2016 ACLU Report On TI Program: “Trapped In a Black Box: The Growing Terrorism Watchlisting (Of TIs) in Everyday Policing” (and youtube)

Although the FBI is the reviewing agency for domestic terrorism nominations, it can also
be the source agency for both domestic and international terrorism nominations. Such
nominations begin when an FBI field office submits a nomination form to the Terrorist Review
and Examination Unit (TREX), the FBI headquarters unit that processes watchlist nominations
resulting from open FBI investigations.6 TREX reviews these nominations and sends domestic
terrorism nominations directly to the TSC, while international terrorism nominations are
forwarded to the NCTC.7 The NCTC processes these nominations into its own database, the
Terrorist Identities Datamart Environment (TIDE), and then feeds the names to the TSC, which
enters them into the TSDB as well.8

4 O FFICE OF THE I NSPECTOR G EN ., U.S. D EP ’ T OF J USTICE, A UDIT REPORT N O . 14-16, A UDIT OF THE F EDERAL
BUREAU OF I NVESTIGATION ’ S MANAGEMENT OF T ERRORIST W ATCHLIST N OMINATIONS (2014), at 1, 3 [hereinafter
2014 OIG REPORT].
5 Id. Domestic and international terrorism are distinguished primarily by whether the activities take place within the
territorial jurisdiction of the United States. See Definitions of Terrorism in the U.S. Code, F ED . BUREAU OF
I NVESTIGATION , http://www.fbi.gov/about-us/investigate/terrorism/terrorism-definition (last visited Jan. 5, 2016).
6 2014 OIG REPORT, supra note 4, at 8.
7 Id. at 9.
8 Id. The TIDE database is prohibited from containing purely domestic terrorism information. Id.

Once a name has been entered into the TSDB, it is fed into other screening databases,9
such as the No Fly List (a list of individuals who are prevented from boarding a commercial
aircraft for travel into or out of the United States or over U.S. airspace) and Selectee List (a list
of individuals who are subjected to heightened screening at airports whenever they seek to board
an airplane); the TSA’s Secure Flight program (used to conduct pre-flight watchlist screening of
passengers); the State Department’s Consular Lookout and Support System (CLASS) (used to
screen visa and passport applications); Customs and Border Protection’s TECS Database, which
customs officers use to screen individuals at points of entry;10 and VGTOF/ KST, which is
accessible to law enforcement agencies across the United States through the National Crime
Information Center (NCIC).11 Information from the TSDB is also shared with more than a dozen
other countries.12

As discussed further below, the criteria for nominations to the TSDB and to
VGTOF/KST are vague, overbroad, and encompass innocent and First Amendment-protected
conduct.

II. NEW DATA

The ACLU’s FOIA litigation revealed the following information about VGTOF/KST File
from 2003 to 2008:

 The total number of records in VGTOF/KST increased drastically from 2003 to 2008,
undergoing a growth of nearly 2,000 percent. The total number of records continuously
increased in this period except for one brief decline in late 2006.

 The vast majority of records were related to suspected international terrorism and were
processed through the NCTC and the TSC.

 Military detainee entries and entries nominated by FBI legal attachés increased steadily
from mid-2003 through the end of 2008.

9 Id.
10 Id. at 85-86.
11 In August 2009, VGTOF was separated into the Gang File and the Known or Suspected Terrorist, or KST, file. Id.
at 85. NCIC is a nationwide information system that provides the law enforcement community with information on
various law enforcement data. Id. at 85 n.127.
12 O FFICE OF THE I NSPECTOR G EN., U.S. D EP ’ T OF H OMELAND SECURITY , N O. OIG-09-64, ROLE OF THE N O F LY AND
S ELECTEE LISTS IN S ECURING COMMERCIAL A VIATION (2009), at 16.

 Large fluctuations in the data suggest that there were problems with data management
and prompt review. Furthermore, there were more than 2,500 faulty records labeled
“Unable to Identify” from 2006 to 2007, most of which subsequently became identified
as “Unknown”—meaning that the government did not know if the individual was
suspected of domestic or international terrorism using its vague and over broad criteria.

Total VGTOF Records

The total number of records in the VGTOF database increased dramatically over the
relevant period (see Figure 2). The total increased from under 13,054 records in December 2003
to 272,198 records by December 2008, an approximately 2,000 percent growth over only a five-
year period. This number includes both regular and silent hit entries (described in Section V).
Even by the most conservative estimate, this means an addition of 259,144 new records to the
database in a period of five years—an average of 142 new records per day.

Figure 2. Total VGTOF Entries

In addition to the steady and high rate of increase, the total number of records was also
characterized by large fluctuations. In May 2005, the total spiked to more than 130,000, only to
decrease again to previous levels in the following month. This was likely the result of “VGTOF
Refresh,” a major clean-up initiative which deleted 7,264 records, modified and updated 113,000
records, and added 12,474 records that had been previously rejected from the VGTOF
database.13 It is unclear, however, how and why the number decreased again precipitously in the
next month, June 2005. 14

13 FED. BUREAU OF INVESTIGATIONS , FBI N OMINATIONS & VGTOF TRAINING (2008), No. NCIC-VGTOF-8345
[hereinafter FBI N OMINATIONS & VGTOF TRAINING ].
14 One change that occurred in June 2005 was that the TSDB was connected to the NCIC in near-real time. Prior to
this change, the TSC only added, but did not modify or delete, records into the VGTOF database. Id. It is possible

These fluctuations in the number of total records in VGTOF suggest flaws in the data
management. The addition or deletion of large numbers of records from the database indicates
either that records were not inputted promptly and thus dumped into the system in bulk at a later
date, or that a large number of records were not properly removed from VGTOF when they
should have been, resulting in their wholesale removal later. This indicates the likely presence of
false positives—individuals who should have been removed but whose records remained in the
system—at any given time over this period.

Suspected Gang-Related versus Suspected Terrorism-Related Entries

From late 2003 to early 2004, the number of suspected terrorism entries underwent a
dramatic increase, from over 9,000 to more than 50,000 (see Figure 3). This is especially notable
when compared to the number of suspected gang entries, which remained steady over this period.
The growth in suspected terrorism entries from December 2003 on is likely because of the
establishment of the TSC, which began operating that month.15 Although VGTOF contained both
suspected gang and terrorism information, these data show that the dramatic growth in the size of
the database in the last decade is due to the expansion of the suspected terrorism records, which
quickly outstripped the suspected gang-related records.

Figure 3. Suspected Gang-Related versus Suspected Terrorism Entries that this real-near-time connectivity
allowed for some records to be deleted, but a roughly 130,000 reduction seems too high to be explained by this change.

