INFORMA TION FROM ENCOUN TERS WITH A KNOWN OR SUSPECTED TERRORIST 73

VII. EXAMPLES OF TERRORISM INFORMATION TYPICALLY AVAILABLE FROM ENCOUNTERS 74

VIII. OBTAINING ENCOUNTER INFORMATION THROUGH TSC'S DAILY ENCOUNTER REPORTS 77

APPENDIX 1: DEFINITIONS

APPENDIX 2: IISPD-6

APPENDIX 3: TSC MOU

APPENDIX 4: ADDENDUM B TO TSC MOU

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 3

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

APPENDIX 5: INFORMA TION SHARING MOU APPENDIX 6: EXECUTIVE ORDER 1 3388

APPENDIX 7: DOJ PROTOCOL ON TERRORIST NOMINATIONS APPENDIX 8: REDRESS MOU

APPENDIX 9: PRESIDENTIAL MEMORANDUM REGARDING 12/25/2009 TERRORIST ATTACK

APPENDIX 10: ACRONYMS AND ABBREVIATIONS

APPENDIX 11: SUMMARY OF CHANGES AND UPDATES FROM THE 2010 WATCHLISTING GUIDANCE

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 4

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

CHAPTER I: WATCHLISTING PROCESS AND PROCEDURES

I. INTRODUCTION

1.1 A key foundation for TERRORIST 1 -related screening is the U.S. Government's TERRORIST watchlisting process managed by the Terrorist Screening Center (TSC). The TSC was established by the Attorney General, acting through the Director of the Federal Bureau of Investigation (FBI), and in coordination with the Secretary of State, the Secretary of Homeland Security, and the then Director of Central Intelligence for the Intelligence Community (IC). The I SC is supported by the National Countcrterrorism Center (NCTC), the Department of State (DOS), the Department of Homeland Security (DI IS), the IC, the FBI, L.aw F.nforcement Agencies, Regulatory Agencies and Diplomatic Bureaus. The TSC has created and maintains the Terrorist Screening Database (TSDB) or Terrorist Watchlist to serve as the U.S. Government's consolidated watchlist for terrorism SCREENING INFORMATION.

1 .2 The current TERRORIST watchlisting process supports the U.S. Government's efforts to combat TERRORISM by: (I) consolidating the U.S. Government's Terrorist Watchlist in the TSDB; (2) helping SCREENERS and intelligence agencies accurately identify individuals on the Terrorist Watchlist; (3) providing SCREENERS with information to help them respond appropriately during ENCOUNTERS with KNOWN or SUSPECTED TERRORISTS; and, (4) subsequently collecting information about the KNOWN or SUSPECTED TERRORIST for use in assessing threats and conducting investigations.2 The collected information may be incorporated into the Terrorist Identities Datamart Environment (TIDE) and TSDB to enhance the records of KNOWN or SUSPECTED TERRORISTS and may be made available to the wider watchlisting and screening communities. Today, the TSDB also includes information about certain foreign nationals who arc associated with TERRORISM, TERRORIST ACTIVITY, or KNOWN Or SUSPECTED TERRORISES) but for whom there is insufficient DEROGATORY INFORMATION to be independently watchlisted. This may include certain immediate family members of KNOWN or SUSPECTED terrorists, or known associates of known or SUSPECTED TERRORISTS. These additional categories of records (also known as exceptions to the REASONABLE SUSPICION standard) are maintained to support immigration and screening activities primarily conducted by DOS and DI IS.3

1 See Appendix I, Definitions for words or phrases appearing in all capitalized letters throughout this Watchlisting Guidance.

2 A SCREENF.R is a Department or Agency that is authorized to conduct TERRORISM screening to determine it an individual is a possible match to a KNOWN or SUSPECTED TERRORIST in the TSDB. The term "SCREENER" is used throughout this document as a general reference to a government official who compares an individual's information with information in the TSDB to determine if an individual is in the TSDB. Certain SCREENERS have components which perform both screening and law enforcement duties and law enforcement officials who engage in such activities may normally describe their targeting or other actions in this context as other than "screening." For case of reference, government officials who compare an individual's information with information in the TSDB will be referred to in the Guidance as "SCREENERS." The internal guidance set forth herein is not intended to create or confer any rights, privileges, or benefits in any matter, case, or proceeding. See United Slates v. Caceres, 440 U.S. 74 1 .

'See Chapter 3, Section V, infra, for more details. Aside from these limited exceptions, references to the TSDB in this Watchlisting Guidance denote the TSDB as containing information about KNOWN or SUSPECTED TERRORISTS.

UNCLASSIFIKD//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 5

U NCL ASSI FI ED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

1 .3 This Watchlisting Guidance has been developed to help standardize the watchlisting community's nomination and screening processes. It is important to remember, however, that watchlisting is not an exact science. There arc inherent limitations in any primarily name- based system and analytic judgments may differ regarding whether subjective criteria have been met. Given these realities, the U.S. Government's watchlisting process attempts to safeguard the American people from a TERRORIST attack while safeguarding privacy, civil rights and civil liberties.

1 .4 Thus, when reasonable minds could disagree on a record, a NOMINATOR will make a determination in favor of sending the nomination to NCTC for consideration and additional review. The TSC has the final decision authority regarding watchlisting determinations and will add an individual's name to the TSDB, consistent with TSC Actions and Processes as further described in Paragraph 1 .56.

II. WATCHLISTING AUTHORITIES

1 .5 On September 1 6, 2003, the President issued I lomeland Security Presidential Directive 6 (HSPD-6), which directed the Attorney General to "establish an organization to consolidate the U.S. Government's approach to TERRORISM SCREENING and provide for the appropriate and lawful use of TERRORIST INFORMATION in screening processes."4 TERRORIST INFORMATION was specifically defined to mean "information about individuals known or appropriately suspected to be or have been engaged in conduct constituting, in preparation for, in aid of, or related to TERRORISM." I ISPD-6 also directed the heads of Executive Departments and Agencies to provide to NCTC on an on-going basis, "all appropriate TERRORIST INFORMATION in their possession, custody, or control," to the extent permitted by law.

1 .6 The intent of HSPD-6 was to consolidate all terrorism information at the Terrorist Threat Integration Center (TTIC) - whose functions were assumed by NCTC5 - in a classified database that would then extract Unclassified, For Official Use Only (U//FOUO) TERRORIST IDENTIFIERS for passage to the new organization created by the Attorney General. Thus, concurrent with the issuance of I ISPD-6, the TSC was established via the Memorandum of Understanding on the Integration and Use of Screening Information to Protect Against Terrorism (TSC MO U), which was signed by the Attorney General, the Secretaries of State and I lomeland Security, and the Director of Central Intelligence (on bchalfof the IC).6

1 See Appendix 2. HSPD-6. 5 See FN 8, infra.

" See Appendix 3, TSC MOV; see also Appendix 4, Addendum B to the TSC MOV. In 2004, the Secretaries of State, Treasury, and Defense also became signatories to the Memorandum of Understanding between the Intelligence Community, Federal Law Enforcement Agencies, and the Department of Homeland Secur ity Concerning Information Sharing, dated March 4, 2003 (Information Sharing MOU). By doing so, they agreed that all provisions of the TSC MOV and the Information Sharing MOV apply to all entities that are or become a part of their respective Departments.

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 6

UNCLASSIF1ED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

1 .7 Under HSPD-6, consistent with the U.S. Constitution and applicable laws, including those protecting the rights of all Americans, the TSC was to develop and maintain an unclassified database containing the most thorough, accurate, and current identity information possible ? about KNOWN or SUSPECTED TERRORISTS. The TSC created the TSDB to meet these goals. The TSDB is also known as the Terrorist Watchlist. The TSDB receives terrorist IDENTIFIERS from two sources: NCTC's TIDF. provides information concerning KNOWN or SUSPECTED international TERRORISTS and the TSC's Terrorist Review and Examinations Unit (TRF.X) provides the identities of KNOWN or SUSPECTED domestic TERRORISTS who have no link to international TERRORISM. NCTC's TIDE contains identifying and substantive DEROGATORY INEORMATION on KNOWN or SUSPECTED international TERRORISTS and the FBI's Sentinel system contains supporting information regarding purely domestic TERRORISTS.

1 .8 Pursuant to Paragraph (2) of HSPD-6, the NCTC is mandated to "provide [ I SC] with access to all appropriate information or intelligence in the [NCTC's] custody, possession, or control that [TSC] requires to perform its functions." NCTC fulfills this function by providing TSC's TSDB with U//FOUO information about KNOWN or SUSPECTED TERRORISTS from NCTC's TIDE and by providing access to TIDE Online, a read-only copy of the TIDE database, to those in the watchlisting community who require access.

1.9 NCTC's establishment by the President was codified by section 1021 of the Intelligence Reform and Terrorism Prevention Act of 2004 (IRTPA).8 Pursuant to IRTPA, NCTC shall "serve as the central and shared knowledge bank on KNOWN and SUSPECTED TERRORISTS and international terror groups." In addition, NCTC "may, consistent with applicable law, the direction of the President, and guidelines referred to in [the statute], receive intelligence pertaining exclusively to domestic counterterrorism from any Federal, State, or local government or other source necessary to fulfill its responsibilities and retain and disseminate such intelligence."9

1 .9. 1 All Departments and Agencies arc required to provide NCTC with all TERRORISM INFORMATION. Due to the amount of information involved, only a subset of this information is provided in the NCTC prescribed format designed to facilitate direct ingestion into the TIDE. NOMINATING DEPARTMENTS and AGENCIES, however, should remain focused on reviewing and watchlisting terrorism information from datasets most likely to contain information about known or SUSPECTED TERRORISTS.

Addendum B to the TSC MOU, which superseded Addendum A, incorporates by reference all provisions of the Information Sharing MOV. See Appendix 5.

7 The TSDB consolidates the U.S. Government's TERRORISM screening and lookout databases into a single integrated terrorist identities database. . .

8 NCTC initially was created by Executive Order 1 3354 (August 27, 2004) to serve as the primary organization in the U.S. Government for analyzing and integrating all intelligence possessed or acquired by the U.S. Government pertaining to TERRORISM and counterterrorism, excepting purely domestic counterterrorism information. Executive Order 13354 was revoked by Executive Order 13470 (July 30, 2008) after NCTC was codified in IRTPA section 1021.

9 In addition to the provision of domestic KNOWN or SUSPECTED TERRORISTS directly to the TSC, the TSC's TRF.X unit also provides the identities of international KNOWN or SUSPECTED TERRORISTS to NCTC for inclusion in TIDE.

UNCLASS1FIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 7

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

1.10 On August 27, 2004, the President issued Homeland Security Presidential Directive 1 1 (HSPD-1 1), which "builds upon HSPD-6," to enhance TERRORlST-relatcd screening to more effectively detect and interdict SUSPECTED TERRORISTS and TERRORIST ACTIVITIES. HSPD- 1 1 defines "SUSPECTED TERRORISTS" as "individuals known or reasonably suspected to be or have been engaged in conduct constituting, in preparation for, in aid of, or related to TERRORISM . . . and TERRORIST ACTIVITIES."

1.11 To enhance information sharing, another key component of the consolidated terrorist watchlisting system, the President issued Executive Order 13388, which provides that the head of each Agency that possesses or acquires TERRORISM INFORMATION shall promptly give access to that information to the head of each other Agency that has countertcrrorism functions.10

1.12 On June 5, 2008, the President issued Homeland Security Presidential Directive 24 (HSPD- 24) to further build upon the TERRORIST screening policies announced in 1 ISPD-6 and HSPD- I 1 to protect the nation from TERRORISTS by enhancing the use of biometrics. In HSPD-24, the President directed that ". . . agencies, shall, to the fullest extent permitted by law, make available to other agencies all biometric and associated biographic and contextual information associated with persons/or whom there is an articulable and reasonable basis for suspicion that they pose a threat to national security" (emphasis added). HSPD-24 underscores the value of biometrics in achieving effective TERRORISM screening and emphasizes the need for a layered approach to identification and screening of individuals, as no single mechanism is sufficient.

1.13 The relevant TERRORISM screening Presidential Directives use words and phrases to describe a known or SUSPECTED TERRORIST subject to TERRORIST screening without defining them: "TERRORIST INFORMATION" (HSPD-6), " terrorism" (HSPD-6), "appropriately suspected" (HSPD-6), "reasonably suspected" (HSPD-1 1 ), and "articulable and reasonable basis for suspicion" (I ISPD-24). Thus, previous watchlisting guidance supplied definitions of key terms and the standard that would apply to terrorist watchlisting decisions.

1.14 Neither HSPD-6 nor HSPD-1 1 defines "TERRORISM and/or TERRORIST ACTIVITIES." While federal law contains numerous definitions of "terrorism" 1 1 , for watchlisting purposes under this Guidance, "terrorism and/or terrorist activities" combine elements from various federal definitions and are considered to:

1 . 1 4. 1 involve violent acts or acts dangerous to human life, property, or infrastructure

10 See Appendix 6, Executive Order 13388.

11 See 50 U.S.C. 1801(c) (Foreign Intelligence Surveillance Act (EISA) definition of "international terrorism"); Immigration and Nationality Act (INA) § 2l2(a)(3)(B)(iii) [8 U.S.C. I l82(a)(3)(B)(iii)] (defining "terrorist activity"); INA § 212(a)(3)(B)(iv) [8 U.S.C. 1 182(a)(3)(B)(iv)] (defining to "engage in terrorist activity"); 18 U.S.C. 233 1(1) (defining "international terrorism"); 1 8 U.S.C. 2332(b) (defining "federal crime of terrorism"); Executive Order 13224, 66 Fed. Reg. 49079 (September 23, 2001) (defining "terrorism").

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 8

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

which may be a violation of U.S. law, or may have been, if those acts were committed in the United States; and,

1 . 1 4.2 appear to be intended —

1 .14.2.1 to intimidate or coerce a civilian population;

1.14.2.2 to influence the policy of a government by intimidation or coercion; or,

1 . 1 4.2.3 to affect the conduct of a government by mass destruction, assassination, kidnapping, or hostage-taking.

1.15 This includes activities that facilitate or support TERRORISM and/or TERRORIST ACTIVITIES such as providing a safe house, transportation, communications, funds, transfer of funds or other material benefit, false documentation or identification, weapons (including chemical, biological, or radiological weapons), explosives, or training for the commission of an act of TERRORISM and/or TERRORIST ACTIVITY.

1 . 1 6 1 ISPD-24 speaks in terms of "articulable and reasonable basis for suspicion" to describe a KNOWN or SUSPECTRD TERRORIST who should be watchlisted and represents the President's most recent explanation concerning U.S. policy regarding the individuals who pose a threat to national security and should be screened to better protect the American people. Accordingly, that standard has been adopted and is clarified in this Watchlisting Guidance in Chapter 3, Section II.

1.17 On December 16, 2005, in accordance with section 1016 of I RTPA, the President issued a Memorandum for the Heads of Executive Departments and Agencies prescribing the guidelines and requirements in support of the creation and implementation of the Information Sharing Environment (1SE). In Guideline 5 of that Memorandum, the President directed, as he had earlier in Executive Order 1335312, that the information privacy rights and other legal rights of Americans must be protected and that guidelines be developed and approved to ensure that "such rights are protected in the development and use of the ISE." In December 2006, the President approved for issuance the ISE Privacy Guidelines by the Program Manager.13

I 1 8 A second addendum to the TSC MOU, Addendum B '\ which supplements and incorporates by reference all provisions of the TSC MOU, superseded Addendum A and became effective on January 18, 2007. The Directors of National Intelligence, NCTC, and the TSC joined as signatories in Addendum 13. Paragraph 7 of Addendum B introduces the term TERRORIST IDENTIFIERS to more clearly describe the type of TERRORIST identity elements that are deemed

12 See Executive Order 13353, Establishing the President's Board on Safeguarding Americans' Civil Liberties (August

27, 2004). _ .

13 See Guidelines to Ensure that Information Privacy and other Legal Rights of Americans are Protected m the Development and Use of the Information Sharing Environment (December, 2006).

M See Appendix 4, Addendum B to the TSC MOU.

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 9

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

U//FOUO, without regard to the classification of the source material from which it is drawn. TERRORIST IDENTIFIERS include those listed in Addendum B (i.e., names and aliases; dates of birth; places of birth; unique identifying numbers; passport information; countries of origin and nationality; physical identifiers; known locations; photographs or renderings; fingerprints or other biometric data; employment data; license plate numbers; and any other TERRORIST IDENTIFIERS that originators specifically provide for passage to the TSC). Tor example, email addresses and phone numbers are increasingly useful for screening purposes. ORIGINATORS should mark email addresses and phone numbers as U//FOUO whenever possible and pass these TERRORIST IDEN TIFIERS to NCTC to forward to the TSC for inclusion in TSDB. ORIGINATORS are encouraged to provide all relevant and unclassified information, to include social media information when appropriate.

CONSTITUTIONALLY PROTECTED ACTIVITIES

1.19 First Amendment. First Amendment protected activity alone shall not be the basis for nominating an individual for inclusion on the Terrorist Watchlist.15 The following arc examples of protected Constitutional activities:

1.19.1 Free Speech. The exercise of free speech, guaranteed by the U.S. Constitution, includes more than simply speaking on a controversial topic in the town square. It includes such symbolic or other written, oral and expressive activities as carrying placards in a parade, sending letters to a newspaper editor, wearing a tee shirt with a political message, placing a bumper sticker critical of the President on one's car, and publishing books or articles. The common thread in these examples is conveying a public message or an idea through words or deeds. Speech that may be repugnant to ideas of the majority may still be protected by the U.S. Constitution. For the purpose of this Watchlisting Guidance, the right of protected free speech under the U.S. Constitution applies to U.S. PERSONS wherever they are located and to non- U.S. PERSONS located inside the United States. The right of protected free speech, however, is not unlimited and may not extend to some lawless action.

1 .19.2 Exercise of Religion. The free exercise of religion covers any form of worship of a deity - even forms that are not widely known or practiced - as well as the right not to worship any deity. Protected religious exercise also extends to dress that is worn or food that is eaten for a religious purpose, attendance at a facility used for religious practice, observance of the Sabbath, raising money for evangelical or missionary purposes, and proselytizing.

1.19.3 Freedom of the Press. Freedom of the press includes such matters as reasonable access to news-making events, the making of documentaries, and the posting of "blogs."

15 The First Amendment does not apply to non-U.S. PERSONS outside the United States. Before submitting nominations, NOMINATORS may consult with their Department or Agency counsel to determine whether a specific person is a U.S. PERSON and whether the questioned activity is entitled to First Amendment protection.

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 10

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

1 .19.4 Freedom of Peaceful Assembly. Freedom of peaceful assembly, often called the right to freedom of association, includes gathering with others to protest government action, or to rally or demonstrate in favor of, or in opposition to, a social cause. The right to peaceful assembly includes more than just public demonstrations - it includes, as well, the posting of group websites on the Internet, recruiting others to a lawful cause, marketing a message, and fundraising, which all are protected First Amendment activities if they are conducted in support of an organizational, political, religious, or social cause.

1 . 1 9.5 Petition the Government for Redress of Grievances. The right to petition the government for redress of grievances includes, for example, writing letters to Congress, carrying a placard outside the city hall that delivers a political message, recruiting others to one's cause, and lobbying Congress or an Executive Agency for a particular result.

1.20 Equal Protection. The Equal Protection Clause of the U.S. Constitution provides in part that: "No State shall make or enforce any law which shall ... deny to any person within its jurisdiction the equal protection of the laws." The U.S. Supreme Court has made it clear that this applies as well to the official acts of U.S. Government personnel. Nominations, therefore, shall not be based solely on race, ethnicity, national origin, or religious affiliation. Any activities relating to this Guidance that are based solely on such considerations are invidious by definition, and therefore, unconstitutional.

IV. WATCHLISTING POLICIES

1.21 Watchlisting Disclosures. The general policy of the U.S. Government is to neither confirm nor deny an individual's watchlist status. In addition to the provisions in Addendum B to the TSC MOU, which require NOMINATOR approval before TSDB information can be used in any process that might result in public disclosure, the 2007 Memorandum of Understanding on Terrorist Watchlist Redress Procedures (Redress MOU)* requires SCREENERS to contact the TSC if it receives a request for information or records that might reveal an individual's watchlist status. Approval would also be required from any entity which provided information used by a NOMINATOR during a nomination. Per the Redress MOU, ORIGINATING and NOMINATING AGENCIES are obligated to support SCREENER determinations - both at the administrative level and in litigation - and provide appropriate information, including unclassified substitutes as necessary. TSC, in conjunction with NCTC, the NOMINATORS, and the Department of Justice (DOJ), as appropriate, will ensure that representations regarding an individual's potential watchlist status are properly coordinated and approved.

1.22 Legal or Use Restrictions. Because information in the TSDB comes overwhelmingly from intelligence sources and methods or sensitive law enforcement techniques. Paragraph 12 of

10 See Appendix 8, Redress MOU. UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 1 1

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Addendum B to the TSC MOUr' requires that any recipient of information from the TSDB seeking to use TERRORIST identity information in any legal or administrative process or proceeding obtain NOMINATOR approval before doing so. Approval from the entity which provided the information, if other than the NOMINATOR, is also required. Additionally, information from Foreign Intelligence Surveillance Act (F1SA) collections may only be used in a proceeding with the advance authorization of the Attorney General. Therefore, any SCREENER seeking to use TSDB information in any process or proceeding must contact TSC so that TSC can assist in obtaining approval from the NOMINATOR, owner of the information, or Attorney General, as required.

1 .23 In addition to the foregoing restrictions, there are restrictions on sharing information with foreign governments. Any TERRORIST IDENTIFIER (as described in Addendum B to the TSC MOU) will be deemed U//FOUO and shared with the watchlisting community and foreign governments for watchlisting purposes pursuant to the terms of the TSC MOU. Accordingly, NOMINATORS should include, as appropriate, TERRORIST IDENTIFIERS in documents that contain non-releasable warnings {e.g., a report is not releasable to xxx/yyy/zzz. countries), unless the TERRORIST IDENTIFIERS are restricted by some other authority that limits dissemination. If U.S. person information is otherwise authorized for release to the foreign government, the non- releasable warning is disabled to allow dissemination of the information.

V. WATCHLISTING STANDARD: IDENTIFYING AND SUBSTANTIVE DEROGATORY CRITERIA

1 .24 Before a KNOWN or SUSPECTED TERRORIST is added to the Terrorist Watchlist, TSC reviews the nomination to determine whether it meets the following minimum identifying criteria and minimum substantive derogatory criteria for inclusion in the TSDB.

1 .24. 1 Minimum Identifying Criteria. Each nomination must contain minimum identifying criteria for inclusion into the TSDB. Without this minimum identifying data, the nomination is not eligible for inclusion into the TSDB, or any of the TSC's supported systems. Chapter 2 sets forth guidance regarding both the minimum identifying biometric and biographic criteria for inclusion into the TSDB. Although TIDE accepts records containing less than these minimum criteria, such records will not be exported either to the TSDB for watchlisting or to the various supported systems used by the SCREBNERs absent an exception described in the Watchlisting Guidance.

1 .24.2 Minimum Substantive Derogatory Criteria. In addition to the minimum identifying criteria, nominations lo the TSDB are accepted based on a REASONABLE SUSPICION that the individual is a KNOWN or SUSPECTED TERRORIST derived from the

17 Set Appendix 4, Addendum B to the TSC MOU.

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 12

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

totality of the information reviewed for nomination. To demonstrate that the nomination has sufficient indicia of reliability to support this REASONABLE SUSPICION determination, nominating AGENCIES should implement processes designed to ensure that nominations are free from errors, that recalled or revised information is reviewed regularly, and that necessary corrections to nominations based on those revisions/retractions are made. NOMINATING AGENCIES should, to the extent possible given the nature of the reporting, verify the accuracy and reliability of the information included in nominations. In some cases, the NOMINATING AGENCY may not be able to evaluate the reliability of the information received; however, in such situations, the NOMINATING AGENCY can ensure that the information provided is an accurate representation of the information obtained. Chapter 3 sets forth further guidance regarding the application of the REASONABLE SUSPICION standard to TSDB nominations.

VI. WATCHLISTING PROCESS OVERVIEW

1 .25 The authorities referenced in Section II of this Chapter created the framework for the watchlisting enterprise by combining various functions of existing government entities and joining them to new organizations with counterterrorism responsibilities. The resulting watchlisting enterprise consists of ORIGINATORS, NOMINATORS, AGGREGATORS, SCREENERS and encountering agencies that are supported by the community-wide collection, nomination, and consolidation processes.

1 .26 originators, nominators, AGGREGATORS, and SCREENERS. All Executive Departments and Agencies have responsibility for collecting, collating, and sharing TERRORISM INFORMATION to support the watchlisting process. They are called ORIGINATORS because they initially collect and identify information supporting the conclusion that an individual is a KNOWN or SUSPECTED TERRORIST. An ORIGINATOR is the Department or Agency that has appropriate subject matter interest and classification authority and collects TERRORISM INFORMATION (i.e., raw information) and disseminates it or TERRORIST IDENTIFIERS to other U.S. Government entities via an intelligence report (i.e., finished intelligence) or other mechanism. In general, when an ORIGINATOR has identified international TERRORISM INFORMATION and determines that information should be provided to NCTC, the originator takes on the NOMINATOR role. A NOMINATOR is a Federal Department or Agency that has information to indicate that an individual meets the criteria for a KNOWN or SUSPECTED TERRORIST and nominates that individual to TIDE and the TSDB based on information that originated with that Agency.

1 .27 While all nominators have the duty of upholding informational standards, the NCTC and TSC are distinctly responsible for ensuring data quality and the integrity of their respective repositories. NCTC and TSC are themselves potential NOMINATORS. Analysts from the

Please note that there are also certain exceptions to the minimum biographic information and minimum substantive derogatory criteria required for Terrorist Watchlist nominations that support immigration and visa screening activities conducted by DHS and DOS. See Chapter 2, Section III and Chapter 3, Section V.

