Risk
8/23/2010
12:34 PM
Connect Directly
RSS
E-Mail
50%
50%

DHS To Automate Terror Watchlist

Watchlist Service will replace the current manual process for sending information from the Terrorist Screening Database to the DHS

The Department of Homeland Security plans to automate the process for how it receives data from the Terrorist Screening Database (TSD).

Working together with the FBI Terrorist Screening Center, the agency is developing a Watchlist Service to replace multiple, manual data feeds from the TSD to various components within the DHS.

The service will help the agency “move away from a manual and cumbersome process of data transmission and management to an automated and centralized process,” according to a DHS document outlining the Watchlist Service.

A presidential directive issued in September 2003 established a consolidated watchlist to help government enforcement officials identify, screen and track terrorist suspects or those believed to have the potential to engage in terrorist activities.

The system was criticized when airport screeners failed to identify a man who attempted to blow up a U.S. flight from Amsterdam to Detroit on Christmas day, 2009, even though he was on the watchlist. A failed car bomb in New York earlier this year also called into question the usefulness of the system.

The Watchlist Service will be implemented in several phases, according to the DHS. In the initial phase, those building the system will install a data broker to manage the transfer of data and ensure that DHS entities receiving data will receive only formatted records that are authorized for use.

In the second implementation phase, the service will be fitted with another data broker to manage encounter information regarding people on the watchlist.

Currently, when there is an encounter with a potential match on the watchlist, a report of that is sent to the TSD via a system-generated message or manually, by secure phone or fax. The DHS Watchlist Service Encounters Data Broker will allow all of these transmissions to be sent in a standardized way, as well as securely recorded for future use, according to the DHS.

A later implementation phase will add a persistent data store of the TSD within a DHS server so people can perform queries on the information. A combination of off-the-shelf products and custom components will be used to build the Watchlist Service, according to the DHS.

The DHS Screening Coordination Office will oversee the business end of creating the system, while the DHS Transportation Security Agency and Customs and Border Protection will handle the technical side. The DHS Office of the CIO also will aid with initial requirements and project management.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7392
Published: 2014-07-22
Gitlist allows remote attackers to execute arbitrary commands via shell metacharacters in a file name to Source/.

CVE-2014-2385
Published: 2014-07-22
Multiple cross-site scripting (XSS) vulnerabilities in the web UI in Sophos Anti-Virus for Linux before 9.6.1 allow local users to inject arbitrary web script or HTML via the (1) newListList:ExcludeFileOnExpression, (2) newListList:ExcludeFilesystems, or (3) newListList:ExcludeMountPaths parameter t...

CVE-2014-3518
Published: 2014-07-22
jmx-remoting.sar in JBoss Remoting, as used in Red Hat JBoss Enterprise Application Platform (JEAP) 5.2.0, Red Hat JBoss BRMS 5.3.1, Red Hat JBoss Portal Platform 5.2.2, and Red Hat JBoss SOA Platform 5.3.1, does not properly implement the JSR 160 specification, which allows remote attackers to exec...

CVE-2014-3530
Published: 2014-07-22
The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via...

CVE-2014-4326
Published: 2014-07-22
Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in (1) zabbix.rb or (2) nagios_nsca.rb in outputs/.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Where do information security startups come from? More important, how can I tell a good one from a flash in the pan? Learn how to separate ITSec wheat from chaff in this episode.