O FFICE OF THE I NSPECTOR G EN., U.S. D EP ’ T OF J USTICE, A UDIT REPORT N O. 05-27, REVIEW OF THE TERRORIST
S CREENING C ENTER (2005), at 39 [hereinafter 2005 OIG REPORT]. The first data point for TSC-entered data in the
FOIA documents also appeared in December 2003.

Jun‐03 Jul‐03 Aug‐03 Sep‐03 Oct‐03 Nov‐03 Dec‐03 Jan‐04 Feb‐04 Mar‐04 Apr‐04 May‐04 Jun‐04

Suspected Gang‐Related Suspected Terrorism

Domestic versus International Entries

The number of international entries vastly outstripped the number of domestic entries.
Domestic entries hovered steadily around 500 or 600 entries for the duration of the period from
November 2004 to November 2008 (see Figure 4). Fluctuations in the total number of entries in
the database seems to be attributable to variations in the number of international entries, as they
follow the same pattern.

Figure 4. Domestic versus International Entries

Nominating or Processing Entities

The FBI’s records categorize entries as either TSC records or FBI Field Office records.

The precise definitions for these categorizations are unclear, but the vast majority of VGTOF’s
records were categorized as TSC records, while only a small number were categorized as FBI
Field Office records. Thus, the growth of the total number of records in VGTOF closely tracked
the growth of records from the TSC (see Figure 5).

The number of records categorized as having come from FBI Field Offices grew from
below 2,000 in February 2003 to over 12,000 by August 2006, a six-fold increase (see Figure 6).
This number underwent a dramatic change in August 2004, when it plummeted to double digits,
where it stayed until it shot back up to approximately the previous levels in February 2006. The
drastic reduction in August 2004 is the result of a change which rescinded FBI Field Offices’
ability to effect changes directly in the VGTOF database for suspected terrorism records.16 After
that date, only TREX and TSC, along with limited entities within the FBI’s Criminal Justice
16 FBI N OMINATIONS & VGTOF TRAINING , No. NCIC-VGTOF-8345, supra note 13.

Domestic International

Information Services Division (CJIS), had the ability to add, modify, and delete terrorism records
in the VGTOF database.17 It is unclear what prompted the dramatic increase in February 2006.

Information obtained from the ACLU’s FOIA litigation, along with publically available
documents and reviews from the U.S. Department of Justice’s Office of the Inspector General,

Unknown If Domestic or International Unable to identify Total

yielded the following conclusions on how the nomination and removal processes have developed
over time.

 The procedure for nominating names for VGTOF/KST has become more centralized over
time.

 In the meantime, the criteria for inclusion in the watchlist have become less concrete and
less specific.

 What has been revealed regarding current practices suggests haphazard applications of
vague standards to a variety of entries without regular oversight. During the initial
nomination and review process, it is likely that some entries that did not meet the
threshold nomination criteria were nevertheless entered into the watchlist.

A. Historical Developments

VGTOF – Early Process (1990s-2004)

The VGTOF database became operational as a file within the NCIC in 1995. 24 Prior to
the September 11 attacks, the database had never been used for counterterrorism purposes,25
although it contained nomination procedures for both suspected gang members and terrorism
suspects alike. Documents governing the use of the file during that period suggest that any
originating agency, be it a local law enforcement agency or an FBI office, could make either type
of entry.26 Under this system, the originating officer could enter two types of information into
VGTOF: group entries (entries of suspected gang or terrorist organizations) and individual
member entries (which would be tied to a gang or terrorist organization).27

The NCIC Operating Manual for this period defined terrorist organizations as
organizations that use force or violence in patterns of conduct with an aim to “intimidate or
coerce a government, civilian population, or segment thereof, in furtherance of political or social
objectives.”28 The Manual also specified that terrorist group entries should be “the smallest

24 Communication from Assistant Dir., FBI Criminal Investigative Div., to Special Agents in Charge and Legal
Attachés (Mar. 25, 1996), No. NCIC-VGTOF-11653.
25 Statement of Michael Kirkpatrick, Assistant Dir., FBI CJIS Div., CJIS Advisory Policy Board Minutes (June 5-6,
2002), No. NCIC-VGTOF-4269.
26 NCIC 2000 Violent Gang and Terrorist Organization File (VGTOF) (Dec. 1999), at 3, 9. It does not appear there
were any restrictions for what kinds of originating agencies can input entries, as long as the entry contains all the
mandatory fields (header, message key, ORI identifier, group name, subgroup name, and point of contact). Many
additional fields are “free text” and can include miscellaneous information. Id. at 4-5.
27 Id. at 1.
28 NCIC 2000 Operating Manual: Violent Gang and Terrorist Organization (VGTOF) File (Dec. 1999) ¶ 1.2.

identifiable segment, cell, or division which has been documented to be engaged or preparing to
engage in qualifying terrorist activity.”29

For individual member entries, the NCIC Manual provided the same criteria for
suspected terrorists and suspected gang members: the individual either must have admitted to
membership at the time of arrest or incarceration, or must satisfy two items on a composite list of
indicators, including identification by a third party (either proven reliable or corroborated),
observation by the originating law enforcement officer that the individual frequents the area near
or associates with a group or affects the attire or markings of the group, or admission after arrest
or incarceration that the individual is a member.30 The individual entries could also contain
caution and medical codes such as “Armed and Dangerous,” “Violent Tendencies,” and “Heart
Condition.”31

Until at least July 2003, it appears that local law enforcement may have been able to enter
information into VGTOF; the FOIA production revealed records labeled “Local Law
Enforcement” entries, although it appears that they may only have been able to enter gang-
related records, not terrorism-related records.32 Even after a policy change requiring all
information to be input by the TSC, state and local law enforcement officers could submit names
for nomination to local FBI Joint Terrorism Task Force centers, which then transmitted the
nominations to FBI Headquarters for review.33 Because records could remain in the database for
years, some of the locally nominated names may have remained in the database long after the
FBI phased out local officials’ nominating capabilities.34

Centralization within FBI Headquarters (2004-2008)

The VGTOF nomination procedure became more centralized in August 2004, when the
FBI eliminated field offices’ ability to add names to the VGTOF database directly.35 Instead,

29 Id. ¶ 1.3.
30 Id. ¶ 9.2.
31 Id. ¶ 10.6.
It is not clear if and how these supplemental identifiers are regulated; the manual only lists logistical
procedures for entry, not substantive criteria.
32 See VGTOF Totals as of 7/31/2003, No. NCIC-VGTOF-8212. These “Local Law Enforcement Entries” were
separate from, and appeared alongside, “FBI Field Office Entries.” However, the data contained disclaimers stating,

“Local law enforcement has not entered any Terrorist subject records—CTAs have entered some test records and
this count also includes records entered by Legats.” Id. In July 2003, 107 terrorism-related records are labeled
“Local Law Enforcement Entries,” the only month for which a positive number appears (the number in June 2003
was zero and the category ceased appearing after July 2003). Id.