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 13

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

NCTC may discover an individual who is eligible for watchlisting while reviewing all-source information. In these cases, NCTC analysts will request that the ORIGINATOR submit a nomination for inclusion into TIDE; or, on a limited basis or during exigent circumstances, NCTC analysts may update TIDE directly with a disseminated report and notice to the ORIGINATOR(S). In instances where disseminated reporting is used to enhance TIDE, NCTC will provide notice back to the collecting agency via TIDE. TSC may also nominate TERRORISM INFORMA TION received pursuant to TERRORISM screening conducted by foreign governments.

1 .28 NCTC and TSC are responsible for reviewing both newly nominated individuals, as well as subsets of existing records, to determine if additional and/or enhancement (research) is required to locate missing information critical to the watchlisting process. In some cases, this will require research to locate additional DEROGATORY INFORMATION to meet the minimum substantive derogatory criteria for watchlisting. In other cases, this will require research to locate additional biographic or biometric identifiers, in order to provide a comprehensive record maximizing the probability of confirming a positive: match to an identity contained in the TSDB.

1 .29 AGGREGATORS are those who receive and hold TERRORISM INFORMATION and certain other non-TERRORiSM information they are authorized to receive and retain. For example, two of NCTC's main statutory missions are to serve as the (1 ) central and shared knowledge bank on KNOWN or SUSPECTED TERRORISTS and (2) primary organization in the U.S. Government for analyzing and integrating all intelligence information possessed or acquired by the U.S. Government pertaining to TERRORISM and counter-terrorism.19

1 .30 TSC takes on the role of an AGGREGATOR when a KNOWN or SUSPECTED TERRORIST is encountered and the individual's record is enhanced or updated with HNCOUNTER-related information. As noted in Paragraphs 1 .1 and 1 .7, the TSC manages the watchlisting process and plays a key role in helping Departments and Agencies determine whether an ENCOUNTER with a member of the public is one with a KNOWN or SUSPECTED terrorist. Additional TERRORISM INFORMATION or TERRORIST IDEN TIFIERS are generated during ENCOUNTERS and the Encounter Management Application (EMA)20 uses that information to update records of KNOWN or SUSPEC TED TERRORISTS.

1 .3 1 SCREENERS vet against the TSDB to determine if an individual is a possible match to a KNOWN or SUSPECTED TERRORIST in the TSDB. SCREENERS can include federal, state, local, tribal, territorial, or foreign governments and certain private entities. Screening officials include homeland security officers, consular affairs officers, transportation safety personnel, and officials of foreign governments with whom the United States has entered into a TERRORISM SCREENING INFORMATION sharing agreement pursuant to HSPD-6. Certain Departments and Agencies have components which perform both screening and law enforcement duties. If a

l9See50U.S.C. §404o.

20 EMA is an application used by the TSC to administer ENCOUNTER information. UNCLASSIFIE D//FO R OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 14

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

SCREENER believes an individual may be on the Watchlist, the screener contacts the TSC's Terrorist Screening Operations Center (TSOC). The TSOC will determine whether the individual the SCREENER has encountered is, in fact, a positive MATCH to the individual who is on the Terrorist Watchlist. The TSOC may also notify the FBI's Countcrtcrrorism Division (CTD) that there has been a positive ENCOUNTER with a watchlistcd subject. TSC's Terrorist Screening Operations Unit (TSOU) coordinates the appropriate operational response to the ENCOUNTER. Based on the TERRORISM INFORMATION made available by the originating AGENCY, the SCREENER will take action based upon its specific authorities (e.g., requiring additional screening at an airport checkpoint, denying a visa application, determining admissibility into the United States) and follow appropriate ENCOUNTER procedures, as set forth in Chapter 5.

1 .32 Collection, Nomination, Consolidation and the Use of the Terrorist Watchlist to Perform Screening Processes. The following is a chart depicting the collection, TERRORIST nomination, consolidation and screening processes:

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 1 5

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

1 .33 The arrows fade inside the TSDB cylinder because not every nomination from NCTC (for international TERRORISM) or the FBI (for domestic TERRORISM) is exported from the TSDB to SCRBENERS (represented by the multi-colored blocks at the far right of the chart). 1 For example, certain categories of individuals that do not meet the minimum identifying criteria (see Chapter 2, Section II) or the REASONABLE SUSPICION standard (see Chapter 3, Section II) can be watchlistcd to support immigration and visa screening activities by DI IS and DOS (see Chapter 3, Section V) but arc not exported to state/local/tribal SCREBNERS or foreign partners. Similarly, when ORIGINATORS provide FRAGMENTARY INFORMATION to NCTC for inclusion in TIDE, such information will not be exported from TIDE to the TSDB, unless the NOMINA TING AGENCY believes there is REASONABLE SUSPICION to believe that the individual is a KNOWN or SUSPECTED TERRORIST. FRAGMENTARY information is provided to NCTC where it can be further analyzed, connected to existing information, and added to TIDE for export to TSDB because NCTC, and not individual ORIGINATORS, has access to all the information available to the U.S. Government on a KNOWN or SUSPECTED TERRORIST.

VII. ROLES AND RESPONSIBILITES FOR THE WATCHLISTING AND SCREENING COMMUNITY

1 .34 Delineation of roles and responsibilities of NOMINA TING AGENCIES, SCREENERS, NC TC, and the TSC is critical to provide for an effective and efficient integrated Terrorist Watchlisl enterprise. While I ISPD-6 describes the broad mandate of developing an integrated watchlist system, and the TSC MOV provides a level of detail needed to fulfill that mandate, further clarification is required to ensure there arc neither gaps in the nomination process, nor wasteful redundancies.

1 .35 Pursuant to I ISPD-6, Departments and Agencies in the Executive Branch are required, to the extent permitted by law, to provide TERRORIST INFORMATION to NCTC. This process will be accomplished either through direct nomination to NCTC, or through a specific component designated by a Federal Department or Agency head fordoing so (e.g., all DOJ components are directed to nominate through the FBI; DHS Intelligence and Analysis (l&A) has oversight responsibility for all DHS nominations). Except as detailed in the sections applicable to expedited nominations (see Paragraphs 1 .58 and 1 .59), NOMINATING AGENCIES will endeavor to provide comprehensive nominations and include the maximum amount of identifying and DEROGATORY INFORMATION.22 NOMINATING DEPAR TMENTS AND AGENCIES should prioritize

31 The Terrorist Screening Database Annex D to the FBI Memorandum of Understanding with Department of Defense (DoD), signed February 22, 2012, established DoD as a screening agency customer of the TSC. The dashed line in the latter chart represents that DoD is finalizing procedures to receive and use information from the TSDB for its screening processes.

" In May 2010, the Deputies asked that nominating AGENCIES "ensure that nominations are comprehensive and include the maximum amount of identifying and DEROGATORY INFORMATION." In 2012, the Interagency Policy Committee (IPC), in coordination with NOMINATORS, SCRliT.NF.RS, NCTC and TSC, developed a prioritized list of data identifiers that arc critical to screening and identity resolution activities. This Identity Resolution and Enhancement Tiers document is available on NCTC's Watchlisting Community of Interest portal on the Joint Worldwide Intelligence Communications System (JWICS).

U NCL ASSI FI ED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 16

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

the identification of new KNOWN or SUSPECTED TERRORISTS who meet the REASONABLE SUSPICION standard, along with the identifying and DEROGATORY INFORMATION most useful to watehlisting, and screening effort, as well as assisting in identity resolution.

1.36 Each Department or Agency that nominates a KNOWN or SUSPECTED TERRORIST to NCTC for watehlisting is under a continuing obligation to provide NCTC with newly identified DEROGATORY INFORMATION or exculpatory information obtained by that Department or Agency. Each Department or Agency also has the responsibility to provide NCTC with newly identified identifying and DEROGATORY INFORMATION obtained from their Department or Agency, regardless if they were the original nominating AGENCY.

1.37 With the noted exception of the Visa Viper Program, Departments and Agencies should not nominate KNOWN or SUSPECTED TERRORISTS to NCTC based on information that they do not originate without first coordinating with the ORIGINATOR.

VIII. QUALITY CONTROL MEASURES

1 .38 In order to produce and maintain the most reliable and accurate information in TIDE, TSDB, and screening databases, quality control is considered a responsibility of all entities. NOMINATING DEPARTMENTS AND AGENCIES must establish and maintain processes, including appropriate training and guidance, to ensure information transmitted to NCTC is consistent with the source of the information.

1 .39 HSPD-6 Requirements. I ISPD-6 requires the TSC to maintain thorough, accurate, and current information concerning KNOWN or SUSPECTED TERRORISTS. For watehlisting purposes, "current" means information that the NOMINATING AGENCY reasonably believes is valid and accurate. The requirement that information be current docs not necessarily preclude information that is several years old from being included in the TSDB if there is no reason to believe the information may have changed (e.g., information regarding an individual's date of birth or TERRORIST ACTIVITY was collected 20 years ago but has not been superseded by additional information is still relevant). NOMINATORS should consider the date of the DEROGATORY INFORMATION in the context of analyzing the overall quality of the data, as well as the severity of the threat, to determine whether the individual warrants watehlisting. The date of the DEROGATORY INFORMATION may refer to both the date the information is collected (such as a report that was collected 50 years ago) as well as the date of the information that is referenced in the reporting (such as a recent report that references an event that occurred 50 years ago).

1.40 TSC MOV Obligations. Paragraph 15 of the TSC MO U provides that the TSC "will determine, according to criteria established jointly with the entity responsible for each supported system, which supported screening processes will query that entry in the consolidated TERRORIST screening database." Pursuant to that paragraph, the TSC is required to "make these determinations based on criteria and procedures developed in coordination with the Parties to this Memorandum and in consultation with the heads of appropriate Federal

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 17

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Departments and Agencies based on factors, including but not limited to, the following:

1 .40.1 the nature of the person's association with TERRORISM;

1 .40.2 the quality of the data, including credibility, reliability, and extent of corroboration; and,

1 .40.3 the extent of uniquely identifying data. . . ,"23

1 .4 1 Provide Guidance and Training. Each Agency will provide guidance on the watchlisting business process. Analysts will receive periodic refresher training, as needed.

1.42 nominating AGKNCV Procedures. Each nominator providing international TERRORIST watchlisting nominations to NCTC is responsible for the accuracy of its information and has a continuing responsibility to notify NCTC of any changes that affect the validity or reliability of such information. NCTC analysts will review each nomination for TERRORIST watchlisting prior to its inclusion into TIDE and its export to the TSDB.

1 .43 Each nominating agency should implement processes designed to ensure that nominations are free from errors, that recalled or revised information is reviewed regularly, and that necessary corrections to nominations based on those revisions/retractions are made. nominating AGENCIES should, to the extent possible given the nature of the reporting, verify the accuracy and reliability of the information included in nominations. The following represents the type of processes that each nominating AGENCY shall develop that arc tailored to each Agency's particular mission and operational environment:

1 .43. 1 Develop Adequate Factual Predicate. Each NOMINATING AGENCY will seek to obtain as much DEROGATORY INFORMATION and identifying information as practicable concerning the KNOWN or SUSPECTED TERRORIST who is being nominated.

1 .43.2 Provide Guidance and Training. Each NOMINATING AGENCY will provide guidance on the TERRORIST watchlisting nomination process and ensure that analysts involved in the nomination process are trained on a periodic basis.

1 .43.3 Require Quality Assurance Review. Each NOMINATING AGENCY will use a quality assurance process to review nominations for accuracy prior to forwarding the information to NCTC.

1 .43.4 Heightened Review for U.S. PERSONS. The nominations of U.S. PERSONS require

a See Appendix 3, TSC MOV.

■A purely DOMESTIC TERRORISM INFORMATION is provided directly to TSC by the FBI and is subject to the same conditions applicable to the nomination procedures for those associated with international TERRORISM.

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 18

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

special considerations and procedures. See Paragraph 3.15.

1 .43.5 U.S. PERSON Determinations. NOMINATORS must take reasonable steps to determine whether an individual is a U.S. PERSON.

1 .43.6 U.S. PERSON Review and Confirmation. Nominations of U.S. PERSONS to the Terrorist Watchlist shall be reviewed by the NOMINATING AGENCY'S legal counsel or a designated reviewer to confirm that the REASONABLE SUSPICION standard has been met or that the nomination meets an exception to the REASONABLE SUSPICION standard, and to ensure that the nomination conforms to Agency specific U.S. PERSON authorities and guidelines.

1.43.7 Reliability and Accuracy Limitations. Nominations will include any limitations on the reliability or accuracy of the information.

1 .43.8 Periodic Reviews. The NOMINATING AGENCY will conduct periodic reviews of their nominations of U.S. PERSONS to the Terrorist Watchlist, at minimum on an annual basis, when there is no corresponding FBI investigation to ensure that the U.S. PERSON continues to meet watchlisting criteria.

1 .43.9 Redress Procedures. As per the establishment of a formal watchlist redress process (see Chapter 1, Section XI), entities involved in the watchlisting process shall establish internal reviews and redress procedures.

1 .44 Each nominating AGENCY will have procedures that facilitate the prevention, identification, and correction of any errors in information that is shared as part of the watchlisting process. Procedures will include the review of retractions and/or corrections of information that may have been used to support a nomination. In cases where a retraction or other information has become available, the NOMINATING AGENCY will promptly send a watchlist removal request or modification, as appropriate, to NCTC. Each NOMINATING AGENCY must provide notice of any errors or outdated information to NCTC immediately unless there is an articulated reason why such notification could not be made immediately. NCTC will process and transmit to TSC such corrections upon receipt.

1.45 NCTC Review. In addition to review by NCTC analysts, NCTC will employ a quality control process to ensure that all standards and appropriate procedures have been employed, the data is accurate, and the presentation of the material is clear, concise, and complies with established definitions and conventions. NCTC must also have processes and procedures in place to ensure the information documented in TIDE and provided to the TSC is accurately transcribed. NCTC shall ensure there is a process in place for review and/or auditing of TIDE records.

25 See Executive Order 12333, as amended, and 5 U.S.C. 552a(eX7). UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 19

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

1 .46 TSC Review. TSC personnel will review the nominations received as described in Paragraph 1 .56. TSC personnel evaluate whether nominations meet watchlisting standards and weigh, as appropriate, all-source analysis before accepting or rejecting a nomination. The TSC has a critical role to play in quality control, as the TSC review is the last step before any record (including a biometric nomination where no name is available) is sent to various screening systems. As with NCTC, the TSC should ensure there is a process in place for review and/or auditing of TSC nominations and TSC records.

IX. NOMINATION PROCEDURES

1 .47 Distinctions between U.S. PERSONS under Executive Order 12333 and Aliens under the Immigration and Nationality Act. This Watchlisting Guidance generally adopts the definition of U.S. PERSON from Executive Order 12333 (as amended) for nomination procedures. Executive Order 12333 defines a U.S. person as "A United States citizen, an alien known by the intelligence clement concerned to be a permanent resident alien, an unincorporated association substantially composed of United States citizens or permanent resident aliens, or a corporation incorporated in the United States, except for a corporation directed or controlled by a foreign government or governments." The Watchlisting Guidance also contains certain exceptions to the minimum substantive derogatory standards for TERRORIST watchlisting that support immigration and visa screening activities by the DI IS and DOS to determine whether ineligibilities exist for admission to the United States or visa adjudication pursuant to the Immigration and Nationality Act (INA). Because the 1NA defines "aliens" as any person not a citizen or national of the United States, the INA admissibility provisions also apply to Lawful Permanent Residents (LPRs), in certain circumstances, who are considered U.S. PERSONS under Executive Order 12333. Consequently, NC TC developed a mechanism in TIDE to identify and distinguish U.S. citizens from non-U. S. citizens in order to further distinguish between "aliens" under the INA and U.S. PERSONS under Executive Order 12333.26

1.48 originator's Nominations Procedures. As mentioned in Paragraph 1.26, when an ORIGINATOR becomes a NOMINATOR, it prepares a nomination document and forwards it to NCTC through the nominator tool.

1 .48. 1 As a general rule, NCTC will attach all disseminated communications (cables or forms) to the TERRORIST identities record as a "source" document, which will be available on NCTC Current or the Joint Worldwide Intelligence Communications System (JWICS) to individuals who have been granted access to TIDE,

1 .48.2 Because NCTC is the conduit for passing international terrorism INFORMATION to TSC for TERRORISM screening purposes, there is no longer a need to send watchlist requests to multiple Government Agencies. By sending a Terrorist Watchlist nomination cable to NCTC, all potential U.S. Government TERRORISM screening

*Se* INA § 101(a)(3) [8 U.S.C. I IOI(a)(3)J. UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 20

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

responsibilities should be aecounted for.

1 .48.3 The DOJ has approved a Protoeol to govern TERRORIST nominations for its non-FBI components, which requires components to provide the FBI with all TERRORISM INFORMATION.27 The FBI is responsible for submitting watchlisting nominations based on information received from other DOJ components pursuant to the FBI's nomination procedures.

1 .48.4 DHS has designated the Under Secretary for I&A as the Executive Agent for DHS' centralized TERRORIST watchlisting process and he/she shall be responsible for providing a DHS wide-mechanism for nominating all identifying or DEROGATORY INFORMATION about KNOWN or SUSPECTED TERRORISTS to TIDE. DHS I&A is also responsible for providing training/certification programs to the components.

1.49 In providing information to NCTC for inclusion into TIDE, the ORIGINATOR is responsible for determining whether it may, by law, provide the information to NCTC, in accordance with section 1021(d)(6) of I RIP A. This information shall be provided with any applicable caveats or dissemination controls, which will be reflected in TIDE. The biographic and biomctric identifiers derived from this information will be deemed U//FOUO for passage to TSDB unless the ORIGINATOR designates them as "TIDE Restricted," as outlined in Addendum B to the TSC MOV.

1.50 NCTC Actions and Processes. NCTC reviews TERRORIST nominations from Federal Departments or Agencies (NOMINATORS) as described in Paragraph 1 .28.

1 .5 1 In determining whether an individual is a KNOWN or SUSPECTED TERRORIST, NCTC will rely on the designation of "known terrorist" provided by the nominator as presumptively valid. This presumption can be overcome if NCTC has specific and credible information within its possession that such designation is not appropriate, at which point NCTC will provide such information to the NOMINATOR.

1.52 In reviewing whether to include the TERRORISM information about the KNOWN or SUSPECTED TERRORIST in TIDE, NCTC reviews the totality of information. The totality of information is evaluated based on the experience of the reviewer, and the facts and rational inferences that may be drawn from those facts, including past conduct, current actions, and credible intelligence concerning future conduct. As part of this review, NCTC will determine if the information pertains to, or is related to, terrorism. TIDE includes terrorism information on KNOWN or SUSPECTED terrorists and may include additional TERRORISM informa tion beyond what meets the minimum substantive derogatory and identifying criteria required for nominations to the TSDB, as described in Paragraph 1 .24. Upon conclusion of NCTC's review, NCTC will either accept or reject the nomination:

27 See Appendix 7, DOJ Protocol on Terrorist Nominations. UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 21

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

1 .52. 1 Accept Nomination. If a nomination contains TERRORISM INFORMATION, NCTC will create or enhance the associated TIDE record with the data contained in the nomination. If the minimum substantive derogatory and identifying criteria are met, NCTC will forward the TERRORIST IDENTIFIERS to the TSC for placement in TSDB with the NOMINATOR'S watchlist recommendation.

1 .52.2 Reject Nomination. If a nomination docs not contain TERRORISM INFORMATION, NCTC may reject the nomination. NCTC will review rejected nominations and search holdings for additional data that may support a TERRORISM INFORMATION finding. If no information is found to support the nomination, NCTC will notify the NOMINATING! AGENCY of the rejection.

1 .53 Types of records in TIDE. There are two types of records in TIDE:

1 .53. 1 TERRORIST Records. The vast majority of records in TIDE are for KNOWN or SUSPECTED international TERRORISTS. These records arc labeled "terrorists." Only a small percentage of TERRORIST records in TIDE concern U.S. PERSONS.

1 .53.2 Non- TERRORIST Records. A small percentage of records in TIDE are identified and labeled "Non-TERRORISTS." 28 These records are generally of familial family members or associates of known or suspected terrorists and assist DOS and DHS in, for example, adjudicating visas and immigration processing, or assist the IC in tracking known terrorists. These "Non-TERRORISTS" include:

1 .53.2.1 Alien Spouses and Children of TERRORISTS. Based on section 2l2(a)(3)(B)(i)(IX) of the INA, alien spouses and children of TERRORISTS may be inadmissible to the United States.29 TIDE exports records pertaining to alien spouses and children of alien international TERRORISTS (also known as TIDE Category Code 17) to support immigration and visa screening activities by DOS and DHS;

1 .53.2.2 Other Relatives. TIDE also includes "non-TERRORIST" records of individuals who have a close relationship to a KNOWN or SUSPECTED international

™ TIDE records for non-U. S. citizens, including LPRs, with insufficient DEROGATORY INFORMATION to meet the REASONABLE: SUSPICION standard (TIDE Category Code 99) and records relating to an individual who has a defined relationship with the KNOWN or SUSPECTED TERRORIST, but whose involvement with the KNOWN or SUSPECTED TERRORIST'S activities is unknown (TIDE Category Code 50) are exported to the TSDB as TSDB exceptions to the REASONABLE SUSPICION standard. Additionally, individuals described by sources as "TERRORISTS'', "extremists", "jihadists", "militants", "mujahideen" or "insurgents" (TIDE Category Code 03, also referred to as a "labels plus" nomination) will be accepted into the TSDB as exceptions for export to DHS and DOS for immigration and border processing. See Paragraph 3.14.6. A complete list of TIDE Category Codes can found under the "Watchlisting Criteria Guidance" section on the Intelink website at hltp://www.intelink.qov/lsc/leual.htm.

29 "Any alien who. ... is the spouse or child of an alien who is inadmissible under this subparagraph, if the activity causing Ihe alien to be found inadmissible occurred within the last 5 years, is inadmissible." See INA § 212(a)(3)(B)(i)(IX)[8 U.S.C. I I82(a)(3)(B)(iXIX)J.

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 22

U NCL ASS I FIE D//FO R OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

TERRORIST but arc not alien spouses or children of a TERRORIST. For instance, the father or brother of a TERRORIST could have a record in TIDE (also known as TIDE Category Code 160). Thus, these "other relatives" could be U.S. PERSONS or non- U.S. PERSONS. Identifiers for these other relations reside in TIDE but are not exported to the TSC for watchlisting, absent independent DEROGATORY INFORMATION. Instead, these records may be retained in TIDE for analytic purposes;

1 .53.2.3 Passports. Unrecovered lost or stolen passports in the hands of international TERRORISTS (also known as TIDE Category Code 89);

1 .53.2.4 Associates. Individuals who have a defined relationship with the known or SUSPECTED TERRORIST, but whose involvement with the KNOWN or SUSPECTED TERRORIST'S activities is unknown (also known as TIDE Category Code 50);

1 .53.2.5 Individuals with a Possible Nexus to TERRORISM. Individuals with a possible nexus to TERRORISM and/or TERRORIST ACTIVITY but for whom additional DEROGATORY INFORMATION is needed to meet the REASONABLE SUSPICION standard (also known as TIDE Category Code 99).

1.54 Identification of U.S. PERSON Status in TIDE. NCTC analysts will review the totality of information available on a subject to discern U.S. PERSON status prior to creating or enhancing a record in TIDE, whenever possible. For existing TIDE records, this status is available to the analyst in the first field of the TIDE record. In case of external nominations or ENHANCEMENTS from the IC, the standard nomination template provides a means for NOMINATORS to identify U.S. PERSON status pursuant to Executive Order 12333 and the Agency's specific guidelines. The U.S. PERSON status field on the standard nomination template is a required field and it is the responsibility of each NOMINATING AGENCY to ensure the field is properly annotated in accordance with established policy.

1 .55 Types of Records in TIDE and the TSDB. Not all records in TIDE are included in the TSDB. For example, records with fragmen tary information that do not meet the minimum derogatory standard or records that do not meet identifying information criteria remain in TIDE and are not included in the TSDB, absent direction for temporary, threat based categories pursuant to Paragraph 1 .59. 30 The nominations process for TIDE records that will be considered for entry in the TSDB begins with an automated data transfer process that moves an individual TIDE record containing the identity of a KNOWN or SUSPECTED TERRORIST or other exportable category or record nominated for watchlisting to the TSDB.

1.56 TSC Actions and Processes. The TSC's Single Review Queue (SRQ) enables the TSC's Nominations and Data Integrity Unit (NDIU) to review each known or suspected terrorist

Certain categories of QOn-TERRORIST records (see Paragraph 1 .53.2) or nominations to the No Fly and Selectee List based on an expedited waiver of "full date of birth" requirement (see Paragraph 4. 1 8) may also be eligible for inclusion in the TSDB.

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 23

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

record nomination to ensure it meets the watch listing standard.31 The SRQ also helps ensure that all qualified records are made available to the appropriate SCREENERS for use in TERRORISM screening. During the SRQ process, every request to add, modify, or delete a TSDB record is reviewed by a TSC analyst to ensure the accuracy of watchlisting records and the removal of inaccurate records from TSDB.

1 .56. 1 Within the TSC's NDIU, experienced analysts and/or designated Agency representatives serve as Subject Matter Experts (SMBs) with respect to specific databases (e.g., No Fly or Selectee List) that receive TSDB data for TERRORISM screening purposes. The NDIU currently has four types of SMEs who specialize in the information/systems from their respective organizations: DHS/Transportation Security Administration (TSA) for the No Fly, Selectee and Expanded Selectee Lists, FBI for National Crime Information Center (NCIC)/KNOWN or SUSPECTED TERRORIST File (KSTF), DOS for the Consular Consolidated Database (CCD)32 and DHS for TECS (and its components) and the Automated Targeting System (ATS). SMEs provide guidance regarding their specific information/systems to the TSC and watchlisting standards to their Agencies. In some cases, the SME coordinates the data export to the supported system, provides feedback to NOMINATORS, and responds to inquiries regarding their supported system from other TSC customer Agencies.

