Risk
8/23/2010
12:34 PM
Connect Directly
RSS
E-Mail
50%
50%

DHS To Automate Terror Watchlist

Watchlist Service will replace the current manual process for sending information from the Terrorist Screening Database to the DHS

The Department of Homeland Security plans to automate the process for how it receives data from the Terrorist Screening Database (TSD).

Working together with the FBI Terrorist Screening Center, the agency is developing a Watchlist Service to replace multiple, manual data feeds from the TSD to various components within the DHS.

The service will help the agency “move away from a manual and cumbersome process of data transmission and management to an automated and centralized process,” according to a DHS document outlining the Watchlist Service.

A presidential directive issued in September 2003 established a consolidated watchlist to help government enforcement officials identify, screen and track terrorist suspects or those believed to have the potential to engage in terrorist activities.

The system was criticized when airport screeners failed to identify a man who attempted to blow up a U.S. flight from Amsterdam to Detroit on Christmas day, 2009, even though he was on the watchlist. A failed car bomb in New York earlier this year also called into question the usefulness of the system.

The Watchlist Service will be implemented in several phases, according to the DHS. In the initial phase, those building the system will install a data broker to manage the transfer of data and ensure that DHS entities receiving data will receive only formatted records that are authorized for use.

In the second implementation phase, the service will be fitted with another data broker to manage encounter information regarding people on the watchlist.

Currently, when there is an encounter with a potential match on the watchlist, a report of that is sent to the TSD via a system-generated message or manually, by secure phone or fax. The DHS Watchlist Service Encounters Data Broker will allow all of these transmissions to be sent in a standardized way, as well as securely recorded for future use, according to the DHS.

A later implementation phase will add a persistent data store of the TSD within a DHS server so people can perform queries on the information. A combination of off-the-shelf products and custom components will be used to build the Watchlist Service, according to the DHS.

The DHS Screening Coordination Office will oversee the business end of creating the system, while the DHS Transportation Security Agency and Customs and Border Protection will handle the technical side. The DHS Office of the CIO also will aid with initial requirements and project management.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6117
Published: 2014-07-11
Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777.

CVE-2014-0174
Published: 2014-07-11
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

CVE-2014-3485
Published: 2014-07-11
The REST API in the ovirt-engine in oVirt, as used in Red Hat Enterprise Virtualization (rhevm) 3.4, allows remote authenticated users to read arbitrary files and have other unspecified impact via unknown vectors, related to an XML External Entity (XXE) issue.

CVE-2014-3499
Published: 2014-07-11
Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.

CVE-2014-3503
Published: 2014-07-11
Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Marilyn Cohodas and her guests look at the evolving nature of the relationship between CIO and CSO.