33 Communication from CJIS Programs Dev. Section/Glob. Initiatives Unit to CJIS and Counterterrorism, Re:
National Crime Information Center Technical and Operational Update (Nov. 7, 2005), No. NCIC-VGTOF-6886.
34 For example, at the time of the policy change rescinding FBI local office entry powers, the record owners
conducted “no type of qualify [sic] review.” FBI N OMINATIONS & VGTOF TRAINING , No. NCIC-VGTOF-8345,
supra note 13.
35 Id.

only TREX, the TSC, and some entities within the FBI’s Criminal Justice Information Services
(CJIS) Division could make entries in VGTOF. 36 FBI field offices and legal attachés could
submit names to the TREX office, but they could not create new records or alter existing records
directly. For domestic terrorism entries, TREX sent the nominations it received to the TSC
directly for inclusion in the TSDB; for international entries, TREX entered the information into
VGTOF directly and then submitted the nomination to the NCTC, which entered it into TIDE,
which in turn fed the record into the TSDB. 37 Once included in the TSDB, domestic entries were
electronically distributed to downstream screening databases, including VGTOF. 38 Because
international entries were already entered into VGTOF by TREX, the TSC did not export the
record it received from TIDE to VGTOF. 39

FBI Headquarters’ newly centralized control over the nomination process also marked
the end of concrete, specific criteria for nominations. In the NCIC 2000 Operating Manual, the
government’s criteria for nominations included a specific list of behaviors it identified as
indicating terrorist association or activity.40 By early 2005, the list had expanded to encompass
vague, broad criteria such as “Terrorist acting alone” and “Subject is suspected or believed to be
associated with terrorism or a terrorist organization.”41 By late 2005, the group entry criteria
were deleted entirely from the operating procedures for VGTOF terrorism entries.42 By mid-
2006, individual entry criteria too appeared to fall away, giving way to a generalized standard:
nominees to the TSDB needed only to “demonstrate a nexus to terrorism, or [be the subject of]

36 Id.
37 2007 OIG REPORT, supra note 19, at 18.
38 Id.
39 Id.
40 NCIC 2000 Operating Manual: Violent Gang and Terrorist Organization (VGTOF) File (Dec. 1999) ¶ 9.2.
41 Operator’s Lesson Plan: Violent Gang and Terrorist Organization File (Feb. 2005), at 209. The new criteria
required two of the following:
a. Admitted membership in a gang or terrorist organization at the time of his/her arrest or
incarceration;
b. Has been identified by an individual of proven reliability as a group member;
c. Has been identified by an individual of unknown reliability as a group member and that
information has been corroborated in significant respects;
d. Has been observed by members of the entering agency to frequent a known group’s area,
associate with known group members and/or affect that group’s style of dress, tattoos, hand
signals, or symbols;
e. Has been arrested on more than one occasion with known group members for offenses
consistent with group activity;
f. Has admitted membership in the identified group at any time other than arrest or incarceration.
g. Terrorist acting alone.
h. Subject is suspected or believed to be associated with terrorism or a terrorist organization.
Id. Note that (g) and (h) were new and expanded the breadth of the criteria.
42 Communication from CJIS Programs Dev. Section/Glob. Initiatives Unit to CJIS and Counterterrorism, Re:
National Crime Information Center Technical and Operational Update (Nov. 7, 2005), No. NCIC-VGTOF-6886 to
NCIC-VGTOF-6890.

an active investigation to ascertain whether a nexus to terrorism exists.”43 Some handling codes
required “reasonable, articulable suspicion of criminal domestic or international terrorism
activity,” but others did not.44 This ambiguity, and the low threshold for nomination, exacerbate
concerns that the criteria led to the inclusion of entries that should not have been included.
TSC Control, Dissolution of VGTOF, and Creation of the KST (2008-2009)

The move towards a centralized nominations process with broad entry criteria continued.
Although the TSC had been formally designated as the central watchlisting agency in 2003,45
some significant gaps remained in the process prior to 2008. For example, TREX had an
informal practice of entering international terrorist names directly into VGTOF and then
forwarding them to NCTC, thus circumventing NCTC review.46 In September 2007, the Office
of the Inspector General recommended that TREX stop directly creating VGTOF records for
international terrorist nominations before sending them to the NCTC; 47 TREX ultimately
implemented this recommendation in May 2008.48

By August 2009, the FBI had split VGTOF into two new, standalone files: the Gang file
and the Known or Suspected Terrorist (KST) file, which both remain accessible through NCIC. 49
The KST file followed the same nomination process as had terrorism-related entries in VGTOF:
the TSC is the central body with final decision-making power over whether to include
nomination subjects into the TSDB, and the TSDB then populates the KST and other
downstream databases.50

B. Current Nomination Procedures and Criteria

As outlined in Section I, the current process for source agencies to nominate new entries
is as follows:

43 S TANDARD O PERATING P ROCEDURES : N OMINATION P ROCESS , TERRORIST S CREENING C ENTER N OMINATIONS AND
D ATA I NTEGRITY U NIT (Aug. 2, 2006), No. NCIC-VGTOF-8373.
44 Id., No. NCIC-VGTOF-8374.
45 2014 OIG REPORT, supra note 4, at 18 n.44.
46 2007 OIG REPORT, supra note 19, at 18-19.
47 Id.
48 Communication from Nat’l Sec. Branch to Counterterrorism, Re: Priority FBI IT Nominations Terrorist Screening
Center (May 5, 2008), No. NCIC-VGTOF-10894.
49 NCIC 2000 Operating Manual Issued in 1999 with Technical and Operational Updates (TOU) Incorporated –
Known or Appropriately Suspected Terrorists (KST) File (Aug. 2, 2009), No. NCIC-VGTOF-707 [hereinafter 2009
NCIC Operating Manual]. KST was fully implemented much later, in June 2011. 2014 OIG REPORT, supra note 4,
at 36.
50 2014 OIG REPORT, supra note 4, at 8.