1 .56.2 Upon the conclusion of TSC's review, TSC will either accept or reject the nomination:

1 .56.2. 1 Accept Nomination. Consistent with Paragraphs (7) and (8) of Addendum B to the TSC MO U, if a nomination contains the minimum substantive derogatory criteria and the minimum identifying information, TSC will create a TSDB record, include the TERRORIST IDENTIFIERS from the TIDE record, and export the TSDB record to its supported systems (i.e., databases and systems eligible to receive records from the TSDB) for the benefit of SCREENERS that conduct terrorism screening. The current supported systems include, but are not limited to, the following:

1.56.2.1.1 NCIC/KSTF;

1 .56.2. 1 .2 DOS Consular Lookout and Support System (CLASS)-VISA and CCD;

1 .56.2. 1 .3 DI IS Watchlisting Service (WLS) (e.g., TECS, ATS, Secure Flight);

1 .56.2. 1 .4 TSA Transportation Security Vetting Center;

1 .56.2. 1 .5 TSA-Officc of Intelligence Analysis (OIA);

1 .56.2. 1 .6 Tipoff United States Canada (TUSCAN);

3' See Chapter I, Section VIII, supra.

3* CCD is ail application used by DOS to administer its visa and passport applications. UNCLASSIF1ED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 24

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

1 .56.2. 1 .7 Tipoff Australia Countertcrrorism Information Control System (TACTICS).

1 .56.2.2 Reject Nomination. If a nomination lacks either the minimum substantive derogatory criteria or the minimum identifying information, and is not an exception to those requirements (e.g., TIDE Category Codes 50 or 99 as described in Paragraph 1 .53.2), TSC will reject the nomination and notify NCTC directly of its determination or coordinate with NCTC to notify the NOMINATOR of its determination. Records nominated to TIDE that are ineligible for TERRORIST watchlisting may remain in TIDE until additional information is obtained to warrant either watchlisting or removal from TIDE. NCTC analysts will review all- source information for additional identifying or substantive DEROGATORY INFORMATION. If additional information is discovered, NCTC will enhance the TIDE record and submit the record to TSC for inclusion in the TSDI3. The TIDE record will be reviewed again by the TSC to determine whether it is eligible for watchlisting in TSDB and export to certain supported screening systems.33

1.57 The number of TSC's supported systems will continue to grow as TSC, DHS, and DOS expand their domestic and international outreach efforts and finalize additional agreements to exchange TERRORISM SCREENING INFORMATION. TSC has modified the TSDB so that certain customers may query the TSDB remotely instead of receiving exports of TSDB data to their own systems.

1.58 Expedited Nomination Procedures for Individual Nominations. If exigent circumstances exist (imminent travel and/or threat) where an individual nomination into the TSDB needs to be expedited after normal duty hours, a NOMINATOR, with coordination from NCTC, may contact the TSC's TSOC directly. If a nominator coordinated with NCTC, the nomination will be received by the TSC via the SRQ in TSDB and the TSOC Watch Commander will coordinate with a NDIU Senior Analyst to process the nomination. A NOMINATOR may also contact the TSC directly and provide all relevant information using the following process:

1 .58. 1 The NOMINA TOR must first contact the TSOC at 866-1 |(toll free number) or 571

1 .58.2 The NOMINATOR will be instructed by a TSOC Specialist on how to telephonically complete a Terrorist Screening Center Expedited Nomination Request Form.

1 .58.3 In addition to basic identifying information, the nominator will be requested to provide a 24/7 point of contact should the KNOWN or SUSPECTED TERRORIST be encountered by a SCREENER.

See Paragraph 1 .24.2 supra.

U N CL ASSI FI ED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 25

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

1 .58.4 Within 72 hours of contacting the TSOC, the NOMINATOR must provide appropriate follow-up documentation that articulates, through either classified or unclassified means, the substantive DEROGATORY INFORMATION used to establish the basis for TERRORIST watchlisting.

1.59 Expedited Nomination Procedures for Temporary, Threat-Based Categories. This provision is intended to enable categories of individuals to be temporarily upgraded in watchlist status based on current and credible intelligence information or a particular threat stream that indicates a certain category of individuals may be used to conduct an act of domestic or international TERRORISM, This temporary, threat-based expedited upgrade (TBU) is made at the direction of the Assistant to the President for Homeland Security and Countcrtcrrorism or his/her designee (Appropriate Official) and should be narrowly tailored to address the threat.

1 .59.1 The goal of this provision is to fashion a watchlisting response that is appropriate to the nature, specificity, and severity of the threat. To achieve this goal, in addition to verifying the credibility of the threat intelligence, due consideration should be given to:

1 .59. 1 . 1 The harm to public safety posed by the threat;

1 .59. 1 .2 The clarity and specificity of the information giving rise to the threat as to time, place, method, and identity of the suspected perpetrators;

1 .59. 1 .3 The anticipated impact on international and domestic travel, civil liberties, and foreign relations; and,

1 .59.1 .4 The best available screening tools, other than the No Fly or Selectee Lists, given the type and specificity of identifiers and travel data.

1 .59.2 When necessitated by exigent circumstances, and where there is current and credible intelligence information or a particular threat stream that indicates a certain category of individuals may be used to conduct an act of domestic or international TERRORISM, the Appropriate Official may direct the TSC and NCTC to place categories of individuals from TIDE or TSDB on the No Fly List, Selectee List, or into the TSDB for up to 72 hours before concurrence is obtained from the Deputies or Principals Committee. To the extent practicable, the initial direction to NCTC and TSC from the Appropriate Official will be in writing. Absent DEROGATORY INFORMATION supporting individual nomination or watchlist upgrade, if written concurrence is not obtained within 72 hours of the initial direction to TSC and NCTC, the TSC will automatically remove any individuals added to the No Fly List, Selectee List, or TSDB pursuant to the TBU, until such written direction is received.

1 .59.3 The addition of categories of individuals to the No Fly List, Selectee List, or TSDB pursuant to Paragraph 1 .59.2 shall be effected for a period of time, consistent with the

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 26

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

nature of the threat involved, not to exceed 30 days but may be renewed for additional 30-day periods upon written approval of the Deputies or Principals Committee. A TBI? is valid until the threat no longer exists. To the extent that such threat recedes or is otherwise mitigated prior to the expiration of 30 days or during any extension approved by the Deputies or Principals Committee, TSC and NCTC and members of the watchlisting community shall immediately request of the Deputies or Principals Committee to downgrade these TBUs to their original or appropriate status. All threat- based records transmitted through automated mechanisms (i.e., WLS, CCD) will include a "TBU indicator" at the message level to differentiate this category of records from non-TBU records and to provide the TBU directive for which the record is upgraded.

1 .59.4 Until such time as the Deputies or Principals provide additional, written guidance, DOS will defer visa actions with respect to these expedited upgrades in watch list status.

1 .59.5 Departments and Agencies will advise the Deputies or Principals of other consequences that may result from a change in watchlist status and seek guidance as to how to proceed.

1 .59.6 After these categorical moves arc accomplished or renewed, there will be an expedited procedure for the review of all u. S. PFRSONS that are part of the TBU to ensure their watchlisting status is appropriate (including whether continued categorical watchlisting may be warranted based on the nature of the threat).

1 .60 Arbitration of Watchlisting Disputes. If a NOMINATOR wishes to dispute TSC's watchlisting determination, it may contact NCTC (for international TERRORIST nominations) to discuss the watchlisting status and/or submit additional substantive derogatory and identifying information to support its initial nomination. Additional information provided to NCTC by a NOMINATOR will be passed to the 'I SC for review and final watchlisting determination. In the case of an FBI dispute over the TSC's watchlisting determination of an international TERRORIST'S nomination, a case agent must contact the TSC.

1 .6 1 In the case of domestic TERRORIST nominations, if the FBI wishes to dispute TSC's watchlisting determination, it may contact the TSC to discuss the watchlisting status and/or submit additional substantive derogatory and identifying information to support its initial nomination.

X. PROCEDURES TO REMOVE AN INDIVIDUAL FROM THE WATCHLIST

1.62 A NOMINATOR desiring to remove an international TERRORIST identity record previously nominated to TIDF. should contact NCTC and provide written justification for the request. NCTC will promptly process the request when received. NCTC will be the final arbiter of whether the identity is removed from TIDE and TSC will be the final arbiter of whether TERRORIS T IDENTIFIERS are removed from TSDB.

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 27

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

1.63 If the NOMINATOR requesting removal of an international TERRORIST identity record from TIDE is the only nomina tor to have provided information on that record, the removal request will be immediately processed by NCTC. The removal information is then sent to the TSC, which, in turn, makes a determination regarding removal of the TERRORIST identity from the TSDB.

1.64 If multiple nominators have provided information on an international TERRORIST identity record, NCTC will coordinate with all relevant parties in an attempt to reach a consensus on the TERRORIST identity's most appropriate watchlisting status.

1 .64.1 If the multiple NOMINATORS arrive at a consensus that the watchlistcd identity is not reasonably suspected of engaging in TERRORISM and/or TERRORIST ACTIVITIES, or an applicable exception, the identity is removed from the TSDB and TIDE. In certain circumstances, NCTC may retain records in TIDE to prevent inappropriate re- walchlisting.

1 .64.2 If the multiple NOMINATORS cannot arrive at a consensus regarding the watchlisting status of an identity, TSC may decide to remove the identity from the TSDB, but NCTC may retain the identity in TIDE.

1 .64.3 For cases in which the FBI has conducted an investigation on an individual (independently nominated by another NOMINATOR) and has concluded that the watchlisted individual is not a KNOWN or SUSPECTED TERRORIST, the individual may be removed from the TSDB.34 In such cases, the TERRORIST IDENTIFIERS from the FBI's investigation may be used to supplement the TIDE record.

1 .65 The FBI will review domestic TERRORIST identity removal requests according to applicable FBI procedures.

1 .66 TSC has an established, on-going process to review every record in the TSDB in accordance with Paragraph (8)(b) of the TSC MOU and its mission under IISPD-6 to maintain the most thorough, accurate, and current information in the TSDB. If TSC determines that the watchlisting standards arc not met for an individual record, TSC will remove the record from the TSDB, in coordination with the NOMINATING AGENCY.

XI. REDRESS PROCEDURES

1 .67 In January 2005, the TSC established a formal watchlist redress process that allows Agencies

M After an FBI determination that the individual is not a KNOWN or SUSPECTED TERRORIST, NCTC may determine- based on a nominator's independent nomination- that the individual should remain in TIDE as records that have been fully vetted and should not be screened against (TIDE Category Code 140), the individual be watchlisted based upon the NOMINATOR'S independent determination that the individual is a KNOWN or SUSPECTED TERRORIST or that the individual warrants watchlisting based upon an exception to the REASONABLE SUSPICION standard.

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 28

UNCLASS1FIRD//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

that use TSDB data during a TERRORISM screening process to refer individuals' complaints to the TSC if it appears the complaints may be related to the walchlisting process. The goal of the watchlist redress process is to provide for timely and fair review of individuals' complaints and to identify and correct any errors in the TSDB.

1 .68 The watchlist redress process is a multi-Agency process involving the DHS, TSC, NCTC, NOMINATORS, and SCREENERS. On September 1 9, 2007, Agencies participating in the watchlist redress process executed the Redress MOUto set forth a coordinated redress process to respond to individual complaints about adverse screening experiences.35

1 .69 TSC's Redress Office is responsible for receiving, tracking, and researching watchlist-rclated complaints that SCREENERS refer to TSC. For each redress complaint received, the Redress Office conducts an in-depth analysis to determine if the person's complaint is related to a TSDB record, including a determination of whether the complainant is the watch listed individual or merely a near-match to a watchlist record. If the complainant is the watchlistcd individual, the TSC's Redress Office will determine whether the watchlistcd individual still meets all the watchlisting criteria.

1 .70 For each complaint, the TSC Redress Office coordinates with the NOMINATOR (via NCTC when the NOMINATOR is not the FBI), who assists in the evaluation of the complaint to ensure the most current, accurate, and thorough information available is used to review the person's watchlist status. Where appropriate and warranted by the current information and applicable criteria, a person's watchlist status may be adjusted (e.g., downgraded from the No Fly to Selectee Fist or the person's identity may be removed entirely from the TSDB). If the redress complaint was referred to the TSC from the DHS Traveler Redress Inquiry Program (DHS TRIP), the individual's adjusted watchlist status will be provided to DHS TRIP for issuance of an appropriate response.

1.71 DHS TRIP is a single point of contact for individuals who have inquiries or seek resolution regarding difficulties they experience during their travel screening or inspection at, for example, transportation hubs like airports, or when crossing U.S. borders. The DHS TRIP website is www.dhs.gov/trip. DHS TRIP ensures a thorough review is completed by consulting and sharing information with other DHS Components and other Agencies, as appropriate, to address the issues identified by the complainant.

XII. PERIODIC REVIEW OF THE WATCHLISTING GUIDANCE

1.72 This Watchlisting Guidance shall be reviewed no less than every two years following the conclusion of the previous review, or as needed.

* See Appendix 8, Redress MOW, see also FN 16, supra.

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 29

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

CHAPTER 2: MINIMUM IDENTIFYING CRITERIA

I. BIOMETRIC NOMINATIONS

2.1 Biometric information refers to the measurable biological (anatomical or physiological) and behavioral characteristics that can be used for recognition. Examples include facial photographs, fingerprints, iris scans, digital images, latent prints, DNA and gait. A biometric is sufficient to meet the minimum identifying criteria for nominations to the NCTC's TIDE and/or the TSC's TSDB, provided that the nomination also meets the minimum substantive derogatory criteria, or one of the exceptions. Biometric nominations without minimum biographic information will be provided only to those SCREENERS that have the technical capability to screen against or otherwise make assessments using the biometrics. Notwithstanding the above, all NOMINATORS are encouraged to include all available associated biographic information with any biometric nomination.

II. MINIMUM BIOGRAPHIC NOMINATION REQUIREMENT

2.2 TIDE, nominators shall provide NC'l'C, for inclusion into TIDE, FRAGMENTARY

information that suggests an individual may have a nexus to terrorism and/or terrorist ACTIVITIES and any additional information that will facilitate identification of these individuals. Nominations to TIDE under this section will be considered for inclusion in the TSDB if the NOMINATING AGENCY believes there is REASONABLE SUSPICION to believe that the individual is a KNOWN or SUSPECTED TERRORIS T.

2.2.1 Nominations of individuals based on FRAGMENTARY INFORMATION who fail to meet the minimum identifying criteria for nomination to TSDB should be provided to NCTC for inclusion in TIDE when there is DEROGATORY information suggesting that the individual is associated with TERRORISM and the NOMINATING AGENCY determines that there are sufficient identifiers for possibly facilitating a match to existing TIDE records. Unless otherwise directed, NOMINATING AGENCIES should prioritize the nominations of individuals who satisfy the minimum identifying criteria before addressing nominations based on fragmentary informa tion.

2.3 SCREENER Discretion. As appropriate, SCREENERS have the discretion to decide not to include in their screening systems common names received from the TSDB, where insufficient identifying information exists for identification.

2.4 TSDB. Nominations to the TSDB must include a last name, nominating AGENCIES should also provide any additional identifying information available. In addition to a last name, nominations must include:

2.4.1 first name;

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 30

UNCLASS1 FI ED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

2.4.2 Or any one of the following additional identifiers:

2.4.2. 1 Full date of birth (eight digit "mm/dd/yyyy" format);

2.4.2.2 Passport number (with or without country of issuance);

2.4.2.3 Unique identifying numbers such as alien registration numbers, visa numbers, and social security numbers;

2.4.2.4 Telephone number(s)36;

2.4.2.5 E-mail address(es)37;

2.4.2.6 License plate number(s).

38

2.4.3 Or any two of the following additional identifiers :

2.4.3.1 Country of citizenship, if different from place of birth;

2.4.3.2 Place of birth (city or country), if different from country of citizenship;

2.4.3.3 Circa or partial date of birth (partial: e.g., 1960; or range: e.g., 1960-1965);

2.4.3.4 Full name of an immediate family member (e.g., parent, spouse, sibling, or children);

2.4.3.5 Occupation or current employer;

2.4.3.6 Specific degrees received;

2.4.3.7 Schools attended;

2.4.3.8 Physical identifiers such as race, height, or weight;

2.4.3.9 Unique physical identifiers such as scars, marks or tattoos;

2.4.3. 1 0 Street address or other sufficiently specific location information.

16 Only unclassified phone numbers that are authorized for passage to TSC pursuant to Paragraph 7(m) of Addendum 13 to the TSC MOV, will be included in TSDB. See Appendix 4. Unclassified phone numbers will only be provided to those SCREEN ERS that have the technical capability to receive this data.

37 Only unclassified email addresses that arc authorized for passage to TSC pursuant to Paragraph 7(m) of Addendum B of the TSC MOV will be included in TSDB. See Appendix 4. Unclassified email addresses will only be provided to those SCREF.NF.RS that have the technical capability to receive this data.

58 As required here, there must be two distinct identifiers that must be sufficiently specific to account for the large number of possible matches common identifiers may produce. Tor example, if one identifier is rather common (e.g., physical identifiers), the other identifier must be more specific to permit the screening official to successfully match a record with an individual. As a further example, a nomination with the last name listed as Khan, location listed as Kabul, Afghanistan, and occupation listed as a baker alone would be insufficient for screening purposes because it is highly unlikely a successful match could be made against such data. However, a nomination with the name listed as R. Khan, location listed as residence of 123 Sunshine Street, Kabul, Afghanistan, and occupation listed as a baker at ABC Bakery, would be sufficient for screening purposes.

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 3 1

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

III. MINIMUM BIOGRAPHIC INFORMATION REQUIRED FOR EXCEPTIONS TO THE MINIMUM SUBSTANTIVE DEROGATORY STANDARDS FOR TERRORIST WATCH LISTING

2.5 There are certain exceptions to the minimum substantive derogatory standards for TERRORIST watchlisting that support immigration and visa screening activities by DI IS and DOS.39 Examples of these categories of records include, but may not be limited to, records relating to an individual who has a defined relationship with the KNOWN or SUSPECTED TERRORIST, but whose involvement with the KNOWN or SUSPECTED TERRORIST'S activities is unknown (TIDE Category Code 50) and those with insufficient DEROGATORY INFORMATION TO meet the REASONABLE SUSPICION standard for watchlisting (TIDE Category Code 99).

2.6 NOMINATING AGENCIES should provide all additional identifying information available. All nominations under this section must include a full name (first name, last name) and one of the following identifiers:

2.6.1 Full date of birth;

2.6.2 Full passport number (with or without countiy of issuance);

2.6.3 Unique identifying numbers such as alien registration numbers, visa numbers, and social security account numbers;

2.6.4 Telephone number(s);

2.6.5 Email address(es);

2.6.6 License plate numbcr(s);

2.6.7 Biometrics, such as facial image, iris scans or fingerprints.

See Chapter 3, Section V.

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 32

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

CHAPTER 3: MINIMUM SUBSTANTIVE DEROGATORY CRITERIA L INTRODUCTION AND PURPOSE

3.1 TSC issued an updated U.S. Government Protocol Regarding Terrorist Nominations on February 25, 2009, that included an appendix identifying the minimum substantive derogatory criteria for acceptance of known or SUSPECTED TERRORIST nominations into the TSDB. Based on the attempted terror attack of December 25, 2009, the Watchlisting Guidance was reviewed to determine whether adjustments were needed. The revised guidance was approved by the White House Deputies Committee on May 25, 2010 and issued to the watchlisting community on July 16, 2010, after a multi-agency classification review.

3.2 This Chapter of the Watchlisting Guidance has been updated to reflect the watchlisting community's experiences with the Guidance since issuance in July of 2010 by the Deputies Committee. One of the more notable changes of this updated version of the Watchlisting Guidance is the restructuring of instances for when PARTICULARIZED DEROGATORY information is required. Another notable change includes the re-introduction of guidance relative to the TERRORIST facilitators or supporters from an earlier version of the Watchlisting Guidance and the inclusion of additional exceptions to the minimum substantive derogatory standards for TERRORIST watchlisting that support immigration and visa screening activities of the DOS and DHS.

1 1 . REASONABLE SUSPICION

3.3 For purposes of watchlisting an individual to the TSDB, the NOMINATOR should determine whether there is REASONABLE: SUSPICION that an individual is a KNOWN or SUSPECTED

40

TERRORIST.

3.4 REASONABLE SUSPICION. To meet the REASONABLE SUSPICION standard, the NOMINATOR, based on the totality of the circumstances, must rely upon articulable intelligence or information which, taken together with rational inferences from those facts, reasonably warrants a determination that an individual is known or suspected to be or has been knowingly engaged in conduct constituting, in preparation for, in aid of, or related to TERRORISM and/or TERRORIST ACTIVITIES. There must be an objective factual basis for the NOMINATOR to believe that the individual is a KNOWN or SUSPECTED TERRORIST. Mere guesses or hunches are not sufficient to constitute a REASONABLE SUSPICION that an individual is a KNOWN or SUSPECTED TERRORIST. Reporting of suspicious activity alone that does not meet the REASONABLE SUSPICION standard set forth herein is not a sufficient basis to watchlist an individual. The facts, however, given fair consideration, should sensibly lead to the conclusion that an individual is, or has, engaged in TERRORISM and/or TERRORIST ACTIVITIES.

40 In instances where RLASONABl.K SUSPICION is not found, nominators should also determine whether the individual should be nominated to support immigration and visa screening by DHS and DOS (see Chapter 3, Section V).

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 33

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

3.5 Due Weight. In determining whether a REASONABLE SUSPICION exists, due weight should be given to the speeific reasonable inferences that a NOMINA TOR is entitled to draw from the facts in light of his/her experience and not on unfounded suspicions or hunches. Although irrefutable evidence or concrete facts are not necessary, to be reasonable, suspicion should be as clear and as fully developed as circumstances permit. For additional guidance regarding the nomination of U.S. PERSONS, see Paragraph 3. 1 5.

3.6 NOMINATORS shall not nominate an individual based on source reporting that NOMINATING personnel identify as, or know to be, unreliable or not credible. Single source information, including but not limited to "walk-in", "write-in", or postings on social media sites, however, should not automatically be discounted merely because of the manner in which it was received. Instead, the NOMINATING AGENCY should evaluate the credibility of the source, as well as the nature and specificity of the information, and nominate even if that source is uncorroborated, assuming the information supports a REASONABLE SUSPICION that the individual is a KNOWN or SUSPECTED TERRORIST or there is another basis for watchlisting the individual.

3.7 Criteria and Data Quality. To demonstrate that the nomination has sufficient indicia of reliability to support a REASONABLE SUSPICION determination, nominating agencies should incorporate processes designed to ensure that nominations are free of errors, and to the extent possible given the nature of the reporting, have not come from sources known or determined to be unreliable. NOMINATING AGENCIES should, to the extent possible, verify the accuracy and reliability of the information included in nominations. In addition to ensuring that nominations are free from errors, NOMINATING AGENCIES should implement procedures designed to ensure that recalled or revised information is reviewed regularly, and that necessary corrections to nominations based on those revisions/retractions arc made.

3.8 PARTICULARIZED DEROGATORY INFORMATION. PARTICULARIZED DEROGATORY INFORMATION is the type of information relied on to determine whether REASONABLE SUSPICION is met. This is information that demonstrates the nature of an individual's or group's association with TERRORISM and/or TERRORIST ACTIVITIES that is descriptive and specific to an event or activity, and is more than a label. For example, "Subject X provides false travel documentation for Al-Qaida operatives" is PARTICULARIZED DEROGATORY INFORMATION, whereas "Subject Y is a supporter," standing alone, is not considered

PAR TICULARIZED DEROGATORY INFORMA TION.

3.9 Potential Behavioral Indicators. In making a REASONABLE SUSPICION determination, NOMINATORS should consider behavioral indicators known to be associated with particular known or SUSPECTED terrorists. The following is a list of a few examples of those indicators. It is not an exclusive list and it includes activity that may have innocent explanations wholly unrelated to terrorism. Furthermore, some activities conducted by U.S. PERSONS or activities taking place within the United States, may be an exercise of rights guaranteed by the First Amendment. Watchlisting an individual for engaging solely in

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 34

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

constitutionally protected activities is prohibited.41 For these reasons, it is critical that each of these activities — as with all possible indicators of TERRORIST ACTIVITY — not be judged in isolation. Each must be viewed in the context in which it occurs and considered in combination with all other known information to ensure that any nomination based in whole or in part on this behavior comports with the standards set forth above:

3.9. 1 Attendance at training camps known to the IC as facilitating TERRORIST ACTIVITIES42;

3.9.2 Attendance at schools/institutions identified by the IC as leaching an ideology that includes the justification of the unlawful use of violence or violent extremism;

3.9.3 Repeated contact with individuals identified by the IC as teaching or espousing an ideology that includes the justification of the unlawful use of violence or violent extremism; or,

3.9.4 Travel for no known lawful or legitimate purpose to a locus of TERRORIST ACTIVITY. DO. KNOWN TERRORISTS

3.10 Definitions.

3. 1 0. 1 KNOWN TERRORIST. A KNOWN TERRORIST is an individual whom the U.S. Government knows is engaged, has been engaged, or who intends to engage in TERRORISM and/or TERRORIST ACTIVITY, including an individual (a) who has been charged, arrested, indicted, or convicted for a crime related to TERRORISM by U.S. Government or foreign government authorities; or (b) identified as a TERRORIST or member of a designated foreign terrorist organization pursuant to statute. Executive Order or international legal obligation pursuant to a United Nations Security Council Resolution.

3.10.2 TERRORISM and/or TERRORIST ACTIVITIES. In general, TERRORISM and/or TERRORIST ACTIVITIES are acts that: (a) involve violent acts or acts dangerous to human life, property, or infrastructure that may be a violation of U.S. law, or may have been, if those acts were committed in the United States; and, (b) appear intended to intimidate or coerce a civilian population, influence the policy of a government by intimidation or coercion, or affect the conduct of government by mass destruction, assassination, kidnapping, or hostage-taking. This includes activities that facilitate or support

41 See Chapter I , Section III.

42 Attendance at TERRORIST training camps alone meets the RliASONABLl- SUSPICION standard. Note that under the IN A section 212 (a)(3)(BXi)(VHI)|8 U.S.C. 1 182(a)(3)(BXi)(VIII)], an alien who has received military-type training (as defined in section 2339D(cKl ) of Title 1 8, United States Code) from or on behalf of any organization that, at the time the training was received, was a terrorist organization as defined in clause (vi), is inadmissible. Note also that 1 8 U.S.C. section 2339D criminalizes receiving military type training from a designated foreign terrorist organization.

