Of all the details investigators have uncovered about Orlando terrorist Omar Mateen, perhaps the most infuriating is the fact that he spent 10 months on a government watch list, yet had no trouble buying an assault rifle and a handgun.

Authorities placed Mateen on a watch list in May 2013 after coworkers at the Florida courthouse where he was a security guard told authorities he boasted of connections to al Qaeda and other terrorists organizations. He remained on the list for 10 months, and FBI Director James Comey told reporters this week that during that time the agency placed Mateen under surveillance and had confidential sources meet with him.

But the feds removed Mateen from the list in March 2014, after concluding that he had no significant links to terrorism beyond attending the same mosque as an American suicide bomber who died in Syria. "We don't keep people under investigation indefinitely,” Comey said, adding that he doesn't see anything that his agents should have done differently.

Comey didn’t identify the list Mateen was on, but an unnamed official told the Daily Beast that he was in two databases, the Terrorist Identities Datamart Environment database and the Terrorist Screening Database, more commonly called the terrorist watch list.

Here's a look at what the lists are and how someone gets their name on one.

What is the Terrorist Watch List?

The Terrorist Screening Database was created in 2003 by order of a Homeland Security Presidential Directive. The database includes the names and aliases of anyone known to be, or reasonably suspected of being, involved in terrorism or assisting terrorists through financial aid or other ways. The federal Terrorist Screening Center maintains the database, and an array of government agencies nominate people to it through the National Counter Terrorism Center.

Some of the information in the database originates with the Terrorist Identities Datamart Environment, also called TIDE. That list contains classified data collected by intelligence agencies and militaries worldwide, but anything passed on to the terrorist watch list is first scrubbed of classified info. In 2013, TIDE had 1.1 million names in it.

The State Department checks all visa applicants against the watch list. The TSA's No-Fly list and Selectee List, which identifies people who warrant additional screening and scrutiny at airports and border crossings, are also derived from the watch list. But it is most often used by law enforcement agencies at all levels to check the identity of anyone arrested, detained for questioning, or stopped for a traffic violation. The FBI calls it "one of the most effective counterterrorism tools for the US government."

Entries in the database are coded according to threat level to provide law enforcement with instructions on what to do when they encounter a suspected terrorist who is on the list. According to a 2005 inspector general report (.pdf), of some 110,000 records in the database that the IG reviewed, 75 percent of them were given handling code 4, considered the lowest level, and 22 percent were given handling code 3. Only 318 records had handling codes 1 or 2. A description of what each level means is redacted in the publicly released version of the document, but a note indicates that people are usually given code 4 when they are either just an associate of a suspected terrorist and therefore may not pose a threat or if there is too little information known about the individual to categorize them at a higher level.

Appearing in the database doesn’t mean you'll be arrested, denied a visa, or barred from entering the country. But it does mean your whereabouts and any other information gleaned from, say, a traffic stop, will be added to the file and scrutinized by authorities.

What's the Criteria for Getting on the Watch List?

According to a 2013 watch list guideline produced by the Terrorist Screening Center and obtained by The Intercept, engaging in terrorism or having a direct connection to a terrorist organization is not necessary for inclusion on the list. Parents, spouses, siblings, children and "associates" of a suspected terrorist can appear on the list without any suspicion of terrorist involvement. "Irrefutable evidence" of terrorist activity and connections is also not necessary, the document states. Reasonable suspicion is sufficient, though this isn't clearly defined.

"These lists are horribly imprecise," a former federal prosecutor, who asked to remain anonymous, told WIRED. "They are based on rumor and innuendo, and it's incredibly easy to get on the list and incredibly difficult to get off the list. There's no due process for getting off the list."

The guidelines also reveal that the Assistant to the President for Homeland Security and Counterterrorism can temporarily authorize placing entire “categories” of people on to the No-Fly and Selectee lists based on "credible intelligence" that indicates a certain category of individuals may be used to conduct an act of terrorism.

"Instead of a watch list limited to actual, known terrorists, the government has built a vast system based on the unproven and flawed premise that it can predict if a person will commit a terrorist act in the future," Hina Shamsi, head of the ACLU’s National Security Project, told The Intercept. "On that dangerous theory, the government is secretly blacklisting people as suspected terrorists and giving them the impossible task of proving themselves innocent of a threat they haven’t carried out."

What Is the No-Fly List?

This narrower list, derived from the terrorist watch list, includes people who haven't done anything to warrant being arrested, yet the government deems too dangerous to allow onto commercial aircraft. Mateen reportedly did not appear on this list. The list included 2,500 individuals when Homeland Security chief Michael Chertoff released the tally for the first time in 2008. Six years later, Christopher Piehota, director of the Terrorist Screening Center, told a House subcommittee it had 64,000 names on it. That sounds like a lot, but the list includes dead people and multiple versions of names.

The No-Fly list is also notorious for ensnaring the innocent whose names resemble those of suspected terrorists. Senator Ted Kennedy, for example, was repeatedly prevented from boarding planes because his name matched that of someone on the list.

What Kind of 'Terrorist Activity' Gets You on the Terrorist Watch List?

Obvious things like using or possessing weapons of mass destruction will land you on the terrorist watch list. So will committing violence at an international airport, or engaging in arson or other types of destruction of government property if it's done to intimidate, coerce, or influence people or government policy. But computer hacking can also get you included if it damages a computer used for interstate or foreign commerce or ones that are used by a financial institution or the government, if the hack was intended to influence people or policy.