1) The source agency submits names to either the FBI (domestic terrorism) or the NCTC
(international terrorism).51
2) The FBI or the NCTC reviews the nominations.52
3) The FBI or the NCTC submits approved names to the TSC for inclusion in the TSDB. 53
4) The TSC exports the TSDB entries to downstream databases, including KST (formerly
VGTOF).54

For entries that originate with an FBI field office, the nomination process is as follows:

1) The FBI field office submits domestic and international nominations to TREX. 55
2) TREX “Technical Information Specialists” review the nominations.56
3) TREX sends domestic nominations to the TSC and international nominations to the
NCTC. 57
4) The NCTC enters the approved names into the TIDE database, which is then exported to
the TSC. 58
5) The TSC conducts a final review and imports all approved entries to the TSDB. 59
6) The TSDB entries then flow to downstream databases, including KST (formerly
VGTOF).60

Nominations for inclusion in the TSDB (and therefore in KST) must meet a “reasonable
suspicion” standard based on “articulable intelligence or information which, based on the totality
of the facts . . . reasonably warrants a determination that the subject is known or is suspected to
be (or has been) knowingly engaged in conduct constituting, in preparation for, in aid of, or
related to, terrorism or terrorist activities.”61 However, nominating agencies are instructed to
establish their own processes for ensuring the quality and accuracy of the nominations, and it is
not clear how consistent or meaningful those agencies’ quality control is.62 No entity ensures that

51 Id. at 1, 3.
52 Id. at 3.
53 Id.
54 Id. at 9.
55 Id. at 8.
56 Id.
57 Id. at 9.
58 Id.
59 Id.
60 Id.
61 Id. at 7. The government’s leaked 2013 Watchlisting Guidance defined terrorism and terrorist activities as “violent

acts or acts dangerous to life, property, or infrastructure” in violation of U.S. law and appear to be intended to
“intimidate or coerce a civilian population; to influence the policy of a government by intimidation or coercion; or,
to affect the conduct of a government by mass destruction, assassination, kidnapping, and hostage-taking.”
W ATCHLISTING G UIDANCE (Mar. 2013) ¶ 1.14 [hereinafter 2013 W ATCHLISTING G UIDANCE].
62 2013 W ATCHLISTING G UIDANCE ¶¶ 1.43, 1.45. The Guidance states that “[e]ach NOMINATING AGENCY
should implement processes designed to ensure that nominations are free from errors, that recalled or revised
information is reviewed regularly, and that necessary corrections to nominations based on those revisions/retractions

the “reasonable suspicion” standard is consistently applied by nominating officers or analysts. As
explained in greater detail below, the reasonable suspicion standard is deeply problematic for
numerous reasons, including that it permits the use of uncorroborated or questionably reliable
information, necessarily entails a significant risk of error, and makes it likely that individuals
will be nominated for, and included in, the TSDB and KST based on conduct that is innocent or
protected under the First Amendment.

It is not clear what, if any, guidelines govern the nominations of source agencies other
than the FBI. According to a 2014 OIG report, however, three categories of individuals can be
nominated by the FBI for inclusion in the KST File: 1) subjects of full investigations, 2) subjects
of preliminary investigations, and 3) non-investigative subjects. 63

Full investigations are authorized when there are “specific and articulable facts giving
reason to believe that a criminal activity or a threat to national security may exist.”64 Subjects of
full investigations are presumed to meet the “reasonable suspicion” standard because of the
FBI’s internal criteria for expanding a preliminary investigation to a full investigation. 65

Preliminary investigations are authorized when “there exists any allegation or
information indicative of possible criminal activity or threats to the national security.”66 Thus,
the FBI initiates a preliminary investigation when it does not have enough evidence to meet the
standard for a full investigation, and yet it may nevertheless nominate individuals under
preliminary investigation for inclusion in the watchlist. Indeed, subjects of preliminary
investigations may not meet the reasonable suspicion standard for watchlisting.67 As with the
watchlisting criteria, the FBI’s guidelines for preliminary investigations are vague and
overbroad, permitting intrusive investigations of people for lengthy periods even when the
government does not have facts to meet its own low “reasonable indication” standard for
showing that anyone has violated the law.

A third type of nomination, the “non-investigative subject nomination,” allows for the
nomination of individuals who are not the subjects of an open FBI investigation. Although the
specific criteria for who may be nominated as non-investigative subjects are unclear,68 these
are made. NOMINATING AGENCIES should, to the extent possible given the nature of the reporting, verify the
accuracy and reliability of the information included in nominations.” Id. at ¶ 1.43.
63 2014 OIG REPORT, supra note 4, at 33. FBI field offices generally sort terrorism cases into three categories for
action: assessments, preliminary investigations, and full investigations. “Assessment” subjects generally are not
forwarded for nomination to terrorist watchlists. Id. at 7-8.

64 Id. at 7.
65 Id.
66 Id.
67 Id.
68 There are three criteria, but they are redacted in the 2004 OIG Report. Id. at 66.
19

nominations could include names that the FBI receives from foreign governments through legal
attachés or from other agencies, such as the Drug Enforcement Administration (DEA).69 One
document from the FOIA production describes non-investigative subject nominations by FBI
Headquarters as “individuals [who] are ‘on the radar’ but are not currently under
investigation.” 70 A 2009 OIG report found that the review process for such nominations is “weak
or nonexistent.”71 Similarly, a 2014 OIG report found that the FBI could not “readily provide an
accurate accounting of the actions that were taken regarding the watchlisting of non-investigative
subjects.”72 As the foregoing analysis makes clear, the FBI’s watchlisting practices for non-
investigative subjects are ripe for abuse and permit the inclusion of names submitted by foreign
governments (which may have their own reasons for seeking to watchlist dissidents and
opponents) under standards that fall short of the FBI’s already low threshold for nomination.

The FBI’s use of the “reasonable suspicion” standard is problematic for numerous
reasons:

 First, reasonable suspicion, as used here, is a very low standard that can be met with
uncorroborated or even questionably reliable information and, on its face, does not
require that it be more probable than not that an individual is involved in terrorism-
related activities. Such a low threshold for nomination injects a significant risk of error
into the nomination process and makes it likely that individuals will be nominated for,
and included in, the TSDB and KST based on conduct that is innocent or protected under
the First Amendment. The 2013 Watchlisting Guidance also includes numerous
exceptions to the reasonable suspicion requirement that make it significantly easier to
watchlist non-citizens, leaving them particularly vulnerable to watchlisting based on
inaccurate, incomplete, or spurious information.73

 Second, nominations do not always appear to undergo review to determine whether they
actually meet the “reasonable suspicion” standard. This is especially alarming in light of
the fact that FBI field agents do not always understand the downstream effects of
nominating an individual for entry into the TSDB. 74

 Third, the nominations of preliminary investigation subjects and non-investigatory
subjects raise questions about how individuals who do not meet the criteria for full

69 2014 OIG REPORT, supra note 4, at 66.
70 FBI N OMINATIONS & VGTOF TRAINING , No. NCIC-VGTOF-8346, supra note 13.
71 2009 OIG REPORT, supra note 20, at v.
72 2014 OIG REPORT, supra note 4, at 70.
73 2013 W ATCHLISTING G UIDANCE ¶ 1.47.
74 2009 OIG REPORT, supra note 20, at xv (“[M]any agents did not realize that the watchlist feeds several
downstream databases used by other segments of the law enforcement community.”).

investigation—that is, “specific articulable facts giving reason to believe” a threat might
exist75 —could nevertheless satisfy the definition of “reasonable suspicion” required for
entry into the TSDB, which is “articulable intelligence” and an “objective factual
basis.”76

 Fourth, the OIG reports suggest that there has been no systematic review for whether the
nominating field office correctly determined that the reasonable suspicion standard had
been met.77 In 2007, the OIG noted that the TSC had been attempting a record-by-record
audit review of watchlist entries but that the TSC was unlikely to finish the process
before 2012, and it is not clear if the review was ever completed.78 In addition, it is not
clear how meaningful the review process was. While the TSC’s process in March 2006
included reviewing incoming records for a “nexus” to terrorism, 79 review of existing
records appeared limited to special targeted reviews of the No Fly List and other specific
categories, as well as situations where an external encounter with a subject indicated that
information would need to be added or changed.80 These are not systematic reviews of
historical records for substantive sufficiency to meet the reasonable suspicion standard.