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 35

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

TERRORISM and/or TERRORIST ACTIVITIES.

3. 1 1 Types of known TERRORISTS for Whom reasonable SUSPICION is Established by Recognized Authority and for Whom Particularized Derogatory Information is Not Required.

3.11.1 Arrested or Convicted TERRORISTS.44 Individuals who have been arrested or convicted for TERRORIST ACTIVITY arc considered KNOWN TERRORISTS who should be nominated. The arrest or conviction is presumed to meet the REASONABLE SUSPICION standard for watchlisting unless there is reason to believe that the information is questionable (e.g., faulty or erroneous), of dubious origin (e.g., poison pen, source known to be unreliable, or politically motivated) or the result of an unreliable process (e.g., conviction by a court that docs not adhere to minimally acceptable due process standards). Nominations should include the charge, location, and date of the arrest or conviction, if available.

3.1 1 .2 Individuals Identified Pursuant to Statute or Executive Order.45 Pursuant to Executive Order 13224, as amended, "Blocking Property and Prohibiting Transactions with Persons who Commit, Threaten to Commit, or Support Terrorism," Executive Order 12947, as amended, "Prohibiting Transactions with Terrorists Who Threaten to Disrupt the Middle East Peace Process," and section 302 of the Antiterrorism and Effective Death Penalty Act of 1996 (AEDPA), the U.S. Department of the Treasury's Office of Foreign Assets Control (01'' AC) publishes, updates, and maintains an integrated and comprehensive list of designated parties with whom U.S. PERSONS are prohibited from providing services or conducting transactions and whose assets are blocked. The names on this list include persons designated under country-based and list-based economic sanctions programs, as well as individuals and entities designated under the various Executive Orders and Statutes aimed at TERRORISM. Persons designated under Executive Order 13224, Executive Order 12947, or the AEDPA are included on this integrated and comprehensive list and are 'Specially Designated Global Terrorists' (SDGTs), 'Specially Designated Terrorists' (SDTs), or 'Foreign Terrorist

43 TERRORISM and/or TI-RRORIST ACTIVITIES include acts thai the actor knows or reasonably should know affords material support to any individual who the actor knows or reasonably should know, has committed or plans to commit a terrorist activity, to a terrorist organization or to any member of such an organization. Material support includes providing a safe house, transportation, communications, funds, transfer of funds or other material benefit, false documentation or identification, weapons (including chemical, biological, or radiological weapons), explosives, or training for the commission or an act of TERRORISM and/or TERRORIST ACTIVITY.

44 See Paragraph 3. 1 3. 1 for situations involving individuals who are acquitted or against whom charges arc dismissed for a crime related to TERRORISM.

45 These authorities generally authorize the Secretary of State (in consultation with either the Secretary of the Treasury, the Attorney General, the Secretary of Homeland Security, or a combination thereof) to designate and block the assets of Ibreign individuals and entities that commit, or pose a significant risk of committing, acts of TERRORISM that threaten the security of U.S. nationals or the national security, foreign policy, or economy of the United States. Additionally, leaders or members of a Foreign Terrorist Organization (FTO), an Specially Designated Global Terrorist (SDGT) under Executive Order 13224, or an organization named to the Terrorist Exclusion List ( TEL) may be designated as a terrorist organization by the Secretary of State for immigration purposes pursuant to INA section 212(a)(3)(BXvi)(II) [8 U.S.C. M89(a)(3)(B)(vi)(II)].

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 36

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Organizations' (FTOs), respectively, and should be nominated accordingly. NOMINATORS should regularly eheck the Specially Designated Nationals List (SDNL) as individuals are added and dropped as new information becomes available.

3. 1 1 .3 Individuals Identified as TERRORISTS Pursuant to a United Nations Security Council Resolutions (UNSCR) Concerning Al-Qaida and Associated Individuals and Entities. Under UNSCR resolution 1267 (1999), modified and strengthened by subsequent resolutions, including resolutions 1333 (2000), 1390 (2002), 1445 (2003), 1526 (2004), 1617 (2005), 1735 (2006), 1822 (2008), 1904 (2009), and resolution 1989 (201 1), sanctions measures now apply to designated individuals and entities associated with Al-Qaida, wherever loeatcd. The names of the targeted individuals and entities are placed on the Al-Qaida Sanctions List.47 Under the UNSCR sanctions regime, the United States has an international legal obligation to prevent the entry into or transit through its territory of designated individuals listed on the Al-Qaida Sanctions List. NOMINA TORS should regularly check the Al-Qaida Sanctions List as individuals are added and dropped as new information becomes available.

3.1 1.4 Individuals Identified as terrorists Pursuant to the National Intelligence Priorities Framework of Counterterrorism. Members of groups (not support entities) that are identified on the National Intelligence Priorities Framework of Counterterrorism, (NIPl-'-CT) are presumed to meet the REASONABLE SUSPICION standard so long as the group name is not just a regional or activity-based characterization. Neutral associations such as janitorial, repair, or delivery services of commercial goods do not meet the REASONABLE SUSPICION standard.

IV. SUSPECTED TERRORISTS

3.12 Definition.

3.12.1 A SUSPECTED TERRORIST is an individual who is REASONABLY SUSPECTED to be, or has been, engaged in conduct constituting, in preparation for, in aid of, or related to TERRORISM and/or TERRORIST ACTIVITIES based on an articulable and REASONABLE SUSPICION.

3. 1 3 Types Of SUSPECTED TERRORISTS.

6 The comprehensive list of SDGTs and SDTs is accessible through the OI'AC website at the following URL: http://www.trcasurv.eov/resourcc-ccntcr/snnclions/SDN-List/Paucs/dcfault.nspx

Narrative summaries of the reasons for listing individuals, groups, undertakings and entities on the Al-Qaida Sanctions List (where available) can be found at the following URL: http://www.un.oru/sc/committccs/1267/narrativc.shlml.

w Many persons designated under UNSCR 1267 and Executive Order 13224 are or have been engaged in financial support, facilitation, and other activities in support of Tl-RRORISM. They often, however, do not meet the current criteria for placement on the No Ely List. Dl IS and DOS will review the information provided about these individuals and take actions, as appropriate.

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 37

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

3. 13.1 Individuals Who are Acquitted or for Whom Charges are Dismissed. An individual who is acquitted or against whom charges arc dismissed for a crime related to I ERRORJSM may nevertheless meet the REASONABLE SUSPICION standard and appropriately remain on, or be nominated to, the Terrorist Watchlist.49 Each case should be evaluated based on the facts of the underlying activities, the circumstances surrounding the acquittal or dismissal, and all known DEROGATORY INFORMATION to determine if the individual should remain on the Terrorist Watchlist.

3. 1 3.2 Individuals Identified as TERRORISTS Pursuant to Other Internal Department or

Agency Processes. Departments or Agencies that nominate individuals associated with a terrorist group that is not designated by Statute or Executive Order (see Paragraph 3. 1 1 .2) or groups that fall outside of the NIPF-CT construct (see Paragraph 3.114) must have internal processes to review the activities of TERRORISTS and terrorist organizations. So long as a Department's or Agency's internal process has determined that a group is engaging in TERRORISM and/or TERRORIST ACTIVITIES, REASONABLE SUSPICION can be met for members of the group, or active participants in, that group's l BRRORIST ACTIVITIES. Departments and Agencies that use this clause to recommend subjects for watchlisting arc required to provide written notice to NCTC and I SC (an email will suffice) of the Department or Agency's determination. While members or active participants of such groups may be nominated without PARTicui ARIZED DEROGATORY INFORMATION, the watchlisting 0r an individual pursuant to this clause must be based on the determination by a Department or Agency's internal processes that the group is engaging in terrorism and/or terrorist activities. Neutral associations like janitorial, repair, or delivery services of commercial goods do not meet the REASONABLE SUSPICION standard.

3. 1 3.3 Individuals Identified as terrorists Pursuant to Agreements by U.S. Government Agencies/Foreign Governments for Sharing of TERRORIST Identity Data. The U.S. Government may enter into agreements with foreign governments for the sharing of terrorist identity information. Pursuant to such agreements data will be provided to the TSC for TERRORIST screening, as required under HSPD-6. The Information Sharing and Access (ISA) Interagency Policy Committee (IPC) or an IPC- designatcd interagency body, will make a determination, country by country, prior to the final agreement on whether the data provided will (1) be presumed to meet the standard for inclusion in TSDB; or (2) undergo the Foreign Partner Vetting Process.

3. 1 3.4 Individuals Identified as Associates or Affiliates of known or SUSPECTED TERRORISTS or terrorist Cells or Networks.50 Individuals who are associated or afl. hated with a known or SUSPECTED terrorist, or TERRORIST cells or networks should be nominated when there is PARTICULARIZED DEROGATORY INFORMATION

Because he RhASONABl.i; SUSPICION slandard required for walchlisting is lower than (hat required for a criminal conviction (,., beyond a reasonable doubt), an individual that is acquitted or for whom charges arc dismissed may qua Mfy for watchl.s.mg based on the facts and circumstances surrounding the acquittal or dismissal *

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 38

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

regarding the context oi the relationship that gives rise to a REASONABLE suspicion that the individual is engaging or has engaged in conduct constituting, in preparation for in aid of, or related to TERRORISM and/or TERRORIST ACTIVITIES. Neutral associations such as janitorial, repair, or delivery services of commercial goods arc not sufficient Information about the pertinent activities of the known or SUSPECTED terrorist TERRORIST cell or network should be included in the nomination. These nominations should include context or content to demonstrate the membership, association or affiliation to the KNOWN or SUSPECTED terrorist, terrorist cell or network Individuals who merely "may be" members, associates or affiliates to a terrorist organization may not be accepted into the TSDB, unless the REASONABLE SUSPICION standard is met and particularized derogatory informa tion accompanies the nomination.

3. 1 3.4. 1 Inferences that Support reasonable suspicion, reasonable suspicion may be rationally inferred from the context of the relationship with the known or SUSPECTED terrorist. The following factors should be considered when determining whether reasonable suspicion may be inferred:

3.13.4.1 . 1 The nature or the activity engaged in with the known or SUSPECTED terrorist;

3. 1 3.4. 1 .2 The frequency, duration, or manner or their contact;

3.1 3.4. 1 .3 A close, continuing, or direct relationship with a known or SUSPECTED terrorist that reasonably suggests the individual is knowingly involved in or willfully supporting the known or SUSPECTED terrorist's terrorist activities; or,

3.13.4. 1 .4 Other malevolent or illicit factors that can be articulated that would support a REASONABLE SUSPICION that the individual is engaging in TERRORISM and/or TERRORIST ACTIVITIES.

3. 13.5 Individuals Identified as TERRORIST Facilitators. TERRORIST facilitators arc

presumed to meet the REASONABLE suspicion standard. The nomination should include PARTICULARIZED DEROGATORY INFORMATION concerning the type of "facilitation" involved and the role of the facilitator when this information is known. Individuals who are considered facilitators include, but are not limited to, financial fundraisers, document forgers, travel facilitators, money launderers, and arms merchants. There must be REASONABLE SUSPICION that the facilitator knew that his or her actions would aid in the furtherance of terrorism and/or terrorist activities.

3.1 3.5. 1 Criminal Activity Supporting terrorism. If intelligence or information indicates that the individual is engaging in criminal activity related to smuggling, providing safe houses, forging documents, or any other support to terrorist s or terrorist groups, NOMINATORS should presume that the individual is knowingly engaging in criminal activity that supports t errorism and/ or terrorist

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 39

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

ACTIVITIES. In these circumstances, REASONABLE SUSPICION is based on the terrorist criminal activity and should be described in the nomination.

3.13.6 Individuals who Incite Others to Commit Acts of TERRORISM.51 Inciting an individual to commit an act of TERRORISM and/or terrorist ACTIVITIES under circumstances that indicate an intention to cause death or serious bodily harm is considered engaging in terrorist ACTIVITY and is sufficient to meet the REASONABLE SUSPICION standard. The nomination should include PARTICULARIZED DEROGATORY information concerning the type of "incitement" involved and the role of the individual when this information is known. Normally, speech will not rise to the level of "inciting" unless there is a clear link between the speech and an actual effort to undertake the terrorist activity. The individual may have incited terrorist activity, even if a terrorist attack docs not actually occur (e.g., because an attempt to commit such activity is thwarted). Speech advocating a violent or dangerous TERRORIST ACTIVITY is incitement if such advocacy is directed to inciting or producing imminent lawless action and is likely to incite or produce such action.

3. 13.7 Individuals Who Solicit Others to Engage in terrorist ACTIVITIES. In an

individual capacity or as a member of an organization, any individual who solicits another to engage in a TERRORIS T ACTIVITY and/or for membership in a terrorist organization is considered to be engaging in TERRORIST ACTIVITY. Nominations that include PARTICULARIZED DEROGATORY INFORMATION concerning the type of solicitation involved and the role of the individual are sufficient to meet the REASONABLE SUSPICION standard. An individual may fall outside the scope of engaging in the solicitation of an individual for membership in a terrorist organization if there is information that demonstrates that the individual did not know and should not have reasonably known that the organization was a terrorist organization.

3.13.8 Individuals Identified as Sympathizers and Supporters of a Designated Terrorist Organization.' Sympathizers and supporters of a designated terrorist organization (DTO) (see Paragraph 3.11 .2) may be watch listed when the REASONABLE SUSPICION standard is met, and the nomination includes PARTICULARIZED DEROGATORY INFORMATION concerning the how the individual's activities warrant watchlisting, as opposed to information about why the organization is a DTO.

3. 1 3.8. 1 A sympathizer or supporter of terrorism should be nominated if the support is operational in nature. If support is merely ideological, the individual should not be nominated.

51 For situations where there is no PARTICULARIZED derogatory information, individuals may be watchlistcd as an exception to the REASONABLE suspicion standard. See Paragraph 3.14.3.

S2Ashcrqft v. Free Speech Coalition, 535 U.S. 234, 122 S.Ct. 1389 (2002); 9 FAM 40.32 N2.5, "Advocacy of Tcrrorisr Not Always Exclusionary ."

For situations where there is no PARTICULARIZED DEROGATORY INFORMATION, supporters of a designated terrorist organization (DTO) may be watchlistcd as an exception to the REASONABLE SUSPICION standard. See Paragraph 3.14.4.

UNCL ASSI FI ED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 40

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

3. 1 3.9 Individuals Identified as FOREIGN FIGHTERS. FOREIGN FIGHTERS are defined as nationals of one country who travel or attempt to travel to another country to participate in TERRORISM and/or TERRORIST ACTIVITIES, and to the extent possible, the nomination should include PARTICULARIZED DEROGATORY INFORMATION. Behavior that qualifies as PARTICULARIZED DEROGATORY INFORMA TION is the travel to a foreign country to participate in TERRORISM and/or TERRORIST ACTIVITIES.

3. 1 3.9. 1 A person is not considered a FOREIGN FIGHTER when he or she traveled from Country A to Country B for non-TERRORlST reasons (e.g.. enrolling in school). Inferences that someone is a foreign FIGHTER may not be drawn solely from biographic facts that indicate a person was born in one country and is found in a different country and suspected to be participating in terrorism and/or TERRORIST ACTIVITIES.

3.13.10 Special Consideration for Individuals Involved with terrorist- Associated Weapons. Individuals who possess, handle, use, manufacture, sell, or transfer Improvised Explosive Devices (IF.Ds), Explosively Formed Penetrators (EFP), Radiological Dispersion Devices (RDD), or improvised chemical, biological, radiological, or nuclear (CBRN) devices, arc presumed to meet the REASONABLE SUSPICION standard due to the inherently dangerous nature of these items or when it can reasonably be inferred from the context that there is a connection to TERRORISM and/or TERRORIST ACTIVITIES (e.g., Iraq, presence of other KNOWN or SUSPECTED TERRORISTS, previous attacks on or threats to U.S. Forces).

3.13.11 Targets of Raids Conducted by the U.S. Military or the Intelligence Community. REASONABLE SUSPICION is presumed where an individual was identified as the target of a raid to disrupt a FTO. When an individual is identified by discovery of information found during the course of such a raid conducted by the U.S. Military or the IC, however, REASONABLE SUSPICION is met where the available PARTICULARIZED derogatory information explains why he or she can be reasonably suspected of engaging or having engaged in conduct constituting, in preparation for, in aid of, or related to TERRORISM and/or TERRORIST ACTIVITY. If there is no PARTICULARIZED DEROGA TORY INFORMATION on the individual for whom information was discovered during the raid, he or she should not be nominated.

3.13.12 Individuals Identified as TERRORISTS via Documentation or Media Exploitation Efforts. Any individuals identified in documents or media otherwise captured by U.S. or allied forces or obtained from a NOMINATING AGENCY must have a connection to TERRORISM and/or TERRORIST ACTIVITIES in order to be nominated to the Terrorist Watchlist. REASONABLE SUSPICION for an individual to be nominated from document and media exploitation (DOMEX) materials may be established either by the content or context of the DOMEX, or other sources. Nominations under this section must include

PARTICULARIZED DEROGATORY INFORMATION. For example, REASONABLE SUSPICION for watchlisting can be met based on the acquisition of documents/media identifying a person from the countertcrrorism operation that targeted the residence of Al-Qaida

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 41

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

leader Usama bin Laden on May 2, 201 1 ,M Likewise, individuals listed on a roster of an IED cell could be nominated solely on the presence of their name on the list. An identity from a captured passport, however, would only be watchlisted if additional reporting documents REASONABLE SUSPICION to believe that the individual is connected to TERRORISM and/or TERRORIST ACTIVITY.

3.13.13 LONE WOLVES. Because the focus is on the individual's TERRORlSM-rclated conduct, "LONE wolf" TERRORISTS should be nominated when particularized derogatory INFORMATION and their actions support a REASONABLE SUSPICION that they are engaged in, or have engaged in, TERRORISM and/or TERRORIST ACTIVITIES. No present known affiliation with a terror group, organization, or cell is required but prior affiliations, if they exist, may be taken into account for supporting a rational inference that the individual is reasonably suspected of engaging in TERRORISM and/or TERRORIST ACTIVITIES.

V. EXCEPTIONS TO SUPPORT IMMIGRATION AND VISA SCREENING ACTIVITIES BY DHS AND DOS

3.14 TSOB Minimum Substantive Derogatory Exceptions to Support Immigration and Visa Screening Activities by the DHS and DOS. The Watchlisting Guidance contains certain exceptions to the minimum substantive derogatory criteria for TERRORIST watchlisting that support immigration and visa screening activities by the Dl IS and DOS to determine whether grounds exist to deny admission of aliens to the United States (including denials of visas) or to deny other immigration benefits pursuant to the INA.55 PARTICULARIZED DEROGATORY INFORMATION is not required for nominations made pursuant to the following sections. Because the INA defines "aliens" as "any person not a citizen or national of the United States"" , the INA admissibility provisions also apply to LPRs, in certain circumstances including those described in INA section 101(a)(13)(C)[8 U.S.C. 1 101(a)(13)(C)], who are considered as U.S. persons under Executive Order 12333. Consequently, NCTC developed a mechanism in TIDE to identify and distinguish U.S. citizens from non-U. S. citizens in order to further distinguish between "aliens" under the INA and U.S. PERSONS under Executive Order 12333. The following subsections are exceptions to the REASONABLE SUSPICION standard and will only be transmitted to DOS's CLASS (via the DOS CCD) and DI IS's WI.S to support immigration and visa screening processes.

" Such documents/media, however, still need to be reviewed to ensure that innocent individuals arc not erroneously watchlisted.

" INA section 21 2(a)(3KB)[8 U.S.C. 1 182(a)(3)(B)) sets forth several grounds for inadmissibility based on terrorist

activities, which is defined in INA section 212(a)(3XB)(iii)[8 U.S.C. 1 l82(a)(3)(B)(iii)|. For example, INA section

212(a)(3)(B)(i)(VII) slates that any alien who "endorses or espouses terrorist activity or persuades others to endorse or

espouse terrorist activity or support a terrorist organization" is inadmissible to the United States. 8 U.S.C.

1 1 82(a)(3)(BXi)(VII)l. All other uses of the term "terrorist activities" within this Watchlisting Guidance that do not

specifically reference the INA follow the definition outlined in Chapter 1 and Appendix 1.

56 See INA § I01(a)(3)[8 U.S.C. 1 101(a)(3)].

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 42

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

I Spouses and Children. Spouses and children" of a KNOWN or SUSPECTED alien TERRORIST cannot be considered TERRORISTS without a REASONABLE SUSPICION that they arc engaging or have engaged in conduct constituting, in preparation for, in aid of, or related to TERRORISM and/or TERRORIST ACTIVITIES. The INA provides that the alien spouse or alien child of an alien who is inadmissible for certain specified reasons relating to terrorist activities, if the activity causing the alien to be found inadmissible occurred within the last five (5) years, is inadmissible.59 An alien spouse or child of an alien who is believed to be inadmissible under the INA for terrorist activities should be nominated. No additional DEROGATORY INFORMATION (in addition to familial relation) is required for nomination under this section, if the individual meets the below qualifications.

3.14.1.1 To qualify for watchlisting, alien spouses and children of a KNOWN or SUSPECTED TERRORIST must:

3.14.1.1.1 Be an alien (not a U.S. citizen or national), which includes LPRs; and,

3.14.1.1.2 Bean unmarried child under the age of 21 or a spouse of an alien.

3. 1 4. 1. 2 Ex-spouses, widows, or widowers should not be nominated unless there is a REASONABLE SUSPICION to believe that they themselves are engaging or have engaged in conduct constituting, in preparation for, in aid of, or related to TERRORISM and/or terrorist activities. Deceased spouses should not be nominated unless they are specifically covered in Paragraph 3.17.

3.14.1 .3 Once a spouse or child no longer meets the definitional requirements under this section, such an individual should no longer be watchlisted unless there is a REASONABLE SUSPICION to believe that the individual is engaging in terrorism and/or terrorist ACTIVITIES. For example, if a child reaches the age of 21 and there is REASONABLE SUSPICION to believe he or she was knowingly involved in TERRORIST ACTIVITY by providing material support to a FTO, he or she can remain watchlisted based upon this DEROGATORY INFORMATION. On the other hand, once a child of a known or suspected TERRORIST turns 21 years of age, the individual should no longer be watchlisted under this exception because he or she is not considered a child of the known or SUSPECTED TERRORIST and additional derogatory INFORMATION would be needed to meet the reasonable suspicion standard.

ss The INA defines "child" as "an unmarried person under 21 years of age " INA § 10l(b)(l )|8 U.S.C 1 101(b)(1)].

The discussion in Paragraph 3.14.1 is limited exclusively to spouses and children; all other family members (including mothers, fathers, sisters and brothers) should be nominated for inclusion in the TSDB only if there is derogatory information that the individual has a close connection to a KNOWN or suspected terrorist and that connection meets the REASONABLE SUSPICION standard. Absent independent DEROGATORY INFORMATION, records for these individuals may be retained in TIDE for analytic purposes. See Paragraph 1.53.2.2 for treatment of these other family members as "non-TERRORlST" records that may reside in TIDE for analytic purposes but arc not exported to the TSDB (known as TIDE Category Code 160).

59 See INA § 2l2(a)(3)(B)(i)(IX)l8 U.S.C. 1 1 82(a)(3)(B)(i)(IX)]. While this provision does not apply when the activity causing the alien to be found inadmissible occurred more than 5 years before the spouse or child's admissibility is being considered, the analysis of the time limit's application will be determined by SCREENERS upon ENCOUNTER.

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 43

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

3. 1 4.2 Endorsers and Espouscrs. An alien who endorses or espouses TERRORIST activity or persuades others to endorse or espouse terrorist activity or support a terrorist organization may be inadmissible under the INA and should be nominated.

3. 14.3 Incitement. Inciting an individual to commit an act of TERRORISM and/or TERRORIST ACTIVI TY under circumstances that indicate an intention to cause death or serious bodily harm is considered engaging in TERRORIST ACTIVITY. The individual may be inadmissible under the INA and should be nominated.

3.14.4 Supporters of a Designated Terrorist Organization. Supporters of a DTO may be

inadmissible under the INA and should be nominated if the support is operational in nature. If support is merely ideological, the individual should not be nominated.

3.14.5 Representatives. Representatives of terrorist organizations and representatives of any political, social or other group that endorses or espouses TERRORIST ACTIVITY may be inadmissible under the INA and should be nominated. Representatives include an officer, official, or spokesman of an organization, and any person who directs, counsels, commands, or induces an organization to engage in TERRORIST ACTIVITY. Neither membership in, nor association with, the organization or group is required.

3.14.6 TERRORISTS, Extremists, Jihadists, Militants, Mujahideen or Insurgents.60

Nominations of individuals described by sources as "TERRORISTS", "extremists", "jihadists", "militants", "mujahideen" or "insurgents"61, (an exclusive list) will be accepted into the TSDB as exceptions for export to DHS' WLS and DOS' CLASS- VISA and CLASS-PASSPORT for immigration and border processing when the following four conditions apply:

3.1 4.6. 1 The individual is a not a U.S. Citizen or National (e.g., the individual is a foreign national or a LPR);

3.1 4.6.2 The context suggests a nexus to TERRORISM;

3.14.6.3 Adequate identifiers are available to permit identification62; and,

3. 1 4.6.4 The information has been evaluated as being credible.

3.14.6.5 It is important to recognize that some activities associated with extreme political or religious views expressed by aliens in the United States may constitute the exercise of rights guaranteed by the First Amendment (e.g., the rights to free speech, assembly and religious exercise).63 Therefore, someone so labeled based

This exception is commonly referred to as "label plus" nomination.

