Ambassador Sales on Watchlists, Passenger Name Records, Biometrics, and more
Last Friday (Feb 24) Duke law grad Ambassador Nathan Sales, the State Department’s Coordinator for Counterterrorism, was the dinner speaker for LENS’ annual national security law conference (“Complexity and Security: The Role of the Law?”). He addressed border security, something that today presents an especially complex security challenge because of returning foreign terrorist fighters from Iraq and Syria who the UN fears may be coming back to the their home countries “to foster radicalization and attacks on soft targets.”
[B]uilds on UNSCR 2178 by creating new international obligations and other provisions to strengthen border security and information sharing, including the use of Passenger Name Record (PNR) data, Advanced Passenger Information (API), and biometrics to prevent terrorists from boarding airplanes; will strengthen judicial measures and international cooperation; ensure appropriate prosecution, rehabilitation, and reintegration of FTFs and their accompanying family members; and strengthen Member States’ cooperation, including with the private sector, to protect public spaces and soft targets.
Ambassador Sales related how complex technology can aid this effort, and gave specific examples of success stories. Although the event was not recorded, the Ambassador has kindly shared a copy of his remarks. Here they are:
Since 9/11, the United States has been the world’s counterterrorism leader. After the attacks, we pioneered a number of cutting edge tools to secure our borders and keep our people safe. Data analysis. Biometrics. Information sharing. In December, the U.N. Security Council adopted a new resolution that pushes the rest of the world to live up to the same standards.
Let me be more specific. In the run-up to 9/11, al-Qa’ida was able to exploit weaknesses in our borders to send 19 operatives into our country undetected. The result was the deadliest attack on U.S. soil in decades. More Americans died on September 11 than at Pearl Harbor.
We responded by consolidating our watchlists of known and suspected terrorists to block terrorist travel. We started analyzing airline reservation data – known as Passenger Name Records, or PNR – to flag people who should get a little extra scrutiny when they board a plane or come through a customs checkpoint. We started collecting fingerprints from visitors to our country to spot terrorists trying to cross our borders.
With all of this, we made America safer while keeping faith with American values.
Thanks to that new Security Council Resolution, the policies I mentioned are now global standards, not just American ones. UNSCR 2396, which was adopted unanimously and with 66 co-sponsors, requires all UN member states to develop and deploy the same capabilities.
Tonight, I’d like to tell you how the United States has used these vital counterterrorism tools and the promise they hold for the rest of the world.
Let’s start with watchlists.
Effective border security includes multiple layers of screening. The first, most basic layer is to look for previously identified threats. In practice, that means looking at passports or airline manifests and comparing them against databases of known terrorists. It’s a fairly simple process, but it’s effective.
The United States learned all of this the hard way on September 11. In January 2000, a group of senior al-Qa’ida members held a summit in Kuala Lumpur. We knew about the meeting in advance, and Malaysian authorities surveilled the people who attended. But partly because we didn’t have effective watchlists, two of them were able to enter the U.S. after the summit using their actual names – Nawaf al-Hazmi and Khalid al-Mihdhar. They went on to help hijack American Airlines Flight 77 and crash it into the Pentagon.
Today, we have a robust watchlist system. Every day more than a million people enter the United States by land, sea, and air. Another 2.1 million people take a domestic flight. We screen these travelers against our lists of known and suspected terrorists to identify potential threats.
We’ve reinforced these efforts by working with our international partners. Over the years we’ve entered dozens of bilateral arrangements to share information on known and suspected terrorists pursuant to Homeland Security Presidential Directive 6. In 2017, we signed HSPD-6 agreements with 10 additional countries, bringing the total number to 69. Under HSPD-6, our partners have given us over 70,000 names.
Resolution 2396 requires UN member states to maintain these kinds of watchlists. They’re also encouraged to share their lists with other countries. By making watchlists mandatory, the Security Council has taken a U.S. initiative and made it an international norm.
A second, more sophisticated layer of border screening involves passenger name records, or PNR. PNR is the information you give an airline when you book a ticket – a phone number, an email address, and so on. The United States started using PNR back in the 1990s to hunt for suspicious cargo, like narcotics and counterfeit goods. Since 9/11, we’ve used it to spot terrorist threats – with great success.