 Fifth, there are few external incentives for officials within the TSC and field offices to
exercise caution when entering subjects according to reasonable suspicion standards.
Because the information underlying watchlisting entries is secret, and because there is no
judicial review of watchlisting decisions,81 officials do not have the same incentives as
police officers (who face the suppression of evidence if their determination of reasonable
suspicion or probable cause is incorrect) to adhere carefully to applicable evidentiary
standards. In addition, those with decision-making authority over watchlist nominations
may not fully understand the ramifications of placement on a watchlist.82

75 2014 OIG REPORT, supra note 4, at 7.
76 2013 W ATCHLISTING G UIDANCE ¶ 3.4.
77 The 2013 Watchlisting Guidance suggests that TSC reviews nominations for whether they meet watchlisting
standards. Id. ¶ 1.46. However, it also states that a nomination will be accepted if it “contains the minimum
substantive derogatory criteria and the minimum identifying information.” Id. ¶ 1.56.2.1. It is not clear whether this
is systematic review of whether nominations meet the reasonable suspicion standard, or simply a review to make
sure the entry is complete.
78 2007 OIG REPORT, supra note 19, at xvi.
79 Id. at xii, 28-29.
80 Id. at 30.
81 The operating manual for VGTOF specifically states, “Because VGTOF information is based, in part, on
investigative information not previously subject to independent judicial review, strict adherence to policy on the
security, use, and dissemination of VGTOF information is necessary.” NCIC 2000 Operating Manual: Violent Gang
and Terrorist Organization (VGTOF) File (Dec. 1999), at 1.
82 2009 OIG REPORT, supra note 20, at xv (“[M]any agents did not realize that the watchlist feeds several
downstream databases used by other segments of the law enforcement community.”).

 Sixth and finally, although the 2013 Watchlisting Guidance states that “First Amendment
protected activity alone shall not be the basis for nominating an individual for inclusion
on the Terrorist Watchlist,”83 it is clear that First Amendment-protected activity may
constitute part of the basis for inclusion in the TSDB. Indeed, under the Guidance, a
single Facebook post, Tweet, or anonymous letter may provide the “reasonable
suspicion” necessary to watchlist an individual.84

Given these deficiencies in the nomination process and standard, it is perhaps
unsurprising that even someone who has been exonerated after investigation or even prosecution
can nevertheless remain on the watchlist. An FBI document from 2009 explicitly states that
individuals who have been acquitted of terrorism-related crimes, and those whose charges have
been dismissed, can nevertheless remain on the watchlist provided that reasonable suspicion
remains.85 Even when an FBI investigation has closed and the field office is theoretically
required to submit a request to remove the individual from the watchlist, the FBI case agent can
petition to keep that individual on the watchlist by nominating him or her as a non-investigative
subject.86 In addition, individuals exonerated by an FBI investigation can remain in TIDE based
on a nominating agency’s independent determination that the individual is a known or suspected
terrorist (again according to vague and overbroad criteria) or under an exception to the
reasonable suspicion standard.87

IV. ENCOUNTERS WITH LOCAL LAW ENFORCEMENT

The documents obtained through FOIA litigation, along with other publicly available
documents, show the following about law enforcement officers’ “encounters”88 with watchlisted
individuals:

 When local law enforcement encountered an individual on VGTOF/KST, such as during
a routine traffic stop, and the officer runs a search of the individual’s name in the NCIC
83 2013 W ATCHLISTING G UIDANCE ¶ 1.19, 3.9. For example, at ¶ 3.13.8.1, the Guidance states: “A sympathizer or
supporter of terrorism should be nominated if the support is operational in nature. If support is merely ideological,
the individual should not be nominated.”

84 Id. ¶ 3.6 (“Single source information, including but not limited to ‘walk-in’, ‘write-in’, or postings on social media
sites, however, should not automatically be discounted merely because of the manner in which it was received.”).
85 Communications from Counterterrorism to All Field Offices and All Legats, Re: Counterterrorism Program
Guidance/Watchlisting/Administrative and Operational Guidance (Dec. 7, 2009),
http://epic.org/privacy/airtravel/EPIC_DOJ_FOIA_NoFlyList_09_13_11_CT_Guidance2.pdf, ¶ 1.7.
86 Id. ¶ 1.8.
87 2013 W ATCHLISTING G UIDANCE 28 n.34.
88 “Encounter” means “local, state, tribal, or federal law enforcement and homeland security screeners have come
across a known or suspected terrorist during normal job duties (e.g., traffic stops, checking of airplane manifests, or
evaluating an application for a U.S. passport or visa).” 2009 OIG REPORT, supra note 20, at 2 n.42.

identified and tracked the whereabouts of its subjects, and very rarely has resulted in arrests or
detention.

For the vast majority of subjects, which fall under Handling Code 3, VGTOF/KST has
acted as an information-collecting tool for the TSC. In a 2006 meeting of the NCIC Advisory
Policy Board, the director of the TSC stated that VGTOF’s purpose is to ensure that “for the very
first time, state and local officers had some ability to know that someone they pulled over could
be on the watch list,”95 prompting the local officer who encountered someone on the watchlist to
call the TSC and provide the TSC with additional information about the subject. The TSC’s
practice has been to record such information using a tool called the “Encounter Management
Application,” which was implemented in July 2004 and contains records of all encounters since
the TSC became operational.96 Information gathered from the encounter is analyzed and “used to
enhance existing watchlist records,” which the intelligence community uses to assess threats and
conduct investigations.97

When the TSC receives a call from an encountering official based on a VGTOF/KST
hit,98 it can look into the nominating agency’s system to determine if the individual apprehended
is indeed the watchlisted suspect, and if so, if action should be taken. For domestic encounters,
the FBI “must be consulted prior to taking any action based on ENCOUNTERS with a person
who is a POSITIVE MATCH with KNOWN or SUSPECTED TERRORIST.” 99 The 2013
Watchlist Guidance adds that “[e]specially sensitive ENCOUNTERS often require coordination
and situational updates with the White House, Northern Command (NORTHCOM), and FBI’s
Counterterrorism-Watch.”100 In the vast majority of instances, the authorities have taken no
action and have released the individual without telling him that he is on a watchlist.101

For local officers, the discovery that a traffic violator is on a terrorist watchlist has
sometimes led to actions that are not prescribed by the handling code messages. For example, the
TSC acknowledged that in the early days of the implementation, some encountering officers had
95 Statement of Donna Bucella, Dir., Terrorist Screening Ctr., CJIS Advisory Policy Board Minutes (June 22-23,
2006), No. NCIC-VGTOF-5411. As discussed in Section V, this is not the case for silent hit entries, for which
VGTOF/KST information is hidden from the view of state and local officers.