Insurgency is defined as an "organized movement" aimed at the overthrow of a constituted government through the use of subversion and armed conflict

6- An adequate identifier is a biomctric, or a last name, first name and any one of the additional identifiers listed in Chapter 2, Section II.

63 See Chapter I , Section III concerning constitutionally protected activities. UNCL ASSI FI E D//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 44

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

in part on this type of constitutionally protected activity, must have other substantive DEROGATORY INFORMATION indicative of TERRORIST intent. As previously noted, nominations may not be made based solely on protected activity.

3.14.7 Additional Derogatory Information Required (TIDE Category Code 99s and

50s). NCTC will retain a record in TIDE if it is determined that the information pertains to, or is related to, terrorism.64 However, if a record involving an alien, which includes LPRs, does not contain sufficient DEROGATORY INFORMATION to meet any of the aforementioned exceptions to the TSDB's REASONABLE SUSPICION standard for inclusion, NCTC will generally designate the record as a Category Code 99 (the TIDE category code "applied when DEROGATORY INFORMATION docs not meet the reasonable SUSPICION standard for watchlisting because it is very limited or of suspected reliability but there is a possible nexus to TERRORISM") or a Category Code 50 (the TIDE category code applied when an individual has a defined relationship with the KNOWN or SUSPECTED TERRORIST, but whose involvement with the KNOWN or SUSPECTED TERRORIST'S activities is unknown)65, making it available for export to TSDB for use by DOS and DI IS for visa adjudication and immigration processing.

VI. SPECIAL CONSIDERATIONS

3. 1 5 Nominations of U.S. persons. Nominations of U.S. PERSONS, in accordance with the Attorney General approved procedures applicable to each element of the IC66, will be made pursuant to the procedures set forth below to ensure compliance with this REASONABLE SUSPICION standard. Nominations of U.S. PERSONS shall be made based on information from sources of known reliability or where there exists additional corroboration or context supporting REASONABLE SUSPICION. NOMINATING AGENCIES will review information on U.S. PERSONS pursuant to procedures set forth below consistent with the nature of the reporting supporting the nomination and the protection of sources and methods.

3.15.1 Special handling is warranted for U.S. PERSONS nominated for watchlisting, especially by an Agency other than the FBI. To ensure compliance with the Watchlisting Guidance that the reasonable suspicion standard exists for U.S. PERSONS in the TSDB, as well as to ensure proper interagency coordination, a formal process has been implemented that:

3.15.1.1 Ensures the FBI is aware of U.S. PERSONS nominated by any other Department or Agency;

64 See Paragraph 1 .26.

65 See FN 28, supra.

66 The referenced procedures are those approved for each clement of the IC pursuant to Executive Order 12333, as amended, which states in relevant part, "Elements of the Intelligence Community are authorized to collect, retain, or disseminate information concerning United States persons only in accordance with procedures established by the head of the Intelligence Community element concerned or by the head of a Department containing such element and approved by the Attorney General, consistent with the authorities provided by part I of this Order after consultation with the Director." See Executive Order 12333, Paragraph 2.3, as amended by Executive Order 13618 (July 6, 2012).

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 45

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

i. 1 5. 1 .2 Requires review of the watchlist nomination decision and concurrence by the TSC that REASONABLE SUSPICION exists for watchlisting;

.15.1 .3 Ensures there is interagency awareness of all U.S. PERSON nominations (FBI or otherwise); and,

.15.1.4 Ensures there is U.S. Government coordination in the investigation and/or intelligence gathering on these individuals, including strategies for engagement with foreign partners if required.

5.2 NCTC should include in TIDE U.S. PERSONS who are under International TERRORISM Preliminary Investigation by the FBI but who have not been deemed to meet the REASONABLE SUSPICION standard and U.S. persons with a nexus to terrorism, but for whom there is insufficient DEROGATORY INFORMATION to support entry in TSDB. These TIDE records on U.S. persons will not be provided to TSC for export via the TSDB unless approved of as an exception to the REASONABLE SUSPICION standard pursuant to Section V in this Chapter of the Watchlisting Guidance, infra, or as part of a TBU pursuant to Paragraph 1.59 of the Watchlisting Guidance.

5.3 For U.S. PERSONS nominated by other Government Agencies who are not under FBI investigation, NCTC analysts receive, process, and export these subjects for inclusion in the TSDB, as appropriate under current procedures. As part of the processing, NCTC analysts identify and share these U.S. PERSON identifiers with the FBI's Foreign Terrorist Tracking Task Force (FTTIT) for assessment, and notifying the FBI case agent of the inclusion.

3.16 Political Figures or Purposes. Heads of State or other Government officials should be nominated when there is particularized derogatory information to support a REASONABLE SUSPICION to believe the individual is engaging or has engaged in conduct constituting, in preparation for, in aid of, or related to TERRORISM and/or TERRORIST activities. Waivers or other appropriate action can be requested from U.S. Customs and Border Protection (CBP) in coordination with DOS to facilitate the travel of a properly watchlisted I lead of State or other government officials to the extent necessary.

3.16.1 Watchlisting an individual is prohibited based on political purposes, retaliation, or any other reason unconnected to the REASONABLE SUSPICION standard.

3.17 Identities of Deceased Individuals.

3. 1 7. 1 The TSDB will not include identity information of KNOWN or SUSPECTED terrorists that are confirmed dead67 unless:

67 Subjects are considered "confirmed dead" under the following circumstances:

a. The subject's death became a high profile case in the public sphere (e.g., media footage confirming suicide bombers' deaths, 9/1 1 hijackers, death of Abu Musaq al Zarqawi); or,

b. Reporting on the subject's death has been corroborated by at least' two credible sources (e.g.. United States or "friendly" foreign government, fully-vetted asset).

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 46

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

3. 1 7. 1 . 1 PARTICULARIZED DEROGATORY INFORMATION supports a REASONABLE SUSPICION that an existing KNOWN or SUSPKCTED terrorist is using that identity information; or.

3.17. 1 .2 A recognized terrorist organization68 collects KNOWN or SUSPECTED TERRORIST identity information for use by its members in preparing for or committing TERRORIST acts and identity or travel documents (e.g., related to a deceased KNOWN or SUSPECTED TERRORIST of that organization) have not been recovered. "Trusted travel documents" include all documents used for border crossings.

3. 1 7.2 NOMINATING AGENCIES will share information regarding a watchlistcd or nominated individual's deceased status under Addendum B ofthc TSCMOU, section (7)(m) ("Any other TERRORISM INFORMATION that ORIGINATORS specifically provide for passage to the TSC"). NCTC will export deceased status to the TSC, and the TSC will export deceased status to end user screening systems, nominating AGENCIES will mark deceased status information "TIDE Restricted" in cases where the status, because of sensitive sourcing, should not be forwarded to the TSC. TIDE restricted information will not be exported to the TSC. When a nomination is made on a deceased person in accordance with this paragraph, the status indicator within TIDE that is exported to the TSC will be marked to reflect that the person is deceased.

VII. EXAMPLES OF TERRORISM AND/OR TERRORIST ACTIVITIES

3. 1 8 Examples of TERRORISM and/or TERRORIST ACTIVITIES may generally include conduct

intended to intimidate, coerce, influence, or affect civilian populations or government policy consisting of:

3.18.1 destruction of aircraft or aircraft facilities (18 U.S.C. 32);

3.18.2 violence at international airports (18 U.S.C. 37);

3. 1 8.3 biological weapons ( 1 8 U.S.C. 1 75 or 1 75b);

3. 1 8.4 variola virus (18 U.S.C. 175c);

3.18.5 chemical weapons (18 U.S.C. 229);

3.18.6 assassination and kidnapping of Congressional Members, Cabinet Officials, and Supreme Court Justices* 1 8 U.S.C. 35 1 (a)(b)(c) or (d));

3. 1 8.7 nuclear materials ( 1 8 U.S.C. 83 1 );

3.1 8.8 participation in nuclear and weapons of mass destruction threats to the United States (18 U.S.C. 832);

3.18.9 plastic explosives (18 U.S.C. 842(m) or (n) footnote 1.);

3.18.10 arson and bombing of Government property risking or causing death (18 USC 844(0(2) or (3));

3.18.1 I arson and bombing of property used in interstate commerce (18 U.S.C. 844(i));

A classified list of recognized terrorist organizations that are known to reuse TERRORIST identity information is available on the Watchlisting Community of Interest portal on NCTC Current.

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 47

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

3.18.12 killing or attempted killing during an attack on a Federal facility with a dangerous weapon (18 U.S.C. 930(c));

3. 1 8. 1 3 conspiracy to murder, kidnap, or maim persons abroad (18 U.S.C. 956(a)(1));

3. 1 8. 1 4 damaging a protected computer used in interstate or foreign commerce or that is used exclusively by a financial institution or the United States Government (18 USC 1030(a)(1); 18 U.S.C. l030(a)(5)(A)(i) resulting in damage as defined in 1 030(a)(5)(B)(ii) through (v));

3.18.15 killing or attempted killing of officers and employees of the United States (18 U S C 1 1 14);

3.18.16 murder or manslaughter of foreign officials, official guests, or internationally protected persons ( 1 8 U.S.C. 1 1 1 6);

3.18.17 hostage taking (1 8 U.S.C. 1203);

3.18.18 damage to Government property (18 U.S.C. 1361);

3.18.19 destruction of communication lines, stations, or systems (18 U.S.C. 1362);

3.18.20 injury to U.S. aircraft or vessels (18 U.S.C. 1363);

3.18.21 injury to U.S. diplomatic, consular, military, or other property (18 U.S.C. 1363);

3.18.22 destruction of an energy facility (18 U.S.C. 1366(a));

3.18.23 Presidential and Presidential Staff assassination and kidnapping (18 U.S.C. 1751(a), (b), (c), or (d));

3. 1 8.24 acts of violence against railroad carriers and against mass transportation systems on land, on water, or through the air (1 8 U.S.C. 1992);

3.18.25 destruction of national defense materials, premises, or utilities (18 U S C 21 15- 18 U.S.C. 2156);

3.18.26 violence against maritime navigation (seizing a ship by force, destroying a ship or damaging its navigation systems) (18 U.S.C. 2280);

3.18.27 violence against maritime fixed platforms (an artificial island, installation or structure permanently attached to the sea-bed for the purpose of exploration or exploitation of resources or for other economic purposes (18 U.S.C. 2281);

3.18.28 homicides and other violence against U.S. nationals occurring outside of the United States (18 U.S.C. 2332);

3 .18.29 the use of weapons of mass destruction ( 1 8 U.S.C. 2332a);

3.18.30 acts of TERRORISM transcending national boundaries (18 U.S.C. 2332b);

3. 1 8.3 1 bombing of public places and facilities (18 U.S.C. 2332f);

3.18.32 producing, transferring, or threatening to use missile systems designed to destrov aircraft (18 U.S.C. 2332g);

3.18.33 producing, transferring, or threatening to use radiological dispersal devices (18 U.S.C. 2332h); V

3.18.34 harboring TERRORISTS (18 U.S.C. 2339);

3. 1 8.35 providing material support to TERRORISTS ( 1 8 U.S.C. 2339A);

3.1 8.36 providing material support to terrorist organizations ( 1 8 U.S.C. 2339B);

3.18.37 financing TERRORISM (18 U.S.C. 2339C);

3.18.38 receiving military-type training from a FTO (18 U.S.C 2339DV

3. 1 8.39 torture (18 U.S.C. 2340A);

3.18.40 developing, transferring, possessing, or threatening to use atomic weapons (42 U.S.C. 2122); H V

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 48

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

3. 1 8.4 1 sabotage of nuclear facilities or fuel (42 U.S.C. 2284);

3. 1 8.42 aircraft piracy (49 U.S.C. 46502);

3.1 8.43 assault on a flight crew with a dangerous weapon (49 U.S.C. 46504);

3.18.44 carrying a weapon or explosive aboard an aircraft (49 U.S.C. 46505(b) or (c); 49 U.S.C. 46506 if homicide or attempted homicide is involved);

3.18.45 damaging or destroying an interstate gas pipeline facility, an interstate hazardous liquid pipeline facility, or either an intrastate gas pipeline facility or intrastate hazardous liquid pipeline facility (49 U.S.C. 60123(b)); or

3. 1 8.46 manufacturing, distributing, or possessing controlled substances intending to provide anything of pecuniary value to a FTO, member, or group (Section I010A (iv) of the Controlled Substances Import and Export Act).

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 49

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

CHAPTER 4: NO FLY, SELECTEE AND EXPANDED SELECTEE LISTS

I IMPLEMENTATION GUIDANCE

I. BACKGROUND

4. 1 On October 21 , 2004, the Deputies Committee established the criteria for the No Fly and Selectee Lists. On January 10, 2005, the DHS released the No Fly and Selectee Lists Implementation Guidance (Implementation Guidance) to provide direction on how to implement the No Fly and Selectee Fist criteria. The Implementation Guidance was updated and supplemented on July 25, 2006.

4.2 On February 8, 2008, the Deputies Committee approved the addition of a third and fourth criterion to the No Fly List. The Terrorist Screening Center Policy Board Working Group69 revised the Implementation Guidance on March 5, 2008, to provide direction on how to implement these new criteria.

4.3 Following the attempted terrorist attack on December 25, 2009, the President directed that a review of the current No Fly and Selectee List criteria be conducted and recommendations be made regarding whether any adjustments were needed. The Terrorist Screening Center Policy Board Working Group, in conjunction with the Information Sharing Access IPC, recommended certain changes in the lists' criteria and implementation guidance. Those recommendations were approved by the Deputies Committee on July 16, 2010.

11. PRE-CONDITIONS FOR PLACEMENT ON THE NO FLY OR SELECTEE LIST

4.4 Generally, in order to be included on cither the No Fly or Selectee List, two pre-conditions must both be met:

4.4.1 Minimum Identifying Criteria. Absent a Special Situation as described below70, minimum identifying biographic criteria consisting of First Name, Last Name, Full Date of Birth are required; and,

4.4.2 Minimum Substantive Derogatory Criteria. The minimum substantive derogatory criteria for inclusion must be met.71

This Working Group included representatives from Department of State. Department of Justice, Department of Homeland Security, Federal Bureau of Investigation, Central Intelligence Agency, Transportation Security Admin.strat.on, National Countcrtcrrorism Center, Terrorist Screening Center, Department of Treasury, and U S C ustoms and Border Protection.

See Chapter 4, Section IX, for additional information regarding the full date of birth requirement and applicable exceptions. KK

See Paragraph 1.58 for expedited nominations procedures.

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 50

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

III. NO FLY LIST CRITERIA

4.5 Any person, regardless of citizenship, who represents:

4.5. 1 a threat of committing an act of "international terrorism" (as defined in 1 8 U S C 233 1 ( I )) or "domestic TERRORISM" (as defined in 1 8 U.S.C. 233 1 (5)) with respect to an aircraa (including a threat of air piracy, or a threat to airline, passenger, or civil aviation security); or,

4.5.2 a threat of committing an act of "domestic TERRORISM" (as defined in 18 U.S.C. 2331(5)) with respect to the homeland72; or,

4.5.3 a threat of committing an act of "international TERRORISM" (as defined in 1 8 U.S.C. 233 1(1)) against any U.S. Government facility abroad and associated or supporting personnel, including U.S. embassies, consulates and missions, military installations (as defined by 10 U.S.C. 2801(c)(4)), U.S. ships, U.S. aircraft, or other auxiliary craft owned or leased by the U.S. Government; or,

4.5.4 a threat of engaging in or conducting a violent act of TERRORISM and who is OPERATIONALLY CAPABLE73 of doing so.

4.6 Detainees at the Naval Station, Guantanamo Bay, Cuba. Any individual who was a "detainee" held at the Naval Station, Guantanamo Bay, Cuba, unless the President certifies in writing to Congress that the detainee poses no threat to the United States, its citizens, or its allies. For purposes of this subparagraph, the term "detainee" means an individual in the custody or under the physical control of the United States as a result of armed conflict.74

IV. FURTHER CLARIFICATION OF THE NO FLY CRITERIA

4.7 Third No Fly List Criterion. Prior to the addition of the third No Fly List criterion (see Paragraph 4.5.3), a concern over the breadth of the No Fly List arose when KNOWN or SUSPECTED TERRORISTS who posed a threat to a U.S. military base overseas did not meet the criteria for inclusion on the No Fly List. Despite national interests, the threat to the overseas military base did not involve either civil aviation (as set forth in the first No Fly List criterion) or an act of domestic TERRORISM to the homeland (as set forth in the second No Fly List criterion). "Domestic Terrorism" requires that a subject's TERRORIST ACTIVITIES occur primarily within the territorial jurisdiction of the United States. "Homeland" does not include bases and embassies located abroad. F.ven in those instances when the IC had identified a KNOWN or SUSPECTED TERRORIST'S specific target, KNOWN or SUSPECTED TERRORISTS maintained the advantage of operational flexibility. The third No Fly List criterion addresses

'■ Domestic ads of TERRORISM are those that primarily occur "within the territorial jurisdiction of the United States." Sua 18 U.S.C 233 1 (5)(C^).

" See Paragraph 4.8.2, infra, that defines "operationally capable." See 49 U.S.C. 44903(j)(2)(C)(v).

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 51

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

this specific vulnerability and counters the ability of KNOWN or SUSPECTED TERRORISTS to target U.S. Government facilities outside of the "homeland" {e.g., the October 12 2000 attack upon the U.S. Navy guided missile destroyer USS Cole while it was harbored in the Yemeni port of Aden).

4.8 Fourth No Fly List Criterion.

4.8. 1 Enable Flexibility. The fourth No Fly List criterion {see Paragraph 4.5.4) is intended to enable flexibility for nominations to the No Fly List of operationally CAPABLE KNOWN or SUSPECTED terrorists who pose a threat of committing an act of international TERRORISM abroad, but who do not meet the first, second or third No Fly List criterion because they do not pose a threat to civil aviation, a threat to the homeland, or a threat to U.S. facilities and their associated or supporting personnel. Previously, the No Fly List criteria did not prevent KNOWN or SUSPECTED TERRORISTS from traveling aboard aircraft, even though they may have had the intent and operational capabii ity to commit a terrorist act against U.S. nationals abroad (outside of the "homeland") or against a target with no nexus to the United States or its nationals. The fourth No Fly List criterion now addresses these two vulnerabilities.

4.8.2 operationally capable Defined. An individual is "operationally capable" if, based on credible intelligence, he or she, acting individually or in concert with others,' reasonably appears to have the ability, knowledge, opportunity, and intent or is actively seeking the opportunity to engage in a violent act of TERRORISM consistent with 18 U.S.C. 233 1 or 1 8 U.S.C. 2332b. For example, attempting to obtain an I ED would indicate an individual is OPERATIONALLY CAPABLE of committing an act of TERRORISM. However, simply conducting internet research concerning ILDs would not be sufficient without additional activity. Depending on the circumstances, and in combination with other facts, scouting potential targets or traveling for no legitimate purpose to places that ha ve TERRORIST training grounds, regardless of whether the person is presently capable of using an ILD, might also indicate an individual is OPERATIONALLY CAPABLE of committing an act of TERRORISM.

4.8.3 Possible Indicators of Being operationally capable. In determining whether an individual is operationally capable, consideration should be given to the following indicators regarding ability, knowledge, opportunity, and/or intent:

4.8.3. 1 Subject has undergone terrorist training or been provided some instruction, to include receiving military training by a designated terrorist group;

4.8.3.2 Subject has indicated intent to participate in planning/conducting an attack;

4.8.3.3 Subject has expressed desire to martyr him/herscif;

4.8.3.4 Subject is in repeated contact with a KNOWN TERRORIST facilitator who recruits or facilitates travel of operatives;

4.8.3.5 Subject is planning an attack either alone or as part of a group; or, UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 52

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

4.8.3.6 Subject is associated with a TERRORIST group/cell and the subject is accumulating weapons/explosives.

4.9 OPERATIONALLY CAPABLE Scenarios. The three scenarios set forth below serve as some examples of No Fly List nominations that would fall under the fourth No Fly List criterion:

4.9. 1 There is credible information that the planning or preparation for a TERRORIST attack against the interests of the United States or a foreign government is ongoing and there is an indication that an individual is operationally CAPABLE;

4.9.2 There is credible information that an individual is linked with an organization known to target U.S. interests. The actual target may be unknown but indicated to be a commercial facility frequented by U.S. citizens abroad. Intelligence identifies an operational or pre-operational capability of this individual whose cell is planning a near- term attack on a target (e.g.. a plot to kill U.S. nationals residing in a foreign hotel or frequenting a foreign nightclub); or,

4.9.3 There is credible information that an individual is linked with an organization known to target foreign governments. The actual target may be unknown but indicated to be a lorcign government facility such as an embassy, consulate, mission or military installation. Intelligence identifies an operational or pre-operational capability of this individual whose cell is planning a near-term attack on a target (e.g., a plot to bomb the British Parliament or the March 1 1, 2004, Madrid bombing).

4. 1 0 One-Timc Waiver Policy.

4. 1 0. 1 TSA regulations prohibit U.S. flagged air carriers and foreign flagged air carriers from transporting individuals, who pose the level of threat required for No Fly status on regulated commercial flights, including all flights operated by U.S. air carriers regardless of the location, and nights operated by foreign air carriers to, from, or over the United States. This prohibition applies regardless of the individual's status as a U S PERSON.

4. 1 0.2 When necessary, the U.S. Government may authorize and grant a One Time Waiver (OTW) to an air carrier permitting the carrier to transport an individual on a specified itinerary under controlled conditions. OTWs are coordinated with DHS (including CBP and TSA), FBI, DOS and DOJ as appropriate, prior to being authorized by 'I SC. Once authorized by TSC, TSA will review the conditions of transport and may grant the waiver, permitting the air carrier to transport the individual. If the itinerary changes, or the conditions of transport of the individual change, TSA will deny boarding to the individual until such time as satisfactory conditions are present.

4. 1 0.3 U.S. persons Encountered Overseas.

4. 1 0.3. 1 While placement on the No Fly List does not legally bar a U.S. PERSON from

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 53

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

returning to the United States, the U.S. Government has adopted a policy to review all cases in which a U.S. PERSON on the No Fly List is denied boarding on a commercial night bound for the United States to determine whether an OTW may be appropriate. TSC will initiate this assessment immediately, and may approve an OTW in advance. TSA will not review or authorize an OTW until such time as an acceptable itinerary is available.

4.10.3.2 In order to facilitate communication with such an individual, the U.S. Government has determined, as a matter of policy, that U.S. Citizens denied boarding on a commercial flight reluming to the United States should be referred to the consular section of the nearest U.S. Embassy or Consulate, which will facilitate communication with the individual, including providing the individual with instructions in the event an OTW is authorized. In keeping with the U.S. Government's traditional policy of neither confirming nor denying whether an individual is on the Terrorist Watchlist, the individual is not informed of his or her watchlist status or that he or she would be traveling under a waiver.

V. SELECTEE LIST CRITERIA

4. 1 1 Selectee List Criteria. Any person regardless of citizenship, who does not meet the criteria for inclusion on the No Fly List and who:

4.1 1.1 is a member of a foreign or domestic terrorist organization75 (including a "foreign terrorist organization" designated pursuant to Statute or Executive Order, as described in Paragraph 3. 1 1.2); and,

4. 1 1 .2 is associated with "terrorist activity" (as such term is defined in section 212(a)(3)(B) of the INA [8 U.S.C. 1 1 82(a)(3)(B) |); unless information exists that demonstrates that the application of secondary screening to such person is not necessary, in which case such persons may be excluded from the Selectee List.

VI. EXPANDED SELECTEE LIST CRITERIA

4. 1 2 The Expanded Selectee List (ESEL) includes records in the TSDB that contain a full name and full date of birth, regardless of the citizenship of the subject, who do not meet the criteria to be placed on either the No Fly or Selectee Lists, excluding exceptions to the reasonable SUSPICION standard.

VII. ACTIONS BASED UPON POSITIVE MATCHES TO THE NO FLY, SELECTEE, OR EXPANDED SELECTEE LISTS

Members of a defunct terrorist group are included in this criterion if the person was a member of the group when it participated in terrorist activity. k

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 54

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

4.13 The actions resulting from inclusion on the No Fly, Selectee, or Expanded Selectee List are generally as follows:

4.13.1 Individuals that are POSITIVE MATCHES to the No Fly List are prohibited from boarding an aircraft;

4. 1 3.2 Individuals that are POSITIVE MATCHES to the Selectee List undergo enhanced screening prior to boarding an aircraft;

4.13.3 Individuals that are POSITIVE MATCHES to the Expanded Selectee List undergo enhanced screening prior to boarding an aircraft.

4. 14 Selectee, Expanded Selectee, and random screening all result in the same operational response of receiving enhanced screening by Transportation Security Officers prior to boarding an a.rcraft. TSA will notify the TSC of all No Fly, Selectee, and Expanded Selectee ENCOUNTERS.

VIII. IMPLEMENTATION GUIDELINES

4.15 General Guidelines. The watchlisting community has developed six general guidelines regarding the No Fly and Selectee Lists that should be rcemphasized in order to effectively implement the No Fly List and Selectee List criteria. The six general guidelines are:

4.15. 1 When evaluating the significance, relevance and validity of a threat, careful consideration should be given to the extent to which the threat is current, specific and credible.

4. 1 5.2 The Selectee List is not a default position for those who do not qualify for inclusion on the No Fly List and has distinct elements that must be met before an individual may be included.

4. 1 5.3 The purpose of the No Fly List is to protect against acts of TERRORISM; inclusion on the No Fly List has consequences that arc operational, legal, economic, and diplomatic.

4. 1 5.4 Except for expedited nominations made pursuant to Paragraph 1 .58 of the Watchlisting Guidance, the decision to include a person on the No Fly List or Selectee List must include substantive deroga tory INFORMATION that satisfies the aforementioned criteria and thus justifies inclusion on either list. In cases where nominations contain no substantive DEROGATORY INFORMATION, or contain insufficient substantive DEROGATORY INFORMATION, the individual will not be included on either the No Fly List or Selectee List.

