Airport screeners look for passengers with “face pale from recent shaving of beard” and other common traits to spot potential terrorists through the Transportation Security Administration’s controversial behavior-detection program.

That’s according to the tightly held list of criteria that agents use to select passengers for additional screening methods such as pat-downs, questions and investigations by law-enforcement personnel.

The Intercept published the document last week after obtaining it from an anonymous source who was “concerned about the quality of the program,” according to an article from the online news organization.

The appearance of the list came one day after the American Civil Liberties Union sued TSA for details of the behavior-detection program, known as Screening Passengers by Observation Techniques. TSA has never explained what types of behaviors raise flags, but critics suspect that the program leads to racial and ethnic profiling.

The leaked document shows that TSA assigns values for various types of behaviors, with four or more points counting as cause for additional screening and six or more points being grounds for law-enforcement referrals.

Signs of stress earn travelers one point apiece, while signs of fear earn two and deception earns three. Many of the characteristics are common enough to cause paralyzing self-consciousness for the average traveler.

Arriving late or whistling as you approach a screening area can both earn you a point. Repetitive grooming gestures and tightly gripping a bag can earn you two points apiece, while appearing confused or disoriented can earn three points.

Under the criteria, a passenger could be sent for additional screening for arriving close to his departure time and looking puzzled about where to find his gate — that’s four points against him. By then, something as simple as running his fingers through his hair a few times could escalate the matter to law enforcement.

Hugh Handeyside, a staff attorney with the ACLU’s National Security Project, said Monday that the checklist “drives home the absurdity” of the behavior-detection program.

“Airports are rich environments for the kind of stress, exhaustion, or confusion that the TSA apparently finds suspicious, and research has long made clear that trying to judge people’s intentions based on supposed indicators as subjective or commonplace as these just doesn’t work,” Handeyside said in a statement.

TSA defended the program in a statement on Tuesday, stressing that no one single behavior alone will cause a traveler to be referred to additional screening or result in a call to a law-enforcement officer.

“Behavior detection, which is just one element of the Transportation Security Administration’s (TSA) efforts to mitigate threats against the traveling public, is vital to TSA’s layered approach to deter, detect and disrupt individuals who pose a threat to aviation,” the agency said.

The ACLU lawsuit asks a U.S. district court to order the release of documents about the program that the group requested through the Freedom of Information Act in October. More than five months after the initial inquiry, TSA has only issued a denial for expedited processing of the inquiry.

The ACLU said it does not plan to drop its lawsuit because of the leak.

The Government Accountability Office questioned the usefulness of behavioral detection techniques in a 2014 report, saying it found no solid evidence that they are effective. The independent watchdog agency recommended that Congress limit funding for the program.

Former TSA Administrator John Pistole defended the practices that year, testifying at a congressional hearing that the methods are critical to aviation security. He said they help identify intent rather than just prohibited items.