96 2007 OIG REPORT, supra note 19, at 6.
97 2014 OIG REPORT, supra note 4, at 5; 2013 W ATCHLISTING G UIDANCE ¶ 5.14.
98 It is likely that, when NCIC is queried and there is a VGTOF/KST hit, that the TSC first received an electronic
notification that there has been a hit, and then (if the encountering official follows the Handling Code instructions) a
phone call from the encountering officer. The 2013 Watchlist Guidance states that “[n]ame-based transaction queries
by law enforcement personnel (e.g., traffic stops) made to the FBI’s National Crime Information Center . . . that
match a name in the KSTF . . . are routed electronically to TSC for confirmation and subsequent processing as an
ENCOUNTER.” 2013 W ATCHLISTING G UIDANCE ¶ 5.8.1.
99 2013 W ATCHLISTING G UIDANCE ¶ 5.18.
100 Id. ¶ 5.13.1.
101 2007 OIG REPORT, supra note 19, at 9.

been “a little aggressive and . . . pulled the person out of the car” when they saw the NCIC hit
telling them to contact the TSC. 102

B. Description of Handling Codes

Handling Code 1 applies to individuals with outstanding arrest warrants in the NCIC
Wanted Persons File.103 As of 2009, Handling Code 1 read as follows:

***LAW ENFORCEMENT SENSITIVE INFORMATION***
WARNING – APPROACH WITH CAUTION.
THIS INDIVIDUAL IS ASSOCIATED WITH TERRORISM AND IS THE SUBJECT OF AN
ARREST WARRANT, ALTHOUGH THE WARRANT MAY NOT BE RETRIEVABLE VIA
THE SEARCHED IDENTIFIERS. IF AN ARREST WARRANT FOR THE INDIVIDUAL IS
RETURNED IN YOUR SEARCH OF NCIC, DETAIN THE INDIVIDUAL PURSUANT TO
YOUR DEPARTMENT’S PROCEDURES FOR HANDLING AN OUTSTANDING
WARRANT, AND IMMEDIATELY CONTACT THE TERRORIST SCREENING CENTER AT
(866) XXX-XXXX FOR ADDITIONAL DIRECTION.

IF AN ARREST WARRANT FOR THE INDIVIDUAL IS NOT RETURNED, USE CAUTION
AND IMMEDIATELY CONTACT THE TSC AT (866) XXX-XXXX FOR ADDITIONAL
DIRECTION WITHOUT OTHERWISE EXTENDING THE SCOPE OR DURATION OF THE
ENCOUNTER. IF YOU ARE A BORDER PATROL OFFICER IMMEDIATELY CALL THE
NTC.

UNAUTHORIZED DISCLOSURE OF TERRORIST WATCHLIST INFORMATION IS
PROHIBITED. DO NOT ADVISE THIS INDIVIDUAL THAT THEY MAY BE ON A
TERRORIST WATCHLIST. INFORMATION THAT THIS INDIVIDUAL MAY BE ON A
TERRORIST WATCHLIST IS PROPERTY OF THE TSC AND IS A FEDERAL RECORD
PROVIDED TO YOUR AGENCY THAT MAY NOT BE DISSEMINATED OR USED IN ANY
PROCEEDING WITHOUT THE ADVANCE AUTHORIZATION OF THE TSC.
***LAW ENFORCEMENT SENSITIVE INFORMATION***104

Handling Code 2 appears to pertain mainly to watchlisted individuals who are subject to
current or future DHS detainers. The future detainers apply to those who would be given

102 Statement of Donna Bucella, Dir., Terrorist Screening Ctr., CJIS Advisory Policy Board Minutes (June 22-23,
2006), No. NCIC-VGTOF-5411.
103 Communications from Counterterrorism to All Field Offices and All Legats, Re: Counterterrorism Program
Guidance/Watchlisting/Administrative and Operational Guidance (Dec. 7, 2009),
http://epic.org/privacy/airtravel/EPIC_DOJ_FOIA_NoFlyList_09_13_11_CT_Guidance2.pdf, ¶ 1.2.1.1.
104 2009 NCIC Operating Manual, supra note 49, No. NCIC-VGTOF-708.

detainers if they encounter law enforcement.105 People with sealed federal indictments can also
be subject to Handling Code 2.106 In addition, documents from 2008 indicate that Handling Code
2 could be used for entries made under “exigent circumstances which require immediate entry of
the record.”107 The full text of Handling Code 2 is as follows:

***LAW ENFORCEMENT SENSITIVE INFORMATION***

WARNING – APPROACH WITH CAUTION.
THIS INDIVIDUAL IS OF INVESTIGATIVE INTEREST TO LAW ENFORCEMENT REGARDING
ASSOCIATION WITH TERRORISM AND THERE MAY BE A DETAINER AVAILABLE FROM THE
DEPARTMENT OF HOMELAND SECURITY FOR THIS INDIVIDUAL.
IMMEDIATELY CONTACT THE TERRORIST SCREENING CENTER (TSC) AT (866) XXX-XXXX
OR, IF YOU ARE A BORDER PATROL OFFICER, IMMEDIATELY CALL THE NTC TO
ASCERTAIN IF A DETAINER IS AVAILABLE FOR THE INDIVIDUAL AND TO OBTAIN
ADDITIONAL DIRECTION. PLEASE QUESTION THIS INDIVIDUAL TO ASSIST THE TSC IN
DETERMINING WHETHER THE INDIVIDUAL ENCOUNTERED IS THE SUBJECT OF A
DETAINER WITHOUT OTHERWISE EXTENDING THE SCOPE OR DURATION OF THE
ENCOUNTER.