4. 1 5.5 In accordance with determinations made pursuant to Paragraph 1 .59 of the Watchlisting Guidance, the White House may direct the TSC to place categories of individuals on the No Fly List or the Selectee List on a temporary basis based on current

U N CL ASS I FI E D//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 55

UNCL ASSI FI ED/ /FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

and credible intelligence information or a particular threat stream that indicates a certain category of individuals may conduct an act of domestic or international terrorism.

4. 1 5.6 Under exigent operational circumstances, when DEROGATORY INFORMATION may not be widely disseminated or stored in TIDE, individual watchlist status determinations can be made by the Director of the TSC, in accordance with the relevant criteria76 contained in the Watchlisting Guidance. Coordination should occur with relevant nominating agencies and SCREENERS.

Totality of the Information. The foregoing guidance is neither intended to be determinative nor intended to serve as a checklist. Rather, it is intended to guide the watchlisting community in assessing whether the established criteria are satisfied for a specific record, based on the totality of available information, a current threat stream, and/or the current threat environment.

IX. SPECIAL SITUATIONS

4. 1 7 Requirement for Full Names and Complete Dates of Birth. Generally, TERRORIST identities nominated to cither the No Fly or the Selectee List must have both a full name and a complete date of birth. Identities without both will usually not be included on either list. Dates of birth shall not be fabricated.78

4. 1 7. 1 There is, however, a narrow exception to the requirement for full names and

complete dates of birth for individuals from non-Visa Waiver Program countries for international TERRORIST nominations. If a non-Visa Waiver Program country79 has issued a travel document with only a year of birth, or a verified government-issued identification document with only a year of birth, then it is permissible to use only that year of birth. The NOMINATING AGENCY, however, should, whenever possible, specify the type of document containing the year of birth, and the passport number (if the document is a passport). Otherwise, a year of birth alone will not be accepted for nominations to the No Fly or Selectee Lists. The NOMINATING AGENCY has a continuing obligation to attempt to determine the complete date of birth.

4. 1 8 Expedited Waiver of "Full Date of Birth" Requirement for No Fly or Selectee Nominations. When necessitated by exigent circumstances, a NOMINATOR may nominate an individual or individuals to the No Fly or Selectee List with only a partial date of birth, but for whom there is additional identifying information. This provision is intended to enable nominations based on current and credible intelligence information or a particular threat

^ Determinations made under this section apply to the No Fly, Selectee and Expanded Selectee List criteria.

See Paragraph 1 .59 for a complete discussion of expedited nomination procedures for temporary, threat-based categories.

78 The dates of birth of January 1 (0 1/0 1/xxxx), July I (07/01/xxxx), November 1 1 (I l/l 1/xxxx), and December 31

( 1 2/3 1/xxxx) are examples of dates that may be fabricated and as such, should receive additional scrutiny at all stages of the reporting, nomination, and watchlisting process.

79 Visa Waiver Program countries include a complete date of birth in their passports.

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 56

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

stream that indicates the subjcct(s) may be used to conduct an act of domestic or international terrorism as defined in 18 U.S.C. 2331(1), or as a Federal crime of terrorism as defined in 18 U.S.C. 2332b(g)(5). The goal of this provision is to fashion a watchlisting response that is appropriate to the nature, specificity, and severity of the threat. To achieve this goal, in addition to the credibility of the threat intelligence, due consideration should be given to:

4. 1 8. 1 The harm to public safety posed by the threat;

4. 1 8.2 The clarity and specificity of the information giving rise to the threat as to time, place, method, and identity of the suspected perpetrator(s);

4. 1 8.3 The anticipated impact on international and domestic travel, civil liberties, and foreign relations; and,

4. 1 8.4 The best available screening tools, other than the No Fly or Selectee Lists, given the type and specificity of identifiers and travel data.

4.19 This waiver should be utilized in limited circumstances when extreme DEROGATORY information has been identified demonstrating the threat. The waiver should be valid as long as the threat remains.

X. NOMINATIONS THAT ARE INELIGIBLE/NOT SUITABLE FOR EITHER THE NO FLY OR THE SELECTEE LIST80

4.20 Nominations based on exceptions to the minimum substantive derogatory criteria contained in Paragraph 3.14, including immediate family members of TERRORISTS (i.e., spouses or children of a KNOWN or SUSPECTED TERRORIST)81 arc ineligible/not suitable for inclusion on either the No Fly or Selectee List, absent independent DEROGATORY INFORMATION;

4.2 1 Subjects of lost or stolen passports or travel documents are ineligible/not suitable for inclusion on either the No Fly or Selectee List, absent independent DEROGATORY INFORMATION;

4.22 Deceased individuals are ineligible for inclusion on either the No Fly or Selectee List unless they meet the exceptions set forth in Paragraph 3.1 7, Identities of Deceased Individuals.

80 This section can be overridden in the event of an expedited, threat-based categorical nomination procedures, pursuant to Paragraph 1 .59. 1

81 See INA § 212(a)(3XB)(i)(IX)[8 U.S.C. 1 182(a)(3)(BKi)(IX)|.

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 57

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

CHAPTER 5: ENCOUNTER MANAGEMENT AND ANALYSIS I. INTRODUCTION AND PURPOSE

5. 1 This guidance addresses the collection, processing, and analysis of TERRORISM information co lected I by the SCREENERS during an ENCOUNTER with a watchlisted subject. As described below, all information gathered during an ENCOUNTER with a KNOWN or SUSPECTED terrorist is referred to as an encounter package. This guidance does not create any new author.t.es for the collection of any information during ENCOUNTERS with KNOWN or SUSPECTED TERRORISTS. Rather, it identifies the types of information that a Department or Agency should consider collecting during an ENCOUNTER with a known or SUSPECTED TERRORIST .fit possesses the authority to collect such information, and should share with the interagency community consistent with their legal authorities and executive policy.83

5.2 Definitions.

5.2. 1 encounter. An ENCOUNTER is defined as an event in which an individual is identified during a screening process to be a "POSITIVE MATCH," "POTENTIAL MATCH " or "inconclusive match," to an individual who has been designated in the TSDB as a KNOWN or susplcted TERRORIST. An ENCOUNTER can be a face-to-face meeting with a KNOWN or SUSPKCTF.D terrorist, electronic or a paper-based ENCOUNTER (e z the KNOWN or SUSPECTED TERRORIST has submitted an application for a benefit liked a visa, Electronic System for Travel Authorization (ESTA) application, or information is provided to the Umted States by a foreign government, aircraft operator, or other private entity). Chapter 5 is only concerned with positive MATCHES, which occur when the

I SC determines that information about a subject encountered by a SCREENER matches a TSDB record.

5.2.2 terrorism information, terrorism information in this chapter includes purely domestic terrorism as defined in the TSC MOU and incorporates the definition found in m section 1016 of the IRTPA (6 U.S.C 485), as amended. The term "TERRORISM INFORMA TION" means -

5.2.2. 1 all information, whether collected, produced, or distributed by intelligence, law enforcement, military, homeland security, or other activities relating to—

5.2.2.1 .1 the existence, organization, capabilities, plans, intentions,

vulnerabilities, means of finance or material support, or activities of foreign or international terrorist groups or individuals, or of domestic groups or

Shdrmg mtonnat.on for reasons not related to known or SUSPECTED TtRRORiST categories should be limited to updafng b.ograph.c .dent.flers, and the sharing of relevant information that may assistln making decisions related to a change m a person's status in the TSDB and/or terrorism information

Obhgat.ons include those imposed by IRTPA section 1021 or by interagency agreement (e.g., the Information Shanng MOU fAppend.x 5;, the TSC MOU (Appendix 3) and Addendum B to the TSC MOlHAppJ*™))

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 58

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

individuals involved in transnational terrorism;

5.2.2. 1 .2 threats posed by such groups or individuals to the United States u S PERSONS, or U.S. interests, or to those of other nations;

5.2.2.1.3 communications of or by such groups or individuals; or,

'..2. 1 .4 groups or individuals reasonably believed to be assisting or associated with such groups or individuals; and

5.2.2.2 includes weapons of mass destruction information.

5.2.2.2.1 Weapons of Mass Destruction Information. Information that could reasonably be expected to assist in the development, proliferation, or use of a weapon of mass destruction (including a chemical, biological, radiological or nuclear weapon) that could be used by a TERRORIST or a terrorist organization against the United States, including information about the location of any stockpile of nuclear materials that could be exploited for use in such a weapon that could be used by a TERRORIST or a terrorist organization against the United States.

II. PROCESSING TERRORISM INFORMATION FROM ENCOUNTERS WITH POSITIVELY IDENTIFIED KNOWN OR SUSPECTED TERRORISTS

5.3 This section describes the major types of ENCOUNTERS by various Departments and Agencies

ENCOUNIER PACKAGES obtained from a KNOWN or SUSPECTED TERRORIST ENCOUNTER will be processed as follows:

5.4 Department of Homeland Security ENCOUNTERS. DI IS has more ENCOUNTERS with KNOWN or SUSPECTED TERRORISTS than any other U.S. Government component The descriptions below provide information for the majority of DI IS ENCOUNTERS, although it is not an exhaustive list of ENCOUNTER opportunities or the types of TERRORISM INFORMATION available for collection. When lawful and available, both biographic and biometric information will be collected as part of the ENCOUNTER PACKAGE.

5.4. 1 U.S. Customs and Border Protection. CBP ENCOUNTERS occur at ports of entry (POL), between POEs, or at the last point of departure to the United States at foreign airports through CBP programs like Pre-Clearance and the Immigration Advisory Program (IAP). Information available for collection from these ENCOUNTERS may include, but is not limited to, pocket litter, travel information, identification documents travel companions, legal documents, and other information gathered during interviews and the examination process. CBP receives international travel reservation information of KNOWN or SUSPECTED TERRORISTS for commercial air travel to and from the United States (which may include travel companion information) and international private and

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 59

UNCLASSIFIF.D//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

commercial flight manifests, as well as, commercial vessel manifest for travel to and from the United States. With the exception of passenger information required by law to be transmitted to DHS prior to a passenger's arrival, most information is generally collected by CBP when the person is interviewed or apprehended. The National Targeting Center - Passenger (NTC-P) and N IC-Cargo (NTC-C) are CBP entities responsible for communicating with the TSC regarding ENCOUNTERS with KNOWN or SUSPECTED TERRORISTS, to include providing relevant ENCOUNTER information. NTC- P and NTC-C also provide a copy of the examination results to the TSOU for dissemination to the appropriate investigating Agencies.

5.4.2 Transportation Security Administration. TSA generally encounters KNOWN or SUSPECTED TERRORISTS through screening commercial aircraft passengers against subsets of the TSDB and during the application process for a credential or benefit in the transportation or critical infrastructure environment (e.g., Transportation Worker Identification Credential (TWIC)). When an airline encounters subjects who are possible matches to the No Fly or Selectee List, the air carriers arc required to supply the passenger's name and one piece of identifying data (in the form of a government-issued photo identification that contains a date of birth) to the TSA's Office of Intelligence and Analysis (OlA). TSA OIA submits that information, along with information regarding the carrier, flight number, time of departure, and destination to the TSC.

5.4.2.1 Absent an arrest warrant, or unless probable cause arises during the ENCOUNTER, SCREENERS arc reminded that placement on the No Fly or Selectee List is not a legal basis to detain a KNOWN or SUSPECTED TERRORIST. To the extent legal authority exists to question a known or SUSPECTED TERRORIST, encounters with No Fly subjects at the airport may provide an additional opportunity to lawfully obtain ENCOUNTER PACKAGE information. For No Fly subjects who have made a domestic reservation, DHS will notify TSC in advance as well as when the No Fly subject presents at the airport ticket counter. TSC will then notify the TSOU who will notify both the FBI case agent and the airport liaison agent to coordinate the appropriate operational response.

5.4.2.2 For KNOWN or SUSPEC TED TERRORIST ENCOUNTERS as a result of an individual applying for a TSA benefit or credential, ENCOUNTER PACKAGE information can include any supporting documents or information collected as a part of the appl ication process. The ENCOUNTER, and any corresponding information, is communicated to the TSC and other Government Agencies, as appropriate through TSA OIA.

5.4.3 United States Citizenship and Immigration Services. U.S. Citizenship and Immigration Services (USCIS) interact with millions of individuals every year and

M CBP may also encounter such individuals in the course of processing an application and/or conducting an interview of an applicant for a trusted traveler program (e.g., NEXUS, Free and Secure Trade (FAST), Global Entry, SENTRI, etc.).

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 60

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

ENCOUNTERS KNOWN or SUSPECTED TERRORISTS who file petitions or applications for immigration benefits internationally and domestically.85 The USCIS official contacts the TSC to report an encounter with a known or suspected terrorist. Before making a decision on the immigration application or benefit, USCIS contacts the ORIGINATOR/NOMINATOR to obtain additional information that may help determine whether the individual is eligible or ineligible to receive the immigration benefit. In such cases, USCIS seeks further information from the record owner or case agent and may seek de-classification of information relating to the application. In addition, USCIS contacts the ORIGINATOR/NOMINATOR to discuss whether the USCIS decision to grant or deny the application or benefit would interrupt or negatively affect any ongoing investigation.

5.4.3. 1 USCIS maintains a presence at law enforcement and intelligence Agency entities to further information sharing regarding KNOWN or SUSPECTED TERRORISTS. USCIS maintains information, including the subject's Alien File (A- l ilc) and other records. The type of information that may be contained in USCIS files, including the A-File, could be biomctric data (fingerprints and photographs); identity documents; information relating to the application; addresses, as well as family and work history information; immigration benefit application information; and records of previous ENCOUNTERS that DI IS has had with the subject. Other SCREENERS — as well as other appropriate organizations who are considering nominating a potential KNOWN or SUSPECTED TERRORIS T or who have ENCOUNTERS with a person who is a POSITIVE MATCH to a known or suspected terrorist— are advised that they can request, on a casc-by-case basis, a copy of the KNOWN or suspected terrorist's A-File from USCIS if the known or suspected TERRORIST has applied for immigration or citizenship benefits. 6

5.4.4 U.S. Immigration and Customs Enforcement. Immigrations and Customs

Enforcement (ICE) is the principal investigative arm of DIIS. ICE is also the federal law enforcement organization responsible for immigration and customs-related investigations and detention within the interior and at the borders of the United Stales. ICE frequently ENCOUN TERS potential KNOWN or SUSPECTED TERRORISTS during enforcement activities under its purview. Such ENCOUNTERS are documented within ICE Enforcement and Removal Operations (ERO) via the Known Suspected Terrorist Encounter Protocol and reported to the TSC and ICE's I lomeland Security Investigations (HSI). ICE HSI Special Agents frequently encounter KNOWN or SUSPECTED TERRORISTS internationally, domestically, at U.S. POEs, and when KNOWN or SUSPECTED TERRORISTS are the subjects of an ICE investigation. These ENCOUNTERS are

85 For example, a U.S. PERSON who is a KNOWN or SUSPECTED TERRORIST may file a petition for a foreign national or a U.S. PERSON who is not a KNOWN or SUSPECTED TERRORIST may file a petition for a foreign national who is a KNOWN or SUSPECTED TERRORIST.

86 Because USCIS is the custodian of information acquired through the immigration process relating to an individual and because the A-File is not routinely attached to the TSDB or TIDE, a specific request to USCIS is necessary in order to obtain information from the A-Filc.

UNCLASSIF1ED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 61

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

documented by HSi Special Agents in Reports of Investigation (ROI). All ROIs documenting ENCOUNTERS/interviews with a KNOWN or SUSPECTED TERRORIST are shared with the IC.

5.4.4. 1 In addition, under section 428 of the Homeland Security Act, the Secretary of Homeland Security has the authority to refuse visas in accordance with the law and to assign employees of DHS to diplomatic and consular posts to review visa applications and conduct investigations.87 ICE, through the Visa Security Program, exercises this authority. Reviews of visa applications and interviews with applicants can result in the encounter of KNOWN or SUSPECTED TERRORISTS, facilitators, and associates as well as reveal previously unknown information relating to KNOWN or SUSPECTED TERRORISTS. HSI personnel assigned to the Visa Security Program, and to U.S. Embassies and Consulates abroad, work closely with their DOS counterparts to identify KNOWN or SUSPECTED TERRORISTS and report findings through established processes. Finally, ICE may encounter known or SUSPECTED TERRORISTS awaiting immigration hearings who are housed in service processing/detention centers. These detention facilities can document interactions with the aliens while they arc detained in the facility, as well as document materials found on the individual at the time of processing. For all immigration and enforcement activities, ICE will communicate with the TSC regarding encounters with watchlisted individuals, and will submit relevant ENCOUNTER information to the I SC.

5.4.5 United States Coast Guard. The U.S. Coast Guard's Coastwatch branch screens crew and passenger information on vessel manifests, which are required by regulation to be transmitted to the National Vessel Movement Center (NVMC) prior to a vessel's arrival in a U.S. port. Coastwatch communicates with the NTC-P and TSC regarding any known or SUSPECTED TERRORIST ENCOUNTERS during this process. The Coast Guard physically encounters few KNOWN or SUSPECTED TERRORISTS, and such ENCOUNTERS could occur from random and regular inspections of vessels and port facilities, ship boardings, investigations, or Coast Guard licensing activities. The type of information available for collection is dependent on the type of encounter. The ENCOUNTER, and any corresponding information, is communicated to the TSC through Coast Guard Office of Intelligence and Criminal Investigations. Based on the encountering situation, intelligence reporting will be written to provide situational awareness to the IC.

5.4.6 United States Secret Service. Although United States Secret Service (USSS) docs not encounter many KNOWN or SUSPECTED TERRORISTS, such ENCOUNTERS usually involve KNOWN or SUSPECTED TERRORISTS with a domestic nexus to TERRORISM. Such encounters can be the result of investigations or for event screening (e.g., National Security Special Events, political events, large scale sporting events). These

" Consistent with section 428 of the Homeland Security Act and the Memorandum of Understanding between the Secretaries of State and Homeland Security Concerning Implementation of Section 428 of the Homeland Security Act of 2002, the Secretary of I lomeland Security may direct a consular officer to refuse or revoke a visa.

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 62

UNCL ASSI FI ED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

ENCOUNTERS will be coordinated with the FBI, who will handle them as they do all other FBI KNOWN or SUSPECTED TERRORIST ENCOUNTERS.

5.4.7 Department of Homeland Security Intelligence & Analysis. DHS I&A provides end products and analytical reports, which are generally available to the NCTC and the broader countertcrrorism analytic community, including fusion centers. Dl IS l&A works closely with DHS components to ensure non-traditional streams of information arc fused with traditional sources of information from other members of the IC to give a complete picture of potential threats to the nation. DHS I&A "connects the dots" for intelligence reporting and ENCOUNTERS of the DI IS components, and as such, has limited opportunity for ENCOUNTERS with KNOWN or SUSPECTED TERRORISTS.

5.5 Department of State ENCOUNTERS. For DOS ENCOUNTERS with a person who is a POSITIVE MATCH to a KNOWN or SUSPECTED TERRORIST, the DOS unit at the TSC will do the following:

5.5.1 Visa Applications. DOS/TSC will upload the electronic visa application from the CCD to the individual's EMA record. DOS/TSC will coordinate with the overseas posts to scan in CCD all other available DOS documents associated with the individual. DOS information about whether a visa is issued is currently available in individual case records in the CCD; DOS is currently investigating upgrades to the CCD's report function that will make the visa decision data more easily accessible to TSC and other users.

5.5.2 Visa Revocations. DOS/TSC will upload the electronic visa application from the CCD to the individual's F.MA record.

5.5.3 Passports. After encounters with known or SUSPECTED TERRORISTS possessing passports issued by the United States, the TSOC will upload the Passport Information Electronic Records System (PIERS) application forms from the CCD to the individual's EMA record. DOS/TSC will coordinate with the overseas posts to scan in CCD all other available DOS documents associated with the individual.

5.6 United States Agency for International Development ENCOUNTERS. United States Agency for International Development (USA1D) works in agriculture, democracy and governance, economic growth, the environment, education, health, global partnerships, and humanitarian assistance in more than 100 countries. When USAID receives an application seeking financial assistance, prior to granting, these applications are subject to vetting by USAID intelligence analysts at the TSC. If USAID/TSC finds that an application relates to a person who is a POSITIVE MATCH to a KNOWN or SUSPECTED TERRORIST in the TSDB, USAID/TSC will provide any TERRORISM INFORMATION concerning the application and follow standard TSC procedures for processing TERRORISM INFORMA TION, to include logging the ENCOUNTER in F.MA.

5.7 Foreign Partner ENCOUNTERS. After each ENCOUNTER by a foreign partner, DOS/TSC will ask the respective country for the subject's photo, additional biographic data and any

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 63

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

TERRORISM INFORMATION on the ENCOUNTER Information List gathered during the ENCOUNTER. Provision of any material collected by the foreign partner depends on the arrangement with, and legal authorities of, the particular foreign partner involved. Therefore, gathering and sharing this TERRORISM INFORMATION will be done on a case-by-case, country- by-country basis.

5.8 Federal Bureau of Investigation/Law Enforcement ENCOUNTERS. These ENCOUNTERS can be subdivided into three categories:

5.8.1 Name-Based Queries. Name-based transaction queries by law enforcement personnel (e.g., traffic slops) made to the FBI's National Crime Information Center at the Criminal Justice Information Services (CJIS) Division that match a name in the KSTF (a sub-file of NCIC) are deemed to be potential MATCHES. They are routed electronically to TSC for confirmation and subsequent processing as an ENCOUNTER.

5.8.2 Fingerprint-Based Queries. Fingerprint-based queries submitted for criminal identification purposes (e.g., an arrest/booking) or for civil identification purposes (e.g., an employment background check) arc made to the Integrated Automatic Fingerprint Identification System (IAFIS). For POSITIVE MATCHES to records flagged as known or SUSPECTED TERRORIST records, the CJIS Division's Special Identities Unit notifies the TSC and the FBI case agent (or the Agency that identified the subject as a possible TERRORIST). In similar fashion, CJIS Division's Global Initiatives Unit coordinates positive fingerprint hits from its foreign submissions with the Legal Attached It should be noted that IAFIS and NCIC are separate systems that are not fully synchronized at the present time.

5.8.3 National Instant Criminal Background Check System. All background checks resulting from attempts to buy firearms or to obtain explosive permits submitted to the National Instant Criminal Background Check System (N1CS) at CJIS are run against the KSTF. The TSC is immediately notified of all KSTF "hits." NICS consults with TSC to confirm the posi tive MATCHES and the FBI case agent to determine whether there is available information about the prospective purchaser to disqualify him or her from possessing a firearm or explosive as a matter of law. Regardless of whether the purchase is denied or permitted to proceed, all available information is obtained and provided to the TSC and, in turn, CTD, as TERRORISM INFORMATION and processed as an ENCOUNTER.

5.9 Department of Defense ENCOUNTERS. The Department of Defense (DoD) has force protection, operational capture/apprehend, and intelligence responsibilities and on occasion encounters KNOWN or SUSPECTED TERRORISTS. To the extent DoD knowingly encounters a known or SUSPECTED TERRORIST, DoD will report the ENCOUNTER in intelligence channels or to the FBI in cases described in the MOU between the FBI and DoD Governing Information Sharing, Operational Coordination and Investigative Responsibilities signed August 2, 201 1 where the FBI is the lead. In cases where the FBI is not the lead for the ENCOUN TER, the

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 64

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Defense Intelligence Agency (DIA) will be responsible for providing extracted information from the ENCOUNTER to NCTC via standard DIA national TERRORIST watchlisting procedures, which utilize community accepted standards. DoD law enforcement ENCOUNTERS will be handled in accordance with established law enforcement standards that provide notification to the FBI.

5. 10 All other Departments or Agencies. Any other Department or Agency that has TERRORISM INFORMATION from an ENCOUNTER will contact the TSC/TSOC at 866 | | to arrange a mutually acceptable transmission method.

III. CATEGORIES OF TERRORISM INFORMATION FROM ENCOUNTERS WITH POSITIVELY IDENTIFIED KNOWN OR SUSPECTED TERRORISTS OF POTENTIAL INTEREST

5.1 I ENCOUNTER Information List. The following ENCOUNTER Information List identifies

categories of TERRORISM INFORMATION from ENCOUNTERS with positively identified KNOWN or SUSPECTED TERRORISTS that are of potential interest to NOMINA TORS, other counterterrorism analysts, or the watchlisting community. The items identified are not intended to be an exclusive or exhaustive list of what constitutes TERRORISM INFORMATION.

88

5.11.1 ENCOUNTER information identified for collection in Addendum B to the TSC MOV when there is a POSITIVE MATCH to a KNOWN or SUSPECTED TERRORIST:

1 . Photographs

2. Fingerprints

3. Pocket litter

4. Written data

5. Reports of TERRORISM INFORMATION

5.1 1.2 Additional items or potential interest when lawfully collected during an ENCOUNTER with a KNOWN or SUSPECTED TERRORIST:

I . Contemporaneous reports including the impressions or observations recorded by an official involved in the ENCOUNTER:

a) Reason/circumstances of ENCOUNTER

b) ICE Intel Reports

c) FBI Reports of Investigations

d) CBP Incident Reports

e) CBP Secondary Fxam Report

f) USCIS applications or petitions

g) Non-Immigrant Visa (NIV) Applications (including CCD notes)

" See Appendix 3, TSC MOV.

