The dominant cost here isn't the cost of the employee that has to update their database, it is the cost of lost advertising or customers angry that your company is providing services to terrorists.