UNAUTHORIZED DISCLOSURE OF TERRORIST WATCHLIST INFORMATION IS PROHIBITED.
DO NOT ADVISE THIS INDIVIDUAL THAT THEY MAY BE ON A TERRORIST WATCHLIST.
INFORMATION THAT THIS INDIVIDUAL MAY BE ON A TERRORIST WATCHLIST IS
PROPERTY OF THE TSC AND IS A FEDERAL RECORD PROVIDED TO YOUR AGENCY THAT
MAY NOT BE DISSEMINATED OR USED IN ANY PROCEEDING WITHOUT THE ADVANCE
AUTHORIZATION OF THE TSC.
***LAW ENFORCEMENT SENSITIVE INFORMATION***108

As the above language indicates, the querying officer is instructed to “question this individual”
in order to help the NTC to determine whether this person is subject to a detainer, but the message
provides no guidance on the questioning or the kind of information that would assist in such a
determination. It also appears doubtful that officers could question an individual “without otherwise
extending the scope or duration of the encounter,” since presumably an encounter with an individual not
listed in VGTOF/KST would not involve additional questioning or awaiting a reply from the TSC or the
NTC. Thus, encounters with individuals subject to Handling Code 2 will likely be longer and more

105 Communications from Counterterrorism to All Field Offices and All Legats, Re: Counterterrorism Program
Guidance/Watchlisting/Administrative and Operational Guidance (Dec. 7, 2009),
http://epic.org/privacy/airtravel/EPIC_DOJ_FOIA_NoFlyList_09_13_11_CT_Guidance2.pdf, ¶ 1.2.1.1.
106 Id. ¶ 1.6.
107 S TANDARD O PERATING P ROCEDURES : N OMINATION P ROCESS , TERRORIST S CREENING C ENTER N OMINATIONS AND
D ATA I NTEGRITY U NIT (Aug. 2, 2006), No. NCIC-VGTOF-8403.
108 2009 NCIC Operating Manual, supra note 49, No. NCIC-VGTOF-709.

intrusive than they otherwise would because of the ambiguity of the instructions and the directive to
officers to question the individuals further.

Finally, Handling Code 3 applies to all entries that are not categorized as Handling Code 1,
Handling Code 2, or silent hits.109 The text of the message for Handling Code 3 states:

***LAW ENFORCEMENT SENSITIVE INFORMATION***

DO NOT ADVISE THIS INDIVIDUAL THAT THEY MAY BE ON A TERRORIST WATCHLIST.
CONTACT THE TERORRIST SCREENING CENTER (TSC) AT (866) XXX-XXXX DURING THIS
ENCOUNTER. IF THIS WOULD EXTEND THE SCOPE OR DURATION OF THE ENCOUNTER
CONTACT THE TSC IMMEDIATELY THEREAFTER. IF YOU ARE A BORDER PATROL OFFICER
IMMEDIATELY CALL THE NTC.

ATTEMPT TO OBTAIN SUFFICIENT IDENTIFYING INFORMATION DURING THE ENCOUNTER,
WITHOUT OTHERWISE EXTENDING THE SCOPE OR DURATION OF THE ENCOUNTER, TO
ASSIST THE TSC IN DETERMINING WHETHER OR NOT THE NAME OR IDENTIFIER(S) YOU
QUERIED BELONGS TO AN INDIVIDUAL IDENTIFIED AS HAVING POSSIBLE TIES WITH
TERRORISM.

DO NOT DETAIN OR ARREST THIS INDIVIDUAL UNLESS THERE IS EVIDENCE OF A
VIOLATION OF FEDERAL, STATE OR LOCAL STATUTES.

UNAUTHORIZED DISCLOSURE IS PROHIBITED.

INFORMATION THAT THIS INDIVIDUAL MAY BE ON A TERRORIST WATCHLIST IS
PROPERTY OF THE TSC AND IS A FEDERAL RECORD PROVIDED TO YOUR AGENCY THAT
MAY NOT BE DISSEMINATED OR USED IN ANY PROCEEDING WITHOUT THE ADVANCE
AUTHORIZATION OF THE TSC.

WARNING – APPROACH WITH CAUTION.

***LAW ENFORCEMENT SENSITIVE INFORMATION***110

109 S TANDARD O PERATING P ROCEDURES : N OMINATION P ROCESS , TERRORIST S CREENING C ENTER N OMINATIONS AND
D ATA I NTEGRITY U NIT (Aug. 2, 2006), No. NCIC-VGTOF-8374. In the past, there was an additional Handling Code
4 containing less biographical information than Handling Code 3, requiring only a name and an “incomplete” date of
birth. Id.; see Communications from Counterterrorism to CJIS, Re: Terrorist Screening Database; Violent Gang and
Terrorist Organization File (VGTOF) – Handling Code 4 to 3 Conversion (June 14, 2004), No. NCIC-VGTOF-
10908; FBI Email, Subject: HC 4 to 3 Conversion (June 16, 2005), No. NCIC-VGTOF-10912 to NCIC-VGTOF-
10913. As of early 2004, Handling Code 3 was also the default code for the subjects of preliminary investigation.
Communications from Counterterrorism to All Field Offices, Re: Violent Gang and Terrorist Organization File
(VGTOF), No. NCIC-VGTOF-10871.
110 2009 NCIC Operating Manual, supra note 49, No. NCIC-VGTOF-709.

This message makes clear that the querying officer should attempt to identify, but not to
arrest or detain, the individual; it also states that the officer may contact the TSC after letting the
individual go to avoid extending the length of the encounter.

The three handling codes above were in operation as of 2009, but it is not clear if they
continue to contain the language and format as listed above. In the past, some handling code
messages contained a stronger warning against using the VGTOF hit as grounds for search and
seizure:

WARNING – STANDING ALONE, NCIC VIOLENT GANG AND TERRORIST ORGANIZATION
FILE INFORMATION DOES NOT FURNISH GROUNDS FOR THE SEARCH AND SEIZURE OF
ANY INDIVIDUAL, VEHICLE, OR DWELLING111

This warning appears to have been omitted from the most recent handling codes; the
2009 handling codes lack such specific instructions for law enforcement to ensure that they do
not use KST hits improperly to extend the scope of detentions.

The documents related to encounters with watchlisted people underscore that KST
functions primarily as a means of tracking and monitoring individuals about whom the FBI is
suspicious. It is not aimed only at a legitimate and targeted need to apprehend actual, known
terrorists, and it carries the significant risk that innocent people will be subjected to intense
scrutiny or lengthy, intrusive stops by law enforcement officers.

111 NCIC 2000 Operating Manual: Violent Gang and Terrorist Organization (VGTOF) File (Dec. 1999) ¶ 13.1. In
addition, for some time after September 11, 2001, another handling code that specifically identified individuals as a
potential suspects in the September 11 attacks:

WARNING – INDIVIDUAL MAY BE SOUGHT BY FBI FOR QUESTIONING RELATED TO
ATTACKS AGAINST WORLD TRADE CENTER AND PENTAGON. APPROACH WITH CAUTION.
HOWEVER, MAKE NO EFFORT TO ARREST INDIVIDUAL UNLESS THERE IS EVIDENCE OF A
VIOLATION OF FEDERAL, STATE, OR LOCAL STATUTE(S). RATHER, LAW ENFORCEMENT
OFFICERS ARE REQUESTED TO STOP AND PROACTIVELY QUESTION THESE INDIVIDUALS
AND TO CONTACT THE NEAREST FBI OFFICE IMMEDIATELY FOR FURTHER GUIDANCE.
THESE INDIVIDUALS MAY BE HELPFUL IN PROVIDING INFORMATION AND POSSIBLY
EVIDENCE IN SUPPORT OF AN ONGOING INVESTIGATION. SEE CURRENT FBI NLETS
MESSAGE BOLO FOR MORE INFORMATION.
No. NCIC-VGTOF-11586.