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 65

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

h) State, Local, Tribal, Territorial Police Report

i) TSA OIA No Fly and Selectee Reports

j) TSA OIA ENCOUNTER Reports (Vetting Match Reports) on transportation workers

and other populations vetted by TSA against the TSD13 k) Spot Reports I) Suspicious Activity Reports m) Impounded vehicle inventory n) Any inventory record

o) Any pictures, video or recording of or from the actual ENCOUNTER p) Biometric or biographic identifiers of traveling associates

2. Surveillance-related documents:

a) Maps

b) Pictures

c) Visitor or site information

d) Plans or diagrams {e.g., architectural drawings, blueprints, schemas)

3s Context regarding areas of potential interest or possible targets of KNOWN or SUSPECTED TERRORIST interest:

a) Information regarding any high profile events taking place in geographic area of

ENCOUNTER

b) Any critical infrastructure sites near the geographic area of ENCOUN TER

c) Unique characteristics or facts about your domain/area of responsibility/geographic area of encounter

d) Event tickets (e.g., sporting events, concerts, designated National Security Special events)

e) Building access passes, electronic cards, fobs, keys

4. Mode of transportation used by the person who is a POSITIVE MATCH to a KNOWN or SUSPECTED TERRORIST, along with identifying information:

a) Vehicle information (e.g., Vehicle registration. Vehicle identification number (VIN), Title, Driver's license, Car insurance cards or information)

b) Pilot medical license

c) Pilot certificates

d) Aircraft registration c) Marine registration

f) EZ Pass or electronic vehicle payment system

5. Travel-related information:

a) Passport exit/entry stamps indicating places of travel

b) Any visa application or denial information from other countries

UNCLASS1FIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 66

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

c) Travel itineraries

d) Tickets (e.g., plane, train, boat)

e) Hotels (e.g., reservation confirmation, receipts)

f) Rental cars (e.g., reservation confirmation, agreement, receipts)

g) Reservation method (e.g., via travel agency or travel website)

h) PNRdata

i) Travel manifests

j) I-uggage or baggage tags (e.g., airport check-in tags, identification tags,

lost bag bar code tags) k) Claim checks I) Storage locker keys m) Shipping documents and receipts

n) Automated Identification System (AIS) information for maritime shipping

0) Foreign airport security check stickers or labels

p) Conference/seminar materials (e.g., invitation, brochure, schedule)

6. Information about gold and jewelry worn by person at time of ENCOUNTER (e.g., receipts)

7. General items information:

a) Business cards

b) Phone numbers

c) Address books

d) Hmail addresses

e) Any cards with an electronic strip on it (hotel cards, grocery cards, gift cards, frequent flyer cards)

0 Pre-paid phone cards

g) Insurance cards

h) Medical/Health insurance information

1) Prescription information (e.g., doctor, pharmacy information) j) Sales receipts

k) Any additional biographic or biomctric identifiers to enhance

identity matching of associates or family members with a person who is a POSITIVE MATCH to a KNOWN or SUSPECTED terrorist (as well as associates or family members referenced in interviews or documents carried by a person who is a

POSITIVE MATCH to a KNOWN or SUSPECTED TERRORIST) I) Copies of identification documents obtained during the ENCOUNTER with a person who is a POSITIVE MATCH to a KNOWN or SUSPECTED TERRORIST (e.g., passports, Seaman's Papers, Airman Certificates, driver's licenses, state identification cards, and similar government identification documents) m) Any computer, uniform resource locator (URL), or Internet protocol (IP) address

information n) Calendars/schedulers

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 67

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

8. Licenses, permits, membership cards, and application information:

a) Membership cards (including library cards)

b) Gun show applications, firearms license, concealed weapons permit, shooting club memberships

c) HAZMAT license

d) Explosives permit

9. Tools or equipment information:

a) Scuba gear

b) Multiple cell phones

c) Binoculars

d) Peroxide

e) Ammunition

1) Camping fuel tabs

g) Any dual use material that could be used for TERRORIST ACTIVITY

10. Financial information:

a) Check book/individual or loose checks, including cashier's checks

b) Bank account numbers

c) Credit cards, especially those issued by U.S. banks and carried by non- U.S. PERSONS

d) Tax records

e) Business financial records 0 Bank statements

g) Credit card or billing statements

h) Utility bills

i) Anything with an account number

j) Wire transfer information, including receipts from Money Service Businesses k) Denominations of money being carried (i.e., what country(ics) currency(ies) are

they carrying), including, if possible, the serial numbers of currency carried I) Automated teller machine (ATM) receipts m) Ledgers

I I . Electronic media/devices observed or copied:

a) Cell phone list and speed dial numbers

b) Laptop images

c) GPS

d) Thumb drives

e) Disks

0 iPodorMP3

g) PDAs (e.g., Palm Pilots, Trios)

h) Kindle or iPad (electronic books)

i) Cameras

j) Video and/or voice recorders

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 68

UNCLASSI FIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

k) Pagers

I) Any electronic storage media

12. Employment information:

a) Pay stubs

b) Employment applications

c) Want ads

d) Employer correspondence

e) Access cards, badges

13. Professional papers/Academic information:

a) Resumes

b) Academic transcripts

14. Legal document information:

a) Birth certificates

b) Immigration and naturalization documents

c) Marriage licenses

d) Divorce decrees

e) Adoption papers 0 Living Wills

g) Last Will and Testament

h) Parking tickets

i) Speeding tickets

j) Property records (deeds)

k) Summons

I) Criminal documents or civil lawsuit information

15. Miscellaneous item information:

a) Long term storage facilities (e.g., access keys, codes)

b) Social networking accounts (e.g., Facebook, Twitter, MySpacc, Linkedln, ICQ)

c) Titles of books, DVD/CD, brochures being carried and their condition (e.g., new, dog-eared, annotated, unopened, professional journals)

d) Letters, envelopes

e) Letters of Introduction

f) Animal information (e.g., vet or chip information) IV. ENCOUNTER MANAGEMENT ACTIONS

5.12 Handling of ENCOUNTER packages. This section outlines the processes for handling and sharing ENCOUNTER packages by SCRKENERS, the TSC and NCTC.

5. 1 3 FBI/Law Enforcement encounters. TSOU coordinates the U.S. Government's response to an ENCOUNTER with a KNOWN or SUSPECTED TERRORIST. All collection of TERRORISM

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 69

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

INFORMATION during law enforcement ENCOUNTERS (e.g., traffic violations, investigations, arrests) are coordinated between the nominating agency and the encountering agency via TSOU.

5.13.1 l or domestic and international ENCOUNTERS with a person who is a POSITIVE MATCH to a KNOWN or SUSPECTED TERRORIST, TSOU will do the following: After receiving notification of an ENCOUNTER from the TSC, TSOU will disseminate and coordinate information to FBI operational entities and federal, state, and local law enforcement Agencies. TSOU simultaneously coordinates with the appropriate FBI Field Division(s) and Case Agent(s); Joint Terrorist Task Forces (JTTFs); Airport Liaison Agents and Attaches (ALAs); ;Lcgal Attaches (LEGATs); U.S. Embassies and/or other appropriate law enforcement officials, including ICE and CBP (specifically, NTC-P and NTC-C as appropriate); and appropriate members of the IC. For outbound ENCOUNTERS, or ENCOUNTERS involving subjects who have certain DEROGATORY INFORMATION, TSOU contacts (via phone and electronic notification) the appropriate countcrterrorism elemcnt(s). Especially sensitive ENCOUNTERS often require coordination and situational updates with the White 1 louse, Northern Command (NORTHCOM), and FBI's Counterterrorism- Watch.

5.14 TSC Actions. TSC will update existing KNOWN or SUSPECTED TERRORIST records with new TERRORIST IDENTIFIERS and TERRORISM INFORMATION and will provide the broader counterterrorism analytic community with as much new information as possible stemming from an ENCOUNTER with a KNOWN or SUSPECTED TERRORIST. TSC's primary methods for sharing TERRORISM INFORMATION with the broader counterterrorism analytic community will be through its BMA application and the use of Intelligence Information Reports (IIRs), as described further in Section V, infra. TSC will also coordinate with Fusion Centers on law enforcement and other ENCOUNTERS impacting their Area of Responsibility. This coordination will include a request for record enhancing information from the Fusion Center, which if received, will be added to the subject's KNOWN or SUSPECTED TERRORIST record.

5.14. 1 Any new TERRORISM INFORMATION recorded in, or attached to an EMA record by

TSC will be provided to NCTC via an automated ingest process.89 Such daily ingests of EMA records update NCTC's TIDE to reflect the fact of the ENCOUNTER, any new identifiers used to confirm the KNOWN or SUSPECTED TERRORIST POSITIVE MATCHES, or those identified in an MR. Once TIDE has been updated, an automated ingest from TIDE to TSDB is used to update the various I'SDB subsets (e.g., No Fly or Selectee Lists). At this point, the process is complete and the watchlisting, screening and law

An "automated ingest" is one where the contents of TSC's EMA records are incorporated into NCTC's TIDE database via a system-to-system transfer of information that identifies new or changed information. This process allows NCTC to spot KNOWN or SUSPECTED TERRORIST records that have been amended or updated. This process also accommodates the transfer of attached ENCOUNTER PACKAGES received from SCRF.ENERS. In those instances, the ENCOUNTER PACKAGES appear as attachments to the KNOWN or SUSPECTED TERRORIST record. ENCOUNTER PACKAGE attachments must be moved to another system in order to give the broader counterterrorism community access to the terrorism INFORMATION. That process is described in Section V, infra.

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 70

UNCLASSI FI ED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

enforcement communities have the most current and thorough TERRORISM INFORMATION available about a known or SUSPECTED terrorist. Most — but not all — of that TERRORISM information is available in a structured format as part of the KNOWN or SUSPECTED TERRORIST record (e.g., discrete elements such as a date of birth, country of origin). The unstructured TERRORISM INFORMATION, while also in digitized format (e.g., a computer disk, a scanned image of a business card, an encountering officer's report), is handled by NCTC.

5. 1 5 NCTC Actions. NCTC will post to TIDF, Online any digitized ENCOUNTER PACKAGE it receives from TSC or directly from a SCREENER. ENCOUNTER packages can be found under the subject's main page.

V. ROLES AND RESPONSIBILITIES FOR UPDATING EXISTING KNOWN OR SUSPECTED TERRORIST RECORDS AND NOMINATING NEW KNOWN OR SUSPECTED TERRORISTS BASED ON INFORMATION FROM POSITIVE ENCOUNTERS

5. 1 6 This section describes the roles and responsibilities of the watchlisting, screening, and counterterrorism communities for exploitation and analysis of the TERRORISM INFORMATION lawfully collected and shared when there is a POSITIVE MATCH to a KNOWN or SUSPECTED TERRORIST. In this context the following definitions apply:

5. 1 6. 1 "INITIAL REVIEW" means a quick review of the ENCOUNTER PACKAGE to identify obvious, new TERRORIST IDENTIFIERS about the KNOWN or SUSPECTED TERRORIST.

5. 1 6.2 "ADVANCED ANALYSIS" means a thorough review of the TERRORISM INFORMATION contained in an ENCOUNTER package obtained as a result of the ENCOUNTER with the KNOWN or SUSPECTED TERRORIST. ADVANCED ANALYSIS includes the adding of TERRORIST IDENTIFIERS to existing KNOWN or SUSPECTED TERRORIST records and identifying new KNOWN or SUSPECTED TERRORISTS who should be nominated through the existing nomination process. In this context, ADVANCED ANALYSIS is being done on a tactical matter related to the specific known or SUSPEC TED terrorist to identify information useful in "connecting the dots" between and among that known or SUSPECTED TERRORIST and other KNOWN or SUSPECTED TERRORISTS or potential KNOWN or SUSPEC TED TERRORIS TS. It is also when the need for foreign language translation services will be identified.

5. 16.3 "targeted ANALYSIS" means further exploitation of a targeted set of ENCOUNTER PACKAGES and ADVANCED ANALYSIS products to assist in identifying TERRORIST trends and changes to methods, tactics, and practices. ENCOUNTERS for TARGETED analysis are selected using contemporaneous threat criteria and research in additional repositories. Contemporaneous threat criteria includes association with a priority terrorist group (e.g.. NIPF Tier I or II); ENCOUN TERS with KNOWN or SUSPECTED

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 71

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

TERRORISTS designated as No Fly or associated with violent activity; or at the request of any Department or Agency that identities a need.

5.17 Results of initial review, advanced analysis, and TARGETED analysis efforts

(collectively, "Exploitation") by Departments or Agencies will be reported to the watchlisting, screening and counterterrorism communities using standard templates when available.

5.17.1 TSC Actions.

5.17.1.1 First Stage Review. I SC actions with KNOWN or SUSPECTED TERRORIST ENCOUNTERS occur in two stages. The first stage occurs when the ENCOUNTERING agency and TSC exchange terrorist identifiers to determine whether the individual is watchlisted (i.e., a POSITIVE MATCH to a TSDB record). TSC records any new TERRORIST IDENTIFIERS provided during this stage in TSC's EMA application.

5. 1 7.1 .2 Second Stage Review. The second stage occurs after TSC has confirmed there is a positive match to a known or suspected terrorist. For each positive ma tch to a known or suspected terrorist, the TSC's Office of Intelligence (TSC/OI) will generate an I1R for dissemination to the counterterrorism community that provides a summary about the known or suspected terrorist encounter (e.g., basic facts about the encounter such as date, time, and place). If available at the time the initial MR is prepared, TSC/OI will conduct an INITIAL REVIEW of the ENCOUNTER PACKAGE and provide a thumbnail summary of the terrorism information. For example, a summary might highlight the existence of a new KNOWN or SUSPECTED TERRORIST ("known or SUSPECTED TERRORIST was traveling with three other associates not previously identified in the car where the explosives were found in a hidden compartment") or the possibility that new TERRORIST IDENTIFIERS are available ("approximately 80 pages carried by the KNOWN or SUSPECTED TERRORIST were converted to electronic documents ranging from the KNOWN or SUSPEC TED TERRORIST'S calendar/address book to bank account and credit card numbers").

5. 1 7.2 National Media Exploitation Center Actions. Much of the TERRORISM information generated by encounters from a person who is a positive match to a known or suspected terrorist is expected to be in a foreign language that may hinder prompt exploitation. The National Media Exploitation Center (NMEC) has the capability to translate foreign language information and the experience necessary to understand the efforts used to hide their activities. When TSC receives ENCOUNTER PACKAGES with information in a foreign language, or when NCTC receives them directly from an encountering agency, TSC or NCTC will forward/notify NMF.C that it has the action to translate the ENCOUNTER PACKAGE. Once the ENCOUNTER PACKAGE has been translated and returned to TSC and NCTC, the assigned roles and responsibility for exploitation will apply.

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 72

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

5. 1 7.3 FBI Actions. The majority of the FBI's ENCOUNTERS with KNOWN or SUSPECTED TERRORISTS occur in the United States. The FBI has ADVANCED ANALYSIS responsibility for encounter PACKAGES on KNOWN or SUSPECTED TERRORISTS for whom the FBI has an open investigation, no matter where the individual is encountered. If the FBI does not have an open investigation on a KNOWN or SUSPECTED TERRORIST encountered in the United States, or if the KNOWN or SUSPECTED terrorist is a U.S. PERSON, then TSOU will send a lead directing the appropriate FBI Field office to conduct an assessment of the individual and the ENCOUNTER circumstances to determine whether to open a preliminary or full investigation.90 This assessment includes advanced ANALYSIS packages when provided by ENCOUNTERING AGENCIES. If no investigation is opened, an IIR will be sent to the NOMINATING AGENCY and NCTC which will be used to enhance the TIDE record with additional FBI-derived information.

5.17.4 DHS I&A Actions. DHS I&A has ADVANCED ANALYSIS responsibility for ENCOUNTER PACKAGES where the KNOWN or SUSPECTED TERRORIST is denied entry, denied BSTA, denied boarding, or is subject to a no board recommendation at a foreign location, or identified through ICE's visa security processes.

5.17.5 NCTC Actions. On occasion, DOS, USAID, and foreign governments have ENCOUNTERS with KNOWN or SUSPECTED TERRORISTS, usually in the form of a record ENCOUNTER (e.g., the KNOWN or SUSPECTED TERRORIST has submitted an application for a benefit like a visa or grant or information is provided to the United States by a foreign government). NCTC has ADVANCED ANALYSIS responsibility for ENCOUNTER PACKAGES in these instances.

5.17.5. 1 For TARGETED ANALYSIS, NCTC offers this capability for a select set of ENCOUN TER PACKAGES based on internal or interagency tasking. Since all ADVANCED ANALYSIS products created by FBI, DHS, or NCTC will be disseminated to the U.S. Government via an IIR, these materials are available to any organization seeking to further exploit specific ENCOUNTERS. NCTC will leverage these ADVANCED ANALYSIS products as part of its typical intelligence analytic process to highlight emerging threats, issues or concerns.

5.1 7.6 A chart depicting the roles and responsibilities by Department or Agency may be found at the end of this Chapter.

VI. RESPONSIBILITY TO COORDINATE ANY ACTIONS

CONTEMPLATED BASED ON INFORMATION FROM ENCOUNTERS WITH A KNOWN OR SUSPECTED TERRORIST

1)0 Under governing authorities, the EM can conduct "assessments" for an authorized purpose, such as obtaining information about a threat to national security, without a particular factual predication. To open an investigation whether a "preliminary" or "full" investigation - there must be a specific factual predication.

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 73

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

5.18 Information Sharing MOU Requirements. Departments and Agencies are reminded of their agreement to provide transparency between and among them with regard to their "activities to preempt, prevent, and disrupt TERRORIST attacks against U.S. PERSONS and interests.91" As a practical matter, that type of transparency demands, to the greatest extent possible, prior coordination with affected Departments or Agencies before action within a Department or Agency's authorities is taken based on terrorism INFORMATION from a person who is a POSITIVE MATCH to a KNOWN or SUSPECTED TERRORIST. For example, FBI, Central Intelligence Agency (CIA) or DOD, as lead counter-terrorism Agencies in their respective domains, must be consulted prior to taking any action based on ENCOUNTERS with a person who is a POSITIVE MATCH with known or SUSPECTED TERRORIS T. This guidance is subject to existing policies and coordination procedures when action against or pertaining to the KNOWN or SUSPECTED terrorist is contemplated.

5.19 Requests for Withholding of Action. In certain circumstances, law enforcement or the IC may request that a SCREENER not take action (e.g., not to refuse the visa, to allow individual to enter the United States, to not deny an individual to obtain an immigration benefit or access to the secure area of an airport) although action may be taken under the law. This request, to the extent practicable, shall be in writing, by a senior official, and include a statement of justification and risk mitigation. Departments and Agencies will establish mutually acceptable processes and procedures to implement a detailed plan.

[. EXAMPLES OF TERRORISM INFORMATION TYPICALLY AVAILABLE FROM ENCOUNTERS

5.20 The following examples of various types of ENCOUNTERS and the type of information typically generated from those encounters is offered to assist Departments and Agencies in understanding what additional or new information may become available as a result of following the guidance provided in this document.

5.20. 1 Ports of Entry. Types of documents that could be included in the ENCOUN TER PACKAGE typically include:

1 . Business cards

2. Copies of passport and visa entries

91 See Paragraph 3(b) of the Information Sharing MOU (Appendix 5): "Reciprocity and Transparency. All information collected by any entity relevant to the missions and responsibilities of any other covered entities should be shared, to the greatest extent possible, between and among all covered entities. Likewise, the parties agree that, to the greatest extent possible, there should be transparency between and among the covered entities with regard to their activities to preempt, prevent, and disrupt TERRORIST attacks against U.S. I'l-RSONS and interests. Except as otherwise specified in this Agreement, or mandated by relevant Federal statutes or Presidential Directives, procedures and mechanisms for information sharing, use, and handling shall be interpreted and implemented consistently and reciprocally regardless of the role a particular covered entity plays as a provider or recipient of covered information. In other words, for example, international TERRORISM INFORMATION collected by the Border Patrol should be shared by DI IS with the IC to the same extent foreign intelligence information on TERRORISM is shared by the IC with DHS."

UNCLASS1FIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 74

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

3.	Driver s license
4.	Resumes
- 5.	Conference literature
6.	Correspondence not in possession oi tne u.s. i osiai service.
7.	Letters of introduction
8.	Checks, bank deposit slips
9.	Calendar/schedule
10.	Address book
11.	Notepad entries
12.	Mariner's certificates
13.	Telephone data
14.	Location and duration of previous travel stops on current or past travel

itinerary

5.20.2 Law Enforcement ENCOUNTERS. Information collected from law enforcement ENCOUNTERS with a person who is a POSITIVE MATCH to a KNOWN or SUSPECTED TERRORIS T can include any information that would be collected when a law enforcement officer speaks with a KNOWN or SUSPECTED TERRORIST. Typically information that could be included in the ENCOUNTER PACKAGE can include, but is not limited to:

1 . Associates

2. Telephone numbers (home, business, cell, pager, or fax)

3. Other forms of identification

4. Physical descriptors

5. Family members

6. Occupation and work history

7. Travel plans or history

8. Vehicle information

5.20.3 Visa Applications. A typical DOS ENCOUNTER PACKAGE with a person who is a POSITIVE MATCH to a KNOWN or SUSPECTED TERRORIST will be a visa application for entry to the United States, which identifies basic information about the encountered KNOWN or SUSPECTED TERRORIST and the ENCOUNTER. Types of documents that could be included in the ENCOUNTER PACKAGE typically include:

1 . 1 lome and work address

2. Copies of passport and visa entries

3. National Identification Number (if applicable to the country)

4. Phone numbers (home, business, cell, pager, or fax)

5. Sponsorship information (when available, to include individual's name/Company/Government, address and contact information)

6. Family member names (e.g., spouse, parents, children)

7. Police Certificates (if applicable)

8. Biometrics (Photos and Fingerprint Identification Number (FIN))

9. Resumes (when applying for business visas) 1 0. Letters of introduction

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 75

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

1 1.	Mililarv rplalefi Hnrnmpnt^ i*i ii iiai y iuiuiwu viw^fiu i ivi 1 ii>
12	FnnpJit ion
n	I I IVJI LI dVLI
14.	Occupation and work history
15.	Financial information used to support visa application including bank
	statements, salary slips/letters, property records
16.	Photos
17.	Kmail addresses

5.20.4 Applications or Petitions for Immigration Benefits. USCIS may receive an application from an alien for immigration benefits or petitions. Depending on the completed form, USCIS may have information from the following non-exhaustive

categories:
1.	Residences domestic and foreign
2.	Family Members (often extended family)
3.	Occupation
4.	Bank account information
5.	Biometrics
6.	Gender
7.	Identity documents
8.	Travel document information (and 1-94)
9.	Civil documents — POB, COC data
10.	Employer/Prospective Employer
11.	Religious Affiliations
12.	Resumes
13.	Educational Background
14.	Past marriages or divorces
15.	Biographical Information

5.20.5 ENCOUNTERS by HSPD-6 Foreign Partners. On some occasions, and based on the arrangement with and legal authorities of the particular foreign partner involved, an ENCOUNTER PACKAGE may include the KNOWN or SUSPECTED TERRORIST'S visa application to a foreign partner. One such student visa/permit application to a foreign partner could include information provided from the KNOWN or SUSPECTED TERRORIST in the following categories:

1 . Name as shown in passport

2. Other names known by or ever known by

3. Name in ethnic script

4. Gender

5. Date of birth

6. Town/city of birth

7. Country of birth

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 76

U INCLASSI FI ED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

8. Passport number, country, expiration date

9. Country of citizenship 10. Other citizenships held

I I . Residential address and telephone number in home country

12. Local residential address and telephone number (if already in country)

13. Name and address for communication about this application

14. Name and address of friends, relatives, or contacts you have in the country (if applicable)

1 5. All periods of employment, including self-employment (to/from dates, name of employer, location, type of work/occupation/job title)

16. Financial information used to support visa application including bank statements, salary slips/letters, and property records

1 7. Length of planned stay in country

1 8. Questions concerning the person's character (e.g., whether the person has ever been convicted, charged, or under investigation for any offensc(s) against the law in any country; ever deported, excluded or refused a visa by/rcmoved from any country; and police certificates (as evidence of character) from home country or countries of citizenship and from all countries where the person has lived for five or more years since age 1 7)

1 9. Whether the application is for a student visa, a student permit, or a limited purpose visa

20. Whether the application is for a variation of conditions to work

21. Course of study and details of the course(s) enrolled

22. Arrangements for outward travel from host country

23. Name of legal guardian, other names legal guardian is known by, and relationship (e.g., mother, father, legal guardian)

24. Any national identity number or other unique identifier issued by a government

25. Any completed military service (e.g., from/to dates, rank, unit name or number, role)

26. Whether presently subject to military service obligation in any country

27. Any association with any intelligence agency or group, or law enforcement agency

28. Any association with any group or organization that has used or promoted violence to further their aims

29. Any involvement in war crimes, crimes against humanity, and/or human rights abuses

30. Payment method for application fee (e.g., bank check/draft, credit card, or personal check)

VIII. OBTAINING ENCOUNTER INFORMATION THROUGH TSC'S DAILY ENCOUNTER REPORTS

5.21 In addition to the aforementioned TSC/OI IIRs following an ENCOUNTER with a person who is a POSITIVE MATCH to a KNOWN or SUSPECTED TERRORIST, Agencies can obtain the Daily

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 77

UNCLASS1FIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Summary Report (DSR) to assist them in identifying ENCOUNTERS of interest to their organizational missions. DSRs will contain as much information as legally permissible. DSRs arc available from the following locations:

5.21.1 On the Secret Internet Protocol Router Network (SIPRNET), www.fbi.sgov.pov/ , click on the "TSC Intel Daily Summary Reports" link on the right side.