PNR can help analysts identify suspicious travel patterns, flagging threats who might have escaped notice. It can also illuminate hidden connections between known terrorists and their unknown associates. This is called “link analysis” or “contact chaining.”
Collecting and sharing PNR can also help spot so-called “broken travel,” a tactic of using convoluted travel routes to evade detection. Do you remember Mehdi Nemmouche? He’s the gunman who’s been charged with murdering four people at the Jewish Museum in Brussels in 2014. Nemmouche reportedly used broken travel to reach Europe undetected, traveling from Syria by way of Asia.
So what does PNR use look like? Here are a few success stories.
Ra’ed al Banna.
More recently, in December 2014, a Yemeni citizen was scheduled to fly from Saudi Arabia to Washington, DC. During a routine review of inbound flight data, CBP officers matched an email and phone number in his reservation with a suspected terrorist. They dug a little deeper and found additional ties between the two. Thanks to PNR, the State Department was able to immediately revoke the traveler’s visa, and the airline denied him boarding.
PNR can also be useful in criminal investigations. In December 2009, U.S. citizen Faisal Shahzad received explosives training in Pakistan from people affiliated with Tehrik-e-Taliban – the Pakistani Taliban. In February 2010, Shahzad arrived at JFK on a one-way ticket from Islamabad. He was referred to secondary because he matched a PNR targeting rule. CBP interviewed and released him.
Fast forward three months. On May 1, 2010, a car bomb failed to detonate in Times Square. Investigators tied Shahzad to the car, a Nissan Pathfinder that he bought through Craigslist. CBP then placed an alert for Shahzad in its system. When he booked a flight to flee the country, the system flagged it, and he was arrested at JFK as he attempted to travel to Dubai. He’s now serving a life sentence.
The PNR system that the United States pioneered has now become an international obligation. In 2016, after years of ambivalence and even hostility, the EU directed its member states to develop PNR systems of their own. And Resolution 2396 requires all UN members to do the same.
Biometrics provide a third layer of screening. They’re a critical tool for verifying that travelers really are who they say they are. Terrorists try to mask their true identities in a number of ways – aliases, fake passports, and so on. It’s a lot harder to fake their fingerprints.
That’s why the United States collects biometrics from visitors to this country. We take their fingerprints and facial scans to validate their identities and travel documents. We also check their data against our watchlists.
These tools become even more powerful as our soldiers collect biometrics on the battlefield—latent fingerprints in ISIS safe houses, prints on unexploded IEDs, prints from captured foreign fighters, and so on.
Let me give you a few examples of biometrics in action.
First, the big picture. Last year, through automated sharing of biometrics with partners, we were able to identify 134 known or suspected terrorists who were traveling to foreign countries. The numbers for this year are even more impressive. Since last October, this program has already flagged 44 people.
Here’s an example. Earlier this year, a would-be migrant applied for asylum in the United States. The person’s fingerprints were taken, and we shared them with another country. Our partner reported back that this was a known or suspected terrorist. Thanks to biometrics, we were able to stop the traveler from coming to the United States, and we referred the matter to the foreign country’s national police.
Just a couple of weeks ago, authorities arrested a man in Oklahoma who was suspected of trying to join al-Qa’ida. They were able to identify him because his fingerprints matched those taken from a document retrieved in Afghanistan. The document was an application for al-Qa’ida’s Farooq camp – where four of the 9/11 hijackers trained.
Resolution 2396 takes this American initiative and turns it into a global norm. The resolution requires all UN members to collect biometric data to spot terrorists if they attempt to board planes or cross borders. And because we all need to stop threats before they reach our shores, 2396 calls for countries to share this information.
In conclusion, the United States pioneered the border security tools at the heart of Resolution 2396. But it’s also important for our friends and allies around the world to follow our example.
Our goal is to raise the bar on counterterrorism globally. The more states that can spot terrorists and stop them from traveling, the safer we’ll all be. That’s why the United States will continue to share our expertise – why we’ll continue to lead – in the global campaign to defeat terrorism.