V. SILENT HITS

The ACLU’s FOIA litigation revealed for the first time the widespread and growing use
of “silent hits,” a mechanism through which the FBI can keep tabs on individuals suspected of
terrorism without notifying either those individuals or the local law enforcement officers who
encounter them:

 Silent hit entries allow the FBI and other executive departments and agencies to track
watchlisted individuals while withholding this information from state and local law
enforcement officials who encounter the individuals. Whenever local law enforcement
encounters an individual with a silent hit entry, the FBI (and sometimes other designated
agencies) will be automatically notified, but the local law enforcement officer will not.

 The use of silent hits has grown over time, and more agencies have gained the ability to
“nominate” individuals for silent hits as well as receive notifications of encounters.

 Because of their highly secret nature, silent hit nominations are subject to less procedural
protection, and it is extremely difficult for individuals wrongly placed on the list to seek
redress.

A. Criteria for Silent Hit Nominations

The VGTOF/KST watchlist allows some individuals to be tracked without even the
awareness of local law enforcement. When a local law enforcement officer encounters an
individual with a silent hit entry and sends a query through the NCIC, the officer receives no hit
in response, as if no record existed. Simultaneously, however, a notification is sent to the FBI or
another nominating agency, informing them that the individual has been encountered.

A directive from the Counterterrorism Division to all FBI field offices in July 2006 stated
that the subjects may be nominated as a silent hit entry in circumstances where the nominating
official can articulate “a specific, narrowly-defined and legitimate operational justification” for
requesting the silent hit.112 Such justifications include the following:

1) “Subject of investigation is the target of 24/7 physical surveillance, undercover activities
and operations, and undisclosed participation in organizations, in conformity with FBI
policy”;
112 Communications from Counterterrorism Division to All Field Offices (July 25, 2006), No. NCIC-VGTOF-
10889.
2) “Subject is an employee, member, or is affiliated with a military, federal, state, local, or
other law enforcement agency, or any group that may have access to NCIC terminals”; or
3) “Other unique operational circumstances in which a nominating official can articulate a
reasonable and detailed justification why the subject should be included in
NCIC/VGTOF as a silent hit.”113

A proviso in the same directive recognized that because the fact that encountering
officers are not alerted to silent hit entries “raises officer safety issues, subjects who have a
violent nature or are known to be armed and dangerous should not be marked as silent hits.”114

In order to ensure that those considered “armed and dangerous” are not listed as silent
hits, internal guidelines from May 2008 stated that the “Officer Safety Information Field” of an
individual’s VGTOF entry must “be null/blank for records with a HC [handling code] of R or
S.” 115 The “Officer Safety Information Field” includes any information “that would serve to
protect or support an encountering law enforcement officer,” including that the subject
“professes to kill or harm law enforcement,” “is known to impersonate a law enforcement
officer,” “has been issued a concealed weapons permit,” or “is known to carry weapons on his
person.”116 Correspondingly, the guidelines stated that “it is imperative that individuals that pose
any degree of threat to the safety of an encountering law enforcement officer not be issued a
Silent Hit Handling Code.”

B. Expanding Use

The records the ACLU obtained through FOIA indicate that the capability to utilize silent
hits was originally intended to be temporary.117 Only CJIS could enter silent hit entries, and a
local law enforcement officer’s query of a silent hit record prompted a notification only to FBI
Headquarters.118 Around February 2002, silent hits became a permanent fixture of the system,
and the “Office of Origin” for a particular case gained the ability to receive notifications
regarding that silent hit record.119

113 Id.
114 Id.
115 New FBI Nomination Processing Protocol (May 5, 2008), No. NCIC-VGTOF-10558. “R” stands for “routine”
and “S” stands for “sensitive” silent hits. FBI N OMINATIONS & VGTOF TRAINING , No. NCIC-VGTOF-8345, supra
note 13. Although the criteria for these is not clear, there is “no operational difference” between the two handling
codes. Id.
116 New FBI Nomination Processing Protocol (May 5, 2008), No. NCIC-VGTOF-10559.
117 Communications from Counterterrorism Division to All Field Offices (Feb. 22, 2002), No. NCIC-VGTOF-
11121.
118 Id.
119 Id.

As of 2008, the FBI and “OGAs” (likely “other government agencies”) could nominate
individuals to be included as silent hit entries and receive notifications from encounters with
those individuals.120 In some circumstances, “sole OGA identities” with “no FBI nexus/interest”
could also be included as silent hit entries.121 It is unclear whether and to what extent the FBI
reviewed silent hit nominations from outside agencies before approving them.

Total Silent Hit Records

The use of silent hits grew dramatically after their inception, from several hundred
records in early 2003 to over 4,600 records by mid-2006 (see Figure 11). In the period from 2004
to 2008, silent hit records consistently made up between 1 to 3 percent of all records in the
VGTOF database.

Figure 11. Total Silent Hit Records122

120 Id. Silent hit entries may also be accessible through the National Instant Criminal Background system (NICS),
the database used by federal firearms licensees to determine whether individuals are eligible to buy firearms or
explosives. From April to May 2004, NICS received routine silent hit records within an inquiry hit response. After
May 2004, sensitive silent hits were restricted in response to NICS queries, but routine silent hit records may still be
received through NICS. Terrorist Screening Center Initiative Summaries and associated [sic] Specification
Documentation Change Requests (SDCR’s) and Program Tracking Reports (PTR’s) (May 26, 2004), No. NCIC-
VGTOF-11207.

121 New FBI Nomination Processing Protocol (May 5, 2008), No. NCIC-VGTOF-10556.
122 The increase in February 2004 appears to be the result of a database change that relocated all “Terrorist
Member/Silent Hit records from the Undercover database to the VGTOF database.” Terrorist Screening Center
Initiative Summaries and associated [sic] Specification Documentation Change Requests (SDCR’s) and Program
Tracking Reports (PTR’s) (May 26, 2004), No. NCIC-VGTOF-11207.

International versus Domestic Silent Hits

In terms of total numbers, the vast majority of silent hit records are international (see
Figure 12). However, silent hit entries account for a much larger proportion of domestic entries
than of international entries. In the period from 2005 to 2008, between 21.0 and 25.4 percent of
domestic entries were silent hit entries, compared to between 1.0 and 2.4 percent of international
entries.

Figure 12. International versus Domestic Silent Hit Records