5.2 1 .2 On Law Enforcement Online (LEO) via www.leo.uov

5.2 1 .3 On Regional Information Sharing Systems via www.riss.net 5.2 1 .^On 1 IS SUC (for access contact state or local fusion center) or email:

fiihq.dhs.gov

5.21.5

5 Two sources on FBINct:

5.21.5. 1 TSC's homepage at http://home.lbinet.lbi/nsb/tsc/Paces/Default.aspx

5.21.5.2 Current Intelligence Report at httn://di.tbinet.fpi/ims/ciu/ciro/

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 78

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Encounter Roles and Responsibilities

* ni oimtar	SttUAttonit* *	Encounto	PaCR<«U01>	Notifiratlon Encounter	Xn4ti*»l Review	Advanced Annlyfeis	1 TnrQntcd 1 Analysis 1
Entity	Type	Data Format	Maclplant*	MaM>"n*lbla Intlty	ciilnrd loi.i 1 Mf\	Rasponslbla Entity	Raspunslble tnllly
DHS/CBP/NTC	AppuhenUon 1 ■! 1 . .,1 ,. . . . nr 1 B t.UPiy eSTA i-.. i !.,:»-« inwMilon land Border i nuilnf Vrurl MinitMl Cargo Shipment Flle,ht Manifntli (Inbound and	«....,.,(.. Package	i. NCJC (aottt to NOt, NOt -J. NOt-S) 7. FBI J. OHS	ft. TSOU Operational Notification 7. TSC-OI (IIR) Community Notification	isc/isroc (Racalve* F lac Ironic Rafarral,	FBI tOpvn court. USTFR. oc ina KST 1% odmltfaVt* In fna U.S.) OHS/MA, 11% nrtponuolr for oVntao* mtrlm%)	NCTC
DHS/ICC	Namoval Investigation twt'adlllon (In coordination with DOS and DO J) SEVIS Recurrent Urlllti« I»MS National SixurHy OvarMay Initiative	Cncounler Packs B«	1. NCJC n ■ ■ " fO NOC NC*W. NOt S) J. DNS	I. TSOU-Ope rational Notification 1. TSC-CM (MB) -Community Notifiratlon	rsc/Tsroc (Ravtaw* Elactronlc Rafarral)	fBI fOaan coaea. USJtB. Or rna KST Im oomlttmtt/1% In fna U.S.) OHS/IA\A (It >nnunH0/r foe oVrHacf rntrlai)	NCTC
DHS/TSA	iMMft (llBht Credent lallna. (OlA) Pre- Flight Inspection Ftlarht Manila**** Other	[ncoUMar *•<*•*:•	j . Aicrc fpottt to NOJ 1 NOt-SJ 2. rWf S. DNS	I. TSOU-Operatlonai Nor '/>r of 'on t. JSC CM (lilt) Community Notification	ISC/TSTOC (Racaiva* f lactronlr Rafarral)	fBI /Opan COST*. <>:!•> or rna KST It a. ■< ■ - in fna IAJJ liltS/iBn (It ....... i.-, for dr-nlrd anrrtaaj	NCTC
DHS/U it I S*	Applicant i'<- 1 i' i > 11 '•< l-wy	Application/ nrvliHH Visa Application*	i. were /pout to NOt. NOt-J. NO*, i) J. OHS * JSC	1. JSOU-Oporotlonat Notification I. TSC CM (HB) Community Notification	TSC/CIS Application)	IBI (Oaan cot**, USft H. or ina KST It inliwtittr*ttflt In tna U.S.) OHS/IAA (It rrtpontlblr fur aWnnrd vntel**)
DHS/US Coa«t Guard	APIS Quary VtiM) ManllaM Maritime Credenllallna. VvMal K- Port InlprOtona liiws>llgalluni tew Enforcement	Encountar Package	1. NCTC (pottt ro NO*. NOt -J, NOt-S, 2. fbi S. OHS	1. TSOU Operational Notification 2. JSC-CM (lift) Community Notification	TSC/TSTOC	FBI (Often coses. USP£B. or lha KST It a. . i , . m fffa U.S.) t >/'%.'!*.■• (it roaponsib/a for a»ntod mntilat)	NCIC
DHS/US llUfl Satrvlca	Invest l«*t Ions Political and Special Event*	Encountar Package	J. NCTC f|KHIl fa NOt, NOt -J, NOt -S) 7. fbi J. DNS	1. TSOU-Operattortal Notification 2. rsc CM ,nm , <y Notification	TSC /TS IOC	fBI (Onr-n rosea. USP* *. or fna KSr It ■ .. t . ► • ' i . ■ ' ■ * ■• In fha U.S )	NCTC
		C mrc nt/ITav»ou» Application*	1. NCtC (pottt in NOt. NOt-l, NOi'S) i. fm > DOS « rsc	1. TSOU-ape rational Notification 7. TSC Ol (Mt)-Communlty Notification	rsc /Dos (Rawlaw* Vlia A .	NCTC FBI	NCTC
DOS	Viva Hawocallom	C ur > a nt/ProvHMn Application*	1 NCtC (QOttttO NOt. NtM ■ 1. NOt ■ S) 1 /til 1 DOS g rsc	1. ISOU -On* rational Notification 2. JSC-CM (HHf - Community Notification	rsc/oos (Ravlaw* Mm ApplKatlon)	NCTC FBI	NCTC
	l*(tipaii Application	f* • •rr*>nr/Pravlmn Application*	1 NCTC (paitt la NOt. NOt-l. NOt-SI 1 'W • DOS S_T*<	X. TSOU Oar rational <Vi.<./i. or/on 2. TSC CM fll/IJ- Community Notification	TSC/TSTOC (Ravlaw* Passport A,,,. ..... .....	NCTC FBI	NCIC
USA ID	Reneflts	Application (Whan Available)	NOV, NOt J. NOt SI ». rsou ft rsc	I. TSOU-Ooriullif <ol Notification t ISC-CM fllRf-Communlty Notification	TSC/USAIO (II... • I-. I.IKIIl Rafarral)	NCTC	NCTC
1 ...	Remote Onery Inlarnalinnal	Foreign Oovernment POC Referral/ Application (whan Available)	1. NCTC (pottt To NOt NOt J. NOt S) 7. rsc	1. TSOU-Oo* rational Notification 2. TSC-Ot fllHf Community Notification	TSC/TSIOC (Ravi aw* Viae Ironic Rafarral)	FBI (OrMtn rosea, USPtft. or rna KST It odmlttvnyis In fna U.S.) NCTC	NCTC
Government	Lagacy A Othar Countries	rorsngn Government °OC Rafarral/ A, -i . (Whan Avallabla)	1 NCTC (p >SfI to NOt. NOt A NOt {/ «*. rsc	1. TSOU Oom rational Nuffitulion 2. rSC-Ot IHB) Community Notification	TSC/DOS (Reviews Electronic Rafarral)	FBI (Open cattt. USPCB. or Ina ICST It ndmlttr-d/lt In fna U.S.) NCTC	NCTC
Law (nlorecmcni	National Instant Dachfround Chech* / Traffic Violation / DoO law Inloiramanl InveW kjatlon M Related IkOmeUiC ' .	I HI CA/Ji II forward* Blomalrlc*. Police Raport (Whan Avallabla)	2. / 'i' **. NCTC	1. TSOV-aa+rotlonal Notification 2. JSC -CM (URt-Communlty Notification	TSC/TSTOC (Via Telephone Call)	fBI USftH. or rna KST It inlrttltleoyit In rna U.S.) NCTC	NCTC
	" Sactlon II, infra , Identifies iaiaf|o»at of naaoaii" iwomaiioh from anfounlai with positively Identified inowhiv iv Interest to MOMMMioat, othar « ount«run ■ »•>> analyst*, or lha wetchllstlne. community Cmouniating entitles should roller aulhofl Hal (o raialn and share iiaaowtv ihu*m»iom.	IW lid HRajoMtti that an* of potential and share whan It Is wtil»>. il.«t. lVrt'<

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

Page | 79

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

A. ADVANCED ANALYSIS: is a thorough review of the TERRORISM INFORMATION contained in an ENCOUNTER PACKAGE obtained as a result of the ENCOUNTER with the known or SUSPECTED terrorist, advanced analysis includes the adding of terrorist IDENTIFIERS to existing KNOWN or SUSPECTED TERRORIST records and identifying new KNOWN or SUSPECTED TERRORISTS who should be nominated through the existing nomination process. In this context, ADVANCED ANALYSIS is being done on a tactical matter related to the specific KNOWN or SUSPECTED TERRORIST to identify information useful in "connecting the dots" between and among that KNOWN or SUSPECTED TERRORIST and Other KNOWN or SUSPECTED TERRORISTS or potential known or SUSPECTED TERRORISTS. It is also when the need for foreign language translation services will be identified.

B. AGGREGATORS: are those who receive and hold TERRORISM INFORMATION and certain other non-TERRORlSM INFORMATION they are authorized to receive and retain.

C. DEROGATORY INFORMATION: is intelligence or information that demonstrates the nature of an individual's or group's association with TERRORISM and/or TERRORIST ACTIVITIES.

D. ENCOUN TER: is an event in which an individual is identified during a screening process to be a "POSITIVE MATCH," "POTENTIAL MATCH," or "INCONCLUSIVE MATCH," to an individual who has been designated in the TSDB as a KNOWN or SUSPECTED TERRORIST. An ENCOUNTER can be a facc-to-face meeting with a KNOWN or SUSPECTED TERRORIST, electronic or a paper-based ENCOUNTER (e.g., the KNOWN or SUSPECTED TERRORIST has submitted an application for a benefit liked a visa, ETSA grant, or information is provided to the United States by a foreign government, aircraft operator, or other private entity).

E. ENCOUNTERING AGENCY: is a Department or Agency of the U.S. Government with terroris t screening or law enforcement responsibilities that comes into contact with a KNOWN or SUSPECTED TERRORIST (whether in a face-to-facc situation or via an electronic or written submission such as an application for a benefit) that the TSC determines is a POSI TIVE MATCH to a KNOWN or SUSPECTED TERRORIST.

F. ENCOUNTER PACKAGE: is all information gathered during an ENCOUNTER with a KNOWN or SUSPECTED TERRORIST.

G. ENHANCEMENT: is the addition of new TERRORIST IDENTIFIERS or DEROGATORY INFORMATION on a KNOWN or SUSPECTED TERRORIST.

H. FOREIGN FIGHTERS: are nationals of one country who travel or attempt to travel to another country to participate in TERRORISM and/or terroris t ACTIVITIES.

I. FRAGMENTARY INFORMATION: is information that suggests an individual may have a nexus to terrorism and/or terroris t activi ties but the information available to the nomina tor does not meet either or both the minimum identifying criteria that will facilitate identification of these individuals or the substantive DEROGATORY INFORMATION to meet the REASONABLE SUSPICION standard but does qualify as information that should be provided to NCTC pursuant to HSPD-6.

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

J. INCONCLUSIVE MATCH: is the final determination by TSC that limited information in the subject data set matches TSDB data in a TSDB record and no additional identifiers are available to verify the match.

K. INITIAL REVIEW: is a quick primary review of the ENCOUNTER PACKAGK to identify obvious, new TERRORIST IDENTIFIERS about the KNOWN or SUSPECTED TERRORIST.

L. KNOWN TERRORIST: is an individual whom the U.S. Government knows is engaged, has been engaged, or who intends to engage in TERRORISM and/or TERRORIST ACTIVITY, including an individual (a) who has been, charged, arrested, indicted, or convicted for a crime related to TERRORISM by U.S. Government or foreign government authorities; or (b) identified as a terrorist or member of a designated foreign terrorist organization pursuant to statute. Executive Order or international legal obligation pursuant to a United Nations Security Council Resolution.

M. LONE WOLF: an individual motivated by one or more extremists ideologies, who operates alone and supports, or engages in acts of violence in furtherance of that ideology or ideologies thai may involve direction, assistance, or influence from a larger terrorist organization of a foreign actor.

N. NOMINATOR or NOMINATING DEPARTMENT OR AGENCY: is a Federal Department or Agency that has information to indicate that an individual meets the criteria for a known or SUSPECTED terrorist and nominates that individual to TIDE and the TSDB based on information thai originated with that Department or Agency and/or a third Department or Agency.

O. OPERATIONALLY CAPABLE: as described in Chapter 4, an individual is "OPERATIONALLY CAPABLE" if, based on credible intelligence, he or she, acting individually or in concert with others, reasonably appears to have the ability, knowledge, opportunity, and intent or is actively seeking the opportunity to engage in a violent act of TERRORISM consistent with 1 8 U.S.C. 233 1 or 1 8 U.S.C. 2332b. For example, attempting to obtain an IF.D would indicate an individual is OPERATIONALLY capable of committing an act of terrorism. However, simply conducting internet research concerning IHDs would not be sufficient without additional activity. Depending on circumstances, and in combination with other facts, scouting potential targets or traveling for no legitimate purpose to places that have TERRORIST training grounds, regardless of whether the person is presently capable of using an IED, might also indicate an individual is OPERATIONALLY CAPABLE of committing an act of TERRORISM.

P. ORIGINATOR: is the Department or Agency that has appropriate subject matter interest and classification authority and collects TERRORISM INFORMATION (i.e., raw information) and disseminates it or TERRORIST IDENTIFIERS to other U.S. Government entities in an intelligence report (i.e., finished intelligence) or other mechanism.

Q. PARTICULARIZED DEROGATORY INFORMATION: is the type of information relied on to

determine whether REASONABLE SUSPICION is met. This is information that demonstrates the nature of an individual's or group's association with TERRORISM and/or TERRORIST ACTIVITIES

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

that is descriptive and specific to an event or activity, and is more than a label, For example, "Subject X provides false travel documentation for Al-Qaida operatives" is PARTICULARIZED DEROGATORY INFORMATION, whereas "Subject Y is a supporter," standing alone, is not considered PARTICULARIZED DEROGATORY INFORMATION.

R. POSITIVE MATCH: occurs when the TSC determines that information about a subject encountered by a SCREENER exactly or reasonably matches a record in the TSDB.

S. POTENTIAL MATCH: occurs when an ENCOUNTERING AGENCY believes it has a match with a known or SUSPECTED TERRORIST record in the TSDB. An ENCOUNTERING AGENCY may attempt to resolve POTENTIAL MATCHES first through its review process. If an ENCOUNTERING AGENCY'S review process cannot resolve the individual's status as not a match to a TSDB record, the ENCOUNTERING AGENCY will refer the POTENTIAL MA TCH to TSC for final adjudication.

T. PURELY DOMESTIC TERRORISM INFORMATIONS is defined in the TSC MOV as information about U.S. PERSONS that has been determined to be PURELY DOMESTIC TERRORISM INFORMATION with "no link to foreign intelligence, counterintelligence, or international TERRORISM."

U. REASONABLE SUSPICION: is the standard that must be met in order to include an individual in the TSDB, absent an exception provided for in the Watchlisting Guidance. To meet the REASONABLE suspicion standard, the nominator, based on the totality of the circumstances, must rely upon articulable intelligence or information which, taken together with rational inferences from those facts, reasonably warrants a determination that an individual is known or suspected to be or has been knowingly engaged in conduct constituting, in preparation for, in aid of, or related to TERRORISM and/or TERRORIST ACTIVITIES. There must be an objective factual basis for the NOMINATOR to believe that the individual is a KNOWN or SUSPECTED TERRORIST. Merc guesses or hunches are not enough to constitute a REASONABLE SUSPICION that an individual is a KNOWN or SUSPECTED terrorist. Reporting of suspicious activity alone that does not meet the REASONABLE SUSPICION standard set forth herein is not a sufficient basis to watchlist an individual. The facts, however, given fair consideration, should sensibly lead to the conclusion that an individual is, or has, engaged in TERRORISM and/or TERRORIST ACTIVITIES.

V. SCREENER: a Department or Agency that is authorized to conduct TERRORISM screening to determine if an individual is a possible match to a KNOWN or SUSPECTED TERRORIST in the TSDB. SCREEN ERS can include Federal Departments or Agencies, state, local, tribal, territorial, or foreign governments and certain private entities. The term 'SCREENER' is used throughout this document as a general reference to a government official who compares an individual's information with information in the TSDB to determine if an individual is in the TSDB. Law enforcement officials who engage in such activities may normally describe their targeting or other actions in this context as other than "screening." For ease of reference, government officials who compare an individual's information with information in the TSDB will be referred to in the Watchlisting Guidance as a "SCREENER."

VV. SUSPECTED TERRORIST: is an individual who is REASONABLY SUSPECTED to be, or has been engaged in conduct constituting, in preparation for, in aid of, or related to TERRORISM and/or TERRORIST activities based on an articulable and reasonable SUSPICION.

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

X. TARGETED ANALYSIS: is further exploitation of a targeted set of ENCOUNTER packages and

ADVANCED ANALYSIS products to assist in identifying TERRORIST trends and changes to methods, tactics, and practices. ENCOUNTERS for TARGETED ANALYSIS are selected using contemporaneous threat criteria, and research in additional repositories. Contemporaneous threat criteria include association with a priority terrorist group (e.g., NIPF Tier I or II); ENCOUNTERS with KNOWN or SUSPECTED TERRORISTS designated as No Fly or associated with violent activity; or at the request of any Department or Agency that identifies a need.

Y. TERRORISM AND/OR TERRORIST ACTIVITIES: is a combination of definitions because none of the federal law definitions of "terrorism" or "terrorist activities" were directly applicable to the consolidated approach to watchlisting. For terrorist watchlisting purposes under this Watchlisting Guidance, "terrorism and/or terrorist activities" combine elements from various federal definitions and are considered to: (a) involve violent acts or acts dangerous to human life, property, or infrastructure that may be a violat ion of U.S. law, or may have been, if those acts were committed in the United States; and, (b) appear intended to intimidate or coerce a civilian population, influence the policy of a government by intimidation or coercion, or affect the conduct of government by mass destruction, assassination, kidnapping, or hostage-taking. This includes activities that facilitate or support TERRORISM and/or TERRORIS T ACTIVITIES, such as providing a safe house, transportation, communications, funds, transfer of funds or other material benefit, false documentation or identification, weapons (including chemical, biological, or radiological weapons), explosives, or training for the commission of act of terrorism and/or TERRORIST ACTIVITY.

Z. terrorism information: applies, where appropriate, to purely domestic terrorism as defined In the TSC MOV and incorporates the definition found in in section 1 0 1 6 of the IRTPA (6 U.S.C. 485), as amended. The term "TERRORISM information" means -

1 . all information, whether collected, produced, or distributed by intelligence, law enforcement, military, homeland security, or other activities relating to —

a) the existence, organization, capabilities, plans, intentions, vulnerabilities, means of finance or material support, or activities of foreign or international terrorist groups or individuals, or of domestic groups or individuals involved in transnational TERRORISM;

b) threats posed by such groups or individuals to the United States, U.S. PERSONS, or United States interests, or to those of other nations;

c) communications of or by such groups or individuals; or

d) groups or individuals reasonably believed to be assisting or associated with such groups or individuals; and

2. includes weapons of mass destruction information.

a) Weapons of Mass Destruction Information: information that could

reasonably be expected to assist in the development, proliferation, or use of a weapon of mass destruction (including a chemical, biological,

UNCLASSIFIED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

UNCLASSIFI ED//FOR OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

radiological, or nuclear weapon) that could be used by a TERRORIST or a terrorist organization against the United States, including information about the location of any stockpile of nuclear materials that could be exploited for use in such a weapon that could be used by a TERRORIST or a terrorist organization against the United States.

AA. TERRORISM SCREENING INFORMATION: is defined in the standard HSPD-6 agreement to mean unclassified identifying information about KNOWN or SUSPECTED TERRORISTS.

BB. TERRORIST: please see KNOWN TERRORIST or SUSPECTED TRRRORIST.

CC. TERRORIST IDENTIFIERS: are referred to in the TSC MOV as U//FOUO data for inclusion into the TSDB. TERRORIST IDENTIFIERS are data points about a particular identity that include names and aliases, dates of birth, places of birth, unique identifying numbers, passport information, country of origin and nationality, physical identifiers, addresses, photographs or renderings of the individual, fingerprints or other biomctric data, employment data, license plate numbers, and any other TERRORISM INFORMATION that ORIGINATORS specifically provide for passage to the TSC.

DD. TERRORIST INFORMATION: as defined in HSPD-6 is "information about individuals known or appropriately suspected to be or have been engaged in conduct constituting, in preparation for, in aid of, or related to terrorism."

EE. U.S. PERSON: is defined in Executive Order 12333 (as amended) as "a United States citizen, an alien known by the intelligence element concerned to be a permanent resident alien, an unincorporated association substantially composed of United States citizens or permanent resident aliens, or a corporation incorporated in the United Stales, except for a corporation directed and controlled by a foreign government or governments." The Watchlisting Guidance contains certain exceptions to the minimum substantive derogatory standards for TERRORIST watchlisting that support immigration and visa screening activities by the DHS and DOS to determine whether ineligibilities exist for admission to the United States or visa adjudication pursuant to the INA. Because the INA defines "aliens" as any person not a citizen or national of the United States, the INA admissibility provisions also apply to LPRs, in certain circumstances, who are considered as U.S. PERSONS under Executive Order 12333. Consequently, NCTC developed a mechanism in TIDE to identify and distinguish U.S. citizens from non-U. S. citizens in order to further distinguish between "aliens" under the INA and U.S. PERSONS under Executive Order 12333. See INA § 101(a)(3) [8 U.S.C. 1101(a)(3)].

U N C L ASS I FI E D//FO R OFFICIAL USE ONLY/SENSITIVE SECURITY INFORMATION

For Immediate Kclease Office ol Ihe Press Secretary September 16 2003

Homeland Security Presidential DirectiveyHspd-6 Subject. Integration and Use of Screening Information

To protect against terrorism it is the policy of the United States to (1 ) develop, integrate, and maintain thorough, accurate, aid current information about individuals known or appropriately suspected to be or have been engaged in conduct constituting, in preparation for. in aid of. or related to terrorism (Terronst Information), and (2, use that information as appropriate and to the full extent permitted by law to support (a) Federal. State, local, territorial tribal, foreign -government, and private-sector screening processes and (b) diplomatic, military, intelligence, law enforcement, immigration, visa, and protective processes

This directive shall be implemented in a manner consistent with the provisions of the Constitution and applicable laws, including those protecting the rights of all Americans.

To further strengthen the ability of the United States Government to protect the people, property, and territory of the United States against acts of terrorism, and to the full extent permitted by law and consistent with the policy set forth above:

(1 ) The Attorney Geieral shall establish an organization to consolidate the Government's approach to terrorism screening and provide for the appropriate and lawful use of Terrorist Information in screening processes

(2) The heads of executive departments and agencies shall, to the extent permitted by law. provide to the Terrorist Threat Integration Center (TTIC) on an ongoing basis all appropriate Terrorist Information m their possession, custody! or control. The Attorney General, in coordination with the Secretary of State, the Secretary of Homeland Security, and the Director of Central Intelligence shall implement appropriate procedures and safeguards with respect to all such information about United States persons. The TTIC will provide the organization referenced in paragraph (1) with access to all appropriate information or intelligence in the TTIC's custody, possession, or control that the organization requires to perform its functions.

(3) The heads of executive departments and agencies shall conduct screening using such information at all appropriate opportunities, and shall report to the Attorney General not later than 90 days from the date of this directive, as to the opportunities at which such screening shall and shall not be conducted

(4) The Secretary of Homeland Security shall develop guidelines to govern the use of such information to support State, local, territorial, and tribal screening processes, and private sector screening processes that have a substantial bearing on homeland security.

(5) The Secretary of State shall develop a proposal for my approval for enhancing cooperation with certain foreign governments, beginning with those countries for which the United States has waived visa requirements, to establish appropriate access to terrorism screening information of the participating governments

This directive does not alter existing authorities or responsibilities of department and agency heads to carry out operational activities or provide or receive information This directive is intended only to improve ;he internal management of the executive branch and is not intended to. and does not. create any right or

Page 1 of 2

Denefit enforceable at law or in equity by any party against the United States, its departments, agencies, entities, officers, emoloyees or agents, or any other person

The Attorney General, in consultation with the Secretary of State, the Secretary of Homeland Security, and the Director of Central Intelligence, shall report to me through the Assistant to the President for Homeland Secunty not later than October 31. 2003, on progress made to implement this directive and shall thereafter repor. to me on such progress or any recommended changes from time to time as appropriate.

GEORGE W BUSH

###

Page 2 of 2

THE SECRETARY OF STATE THE ATTORNEY GENERAL THE SECRETARY OF HOMELAND SECURITY THE DIRECTOR OF CENTRAL INTELLIGENCE

MEMORANDUM OF UNDERSTANDING ON THE INTEGRATION AND USE OF SCREENING INFORMATION TO PROTECT AGAINST TERRORISM

(1) This memorandum represents the consensus view of the Secretary of State, the Attorney General, the Secretary of Homeland Security, and the Director of Central Intelligence-regarding the implementation of Homeland Security Presidential Directive-6 (HSPD-6), dated September 16. 2003, entitled "Integration and Use of Screening Information to Protect Against Terrorism." (U)

(2) Consistent with the President's direction, the Parties to this Memorandum will develop and maintain, to the extent permitted by law, the most thorough, accurate, and current information possible about individuals known or appropriately suspected to be or have been involved in activities constituting, in preparation for, in aid of, or related to terrorism ("Terrorist Information"), and will, as described in this Memorandum:

(a) use that information to support screening processes at all appropriate opportunities;

(b) make accessible appropriate information to State, local, territorial, and tribal authorities to support their screening processes and otherwise enable them to identify, or assist in identifying, such individuals;

(c) host mechanisms, to the extent permitted by law, to support appropriate private sector screening processes that have a substantial bearing on homeland security;

(d) host mechanisms, to the extent permitted by law, to support appropriate foreign government screening processes that have a substantial bearing on homeland security;

(e) provide or make accessible appropriate information to foreign governments cooperating with the United States in the war on terrorists of global reach; and

(f) ensure that these activities are carried out in a manner consistent with the Constitution and applicable laws. (U)

Page I of 8

Terrorist Screening Center

(3) To implement the President's directive, the Attorney General, acting through the Direcior of the FBI, and in coordination with the Secretary of State, the Secretary of Homeland Security, and the Director of Central Intelligence, will establish the Terrorist Screening Center to consolidate the Government's approach to terrorism screening and provide for the appropriate and lawful use of Terrorist Information, in screening processes. (U)

(4) The Terrorist Screening Center will:

(a) maintain a consolidated terrorist screening database that is a continuously updated, sensitive but unclassified subset of the Terrorist Information possessed by the TT1C, and the Purely Domestic Terrorism Information (i.e., information about U.S. persons that has been determined to be purely domestic terrorism information with no link to foreign intelligence, counterintelligence, or international terrorism) possessed by the FBI;

(b) determine, for each entry in the consolidated terrorist screening database, which supported screening processes shall query that entry, as described in paragraphs (15) through (24);

(c) ensure, consistent with applicable law, that appropriate information possessed by State, local, territorial, and tribal governments, which is available to the Federal