# Operational Standard Operating Procedure (SOP)
## Mandatory Operational Protocol: 60-Minute Airborne Derogatory Recurrent Hit Response

**Classification**: FOR OFFICIAL USE ONLY // LAW ENFORCEMENT SENSITIVE  
**Governing Directives**: CBP Directive 3340-021B (Passenger Vetting Operations), DHS Targeting Standards (TASPD & PSPD), Automated Targeting System (ATS) SOP.  
**Trigger Event**: A traveler with an approved GCVWP / EVS-TAP electronic travel authorization boards a commercial flight bound for Guam (GUM) or Saipan (SPN). While airborne, continuous recurrent vetting produces a new, high-confidence derogatory match against the Terrorist Screening Dataset (TSDB) / National Crime Information Center (NCIC) / TECS Lookout records.

---

## ⏱️ Minute-by-Minute Operational Timeline (0–60 Minutes)

```mermaid
sequenceDiagram
    autonumber
    participant Engine as Recurrent Vetting Engine
    participant ATS as ATS / Passenger Common Core
    participant NTC as National Targeting Center (NTC)
    participant TTRT as Tactical Targeting Response Team
    participant Port as Port of Entry (GUM/SPN) Watch Commander
    participant Secondary as CBP Tactical / Secondary Response
    participant Carrier as Carrier Liaison / Federal Air Marshal

    Note over Engine: T+00:00 - High-Derog Match Triggered
    Engine->>ATS: Ingest Delta Hit (TSDB/TECS/NCIC) & Invalidate Auth Token
    ATS->>NTC: Broadcast Priority-1 High Risk Alert (Seat, PNR, Flight)
    Note over NTC: T+02:00 to T+08:00 - Rapid Intelligence Validation
    NTC->>TTRT: Dispatch Target Dossier & Biographic Confidence Score
    TTRT->>Port: Transmit Immediate Action Directive (IAD)
    Note over Port: T+15:00 - Port Readiness & Tactical Intercept Plan
    Port->>Secondary: Deploy Gate-Side Tactical Arrest / Extraction Team
    Port->>Carrier: Notify Carrier OCC (Secure Law Enforcement Channel)
    Note over Secondary: T+30:00 to T+45:00 - Ramp-Side Quarantine Setup
    Port->>ATS: Update TVS/Simplified Arrival Flag to "MANDATORY SECONDARY ESCORT"
    Note over Secondary: T+50:00 to T+60:00 - Touchdown, Positive ID & Secure Custody
    Secondary->>Port: Confirm Target Restrained, PCCS Record Sealed
```

---

### Phase 1: Automated Invalidation & National Alerting (Minutes 00:00 – 05:00)

| Minute | System & Entity Action | Stakeholders In The Loop |
| :--- | :--- | :--- |
| **T+00:00** | **Derogatory Delta Ingestion**: Recurrent Vetting Engine matches airborne traveler against updated TSDB Tier-1 / NCIC felony warrant. | Automated Vetting Service, ATS Core |
| **T+00:30** | **Authorization Status Revocation**: EVS-TAP authorization state immediately transitions from `APPROVED` -> `REVOKED_DEROGATORY_ALERT`. An automated, cryptographically signed event is published to the Passenger Common Core Service (PCCS) event bus. | PCCS Event Bus, APIS/PDS Subsystem |
| **T+01:15** | **Flight & Seat Telemetry Enrichment**: ATS cross-references the revoked authorization ID with active inbound APIS manifests to isolate exact **Flight Number**, **Carrier**, **Departure Port**, **Estimated Time of Arrival (ETA)**, and assigned **Seat Number**. | ATS Targeting Analysts, NTC Watch Officer |
| **T+02:30** | **Priority-1 Critical Alert Broadcast**: High-priority red-flag banner triggers on National Targeting Center (NTC-P) dashboard with visual and audible alarms. | NTC Senior Watch Officer (SWO), NTC Lead Targeting Officer |

---

### Phase 2: National Targeting Center (NTC) Triage & Tactical Handoff (Minutes 05:00 – 15:00)

| Minute | Tactical & Operational Action | Stakeholders In The Loop |
| :--- | :--- | :--- |
| **T+05:00** | **Positive Identity Confirmation**: NTC Targeting Specialist conducts rapid biographic/biometric verification (confirming passport hash, biometric templates from past encounters, visa history, and derogatory origin agency like FBI/TSA/INTERPOL). | NTC Senior Targeting Officer, Originating Agency LNO (FBI/TSC) |
| **T+08:00** | **Target Assessment Package (TAP) Generation**: NTC compiles automated dossier detailing: Risk Category, Armed & Dangerous flags, Travel History, Traveling Companions on the same PNR, and Specific Handling Instructions. | NTC-Passenger Section Chief |
| **T+11:00** | **Immediate Action Directive (IAD) Transmission**: NTC transmits the IAD and TAP directly via secure high-priority teletype and encrypted portal to the **Port Director** and **Watch Commander** at the destination Port of Entry (Guam A.B. Won Pat International Airport - GUM, or Saipan International Airport - SPN). | NTC SWO -> GUM/SPN Port Director & Watch Commander |
| **T+14:00** | **TSA / FAMS Coordination**: If the threat involves in-flight security, NTC notifies the Federal Air Marshal Service (FAMS) Mission Operations Center and TSA Office of Intelligence. | FAMS Liaison Officer, TSA Operations |