Just as there are those on the list who shouldn't be, so too are there people who don't make it onto the list who should. Umar Farouk Abdul Mutallab, the so-called "underwear bomber" who attempted to detonate explosives aboard a flight from Europe in 2009, wasn't on the terrorist or No-Fly lists, even though his father alerted the US embassy in Nigeria to his radicalization. He did appear in the TIDE database, but because that information is classified, it didn't make it to the No-Fly list or the Amsterdam airport where he boarded his flight.

A 2007 inspector general's audit of the terrorist watch list found that in 15 percent of terrorism cases the inspector's office reviewed, the FBI failed to add suspects in the cases to the list.

Can Someone on the List Buy a Gun from a Federally Licensed Seller?

Appearing on the terrorist watch list wouldn't necessarily prevent someone from purchasing a gun; it simply means law enforcement is alerted if you apply to purchase a weapon. So even if he'd been included on the list at the time he bought his weapons, Mateen would still have had no trouble purchasing his Sig Sauer MCX rifle and Glock 17 handgun.

There are ten criteria, however, that do prevent people, whether they're on the terrorist watch list or not, from buying firearms from a licensed seller. They include a felony conviction, being an undocumented immigrant and being deemed mentally unstable by a court.

Government Accountability Office data recently released to California Democratic Senator Dianne Feinstein indicate that 2,477 people on the watch list attempted to buy a firearm between February 2004 (when authorities started checking gun sale purchases against the list) and the end of 2015. Of those, 2,265 of the transactions were allowed.

Feinstein proposed legislation last year to prevent known or suspected terrorists on the watch list from obtaining a gun license or buying a weapon from a licensed seller. The Senate rejected the proposal one day after the San Bernadino attack, but Feinstein said she hopes the Orlando massacre will give the bill new life. This week, Senate Democrats filibustered until Republicans agreed to consider such legislation.

But barring anyone on the list from buying a gun can create a different problem. "If you prevent people on the list from buying a weapon, then an attempt to buy the weapon can alert the person that they're on the list," the former prosecutor told WIRED. "So you're aiding the terrorist [with that information]."

How Many People Are on the Terrorist Watch List?

The exact number is unclear because the list includes many aliases and variations of names, and officials often confuse the number of names that are on the list and the number of unique individuals that are on it. In 2011, for example, more than 1 million names appeared on the list, but just 400,000 of these represented unique individuals. In 2014, the Terrorist Screening Center's Piehota told lawmakers the list included 800,000 names.

About 99 percent of names nominated to the list each year are accepted, and the number of nominations grows annually. In 2009, authorities nominated 227,932 known or suspected terrorists. In 2013, the number reached nearly 469,000.

Most of the people on the watch list are not US citizens; placing a citizen or permanent US resident on the list is supposed to require a higher standard, such information "from sources of known reliability or where there exists additional corroboration or context supporting reasonable suspicion," according to the guidelines The Intercept obtained.

How Do You Get Off the Terrorist Watch List or No-Fly List?

This remains a source of great controversy. People on these lists rarely know how or why they landed there, and the process of removal can be convoluted. In 2007, the Department of Homeland Security created a redress program through which people can challenge their inclusion on the No-Fly list. It works well enough for anyone mistakenly added to the list, but provides little help to those whom the government says are on the list for legitimate reasons but won't disclose the reasons.

The FBI will remove people from the terrorist watch list after closing an investigation that failed to uncover terrorist activity or connections. This is exactly what happened to Mateen, which has angered some officials. "The only way you should get off the list is if they no longer believe you’re a threat," Senator Lindsey Graham said during a Capitol Hill briefing after the Orlando shooting. "It should have nothing to do with not being able to prove a crime."

But the FBI was simply following procedure when it dropped Mateen from the watch list, after being criticized in the past for not promptly removing people when cases get closed. An inspector general's report in 2007 found that the FBI failed to remove names in a timely manner in 72 percent of the cases the Bureau closed for lack of evidence. A 2009 audit found that the situation had not improved, prompting lawmakers like Vermont Democratic Senator Patrick Leahy to criticize the Bureau.

The bigger question then, is not why was Mateen removed from the list, but why did the FBI close its investigation of him prematurely? "To me, there was enough here to keep it in some sort of a status," New York Republican Representative Peter King said during the Capitol Hill briefing this week.

But with so many suspects on the watch list, authorities must be judicious in choosing which ones to pursue. "Our work is very challenging," Comey said this week. "We are looking for needles in a nationwide haystack. But we’re also called upon to figure out which pieces of hay might someday become needles."

There is no specific criteria guiding when to close a case related to the terrorist watch list. "It's a judgment call," says the former prosecutor. "It depends on the seriousness of the allegations and the result of the investigation. It's [a matter of whether an] investigator is convinced, more than anything else, that 'We better keep looking at this guy.'"

In the case of Mateen, investigators surveilled him, looked into his background, and performed a "dangle," the former prosecutor says. That's when a confidential informant meets with a suspect. "They feel the guy out to try to figure out if he's real or if he's just all talk," he says. They may do this by asking if he's interested in purchasing weapons or materials to make a bomb. "They may try the dangle operation two or three times, and if he shows no genuine interest in activity, if he doesn't take the bait, then they say after a period of time, we've got no reason to believe this person is something other than an angry young man ... and they close the investigation."

Still, a case is never truly closed. Authorities can re-open it if something piques their interest—like say, a suspect buying weapons. That would have been sufficient to get Mateen back on the FBI's radar. But because he wasn't on the watch list, the FBI didn't know what he was up to. And that's what lawmakers are saying they want to fix.