---

### Phase 3: Port of Entry Tactical Mobilization (Minutes 15:00 – 35:00)

| Minute | Port-Level Action & Protocol | Stakeholders In The Loop |
| :--- | :--- | :--- |
| **T+15:00** | **Watch Commander Command Briefing**: Port Watch Commander acknowledges IAD, activates the **Tactical Terrorism Response Team (TTRT)** / **Special Response Team (SRT)**, and briefs the Chief CBPO. | Port Watch Commander, TTRT Lead, Chief CBPO |
| **T+20:00** | **Arrival Gate Hardening & Position Assignment**: TTRT and armed CBPO officers stage at the designated arrival jetbridge/gate. Secondary inspection suites are placed on lockdown; containment zones established to isolate the traveler before they enter the general arrivals hall. | TTRT Officers, Primary Inspection Supervisors |
| **T+25:00** | **Simplified Arrival / TVS System Lockout**: Destination port Automated Passport Control (APC) and Simplified Arrival facial biometric cameras receive an instant override: If the subject attempts facial verification at primary, the kiosk displays a discreet neutral routing prompt ("Please see an Officer") while triggering a silent audible alarm at the Primary Supervisor booth. | Port IT Systems Lead, Primary CBPOs |
| **T+30:00** | **Carrier Operations Coordination**: Port Watch Commander contacts the airline Station Manager and Operations Control Center (OCC) via secure channel. Flight crew is alerted under confidential standard protocol (discreet deplaning sequence instructions) without causing cabin disruption. | Carrier Station Manager, Flight Dispatch, Port Watch Commander |

---

### Phase 4: Ramp-Side Intercept, Positive Identification & Custody (Minutes 35:00 – 60:00)

| Minute | Direct Interception & Post-Encounter Actions | Stakeholders In The Loop |
| :--- | :--- | :--- |
| **T+40:00** | **Pre-Arrival Final Status Check**: NTC, Port Watch Commander, and TTRT conduct synchronized comms check on the encrypted tactical talkgroup. Originating law enforcement agency (JTTF) is linked in for immediate post-custody interviews. | NTC, GUM/SPN Watch Commander, JTTF Special Agent |
| **T+48:00** | **Aircraft Touchdown & Gate Arrival**: Aircraft blocks at gate. TTRT officers position at the jetbridge door. | Port Tactical Officers, Aircraft Lead Gate Agent |
| **T+52:00** | **Discreet In-Jetbridge Intercept**: Target is intercepted at the aircraft door / first-off sequence, identified via mobile biometric (EDR-300 / Mobile Biometric Capture), separated from general passenger flow, and escorted directly to the Port Hardened Secondary Inspection facility. | TTRT Lead Officer, Subject Escort Detail |
| **T+58:00** | **Adverse Action & Lookouts Logging**: Subject is processed under Title 8 / INA § 212 inadmissible alien protocols or criminal warrant execution. EVS-TAP record is permanently marked `REFUSED_INADMISSIBLE` and a global TECS/NCIC Lookout record is created with full event audit logs. | Secondary Processing Officer, Port Watch Commander, NTC |
| **T+60:00** | **National Incident Closeout**: NTC updates executive dashboard to `TARGET IN SECURE CUSTODY - INCIDENT RESOLVED`. PCCS logs immutable record hash. | NTC Executive Leadership, CBP HQ Operations Center |

---

## 👥 Full Stakeholder Responsibility Matrix

| Entity / Role | Primary Responsibility | Communications Medium |
| :--- | :--- | :--- |
| **Recurrent Vetting Engine** | Continuous delta comparison, automated token revocation within $\le 500\text{ms}$ | High-speed Kafka/EventBridge Bus |
| **ATS Operations Analyst** | Telemetry ingestion, flight/seat association, biographic match confidence scoring | ATS Internal Console |
| **National Targeting Center (NTC-P)** | 24/7 command authority, Target Assessment Package (TAP) generation, inter-agency deconfliction | NTC Tactical Dashboard / Encrypted Chat |
| **Port Director / Watch Commander** | Destination port command, tactical staging, gate selection, carrier local coordination | Secure Radio Talkgroup & Encrypted Phone |
| **TTRT / SRT Tactical Officers** | Jetbridge intercept, physical apprehension, mobile biometric confirmation, secure transport | Tactical Encrypted Radios (P25) |
| **Simplified Arrival / Primary CBPOs** | Automated system intercept locks, discreet redirection without alerting target | Biometric Kiosk / TVS Terminal |
| **Carrier Operations Control (OCC)** | Manifest confirmation, gate assignment, discrete deplaning coordination | Secure Dedicated Airline Liaison Line |
| **Joint Terrorism Task Force (JTTF) / FBI** | Warrant execution, counterterrorism debrief, federal custody transition | SIPR/NLETS/Secure Phone |