The details of President Donald Trump’s often vague promise of “extreme vetting” is beginning to take shape. In a hearing Tuesday, Homeland Security Chief John Kelly told Congress the United States is considering requiring visa applicants to disclose passwords to their social media accounts.

“We’re looking at some enhanced or some additional screening. We may want to get on their social media, with passwords,” he told the House Homeland Security Committee.

“It’s very hard to truly vet these people in these countries, the seven countries. But if they come in, we want to say, what websites do they visit, and give us your passwords. So we can see what they do on the internet,” Kelly said.

He also suggested visa applicants and others who refuse to cooperate in the process would be denied entry.

There has been no final decision made on the policy for the time being, but Kelly’s statements do give shape to the type of vetting procedures the Trump administration is considering.

This isn’t the first time social media has been an area of emphasis for visitors to the country. The U.S. Customs and Border Protection (CBP) agency proposed adding a line to visa application forms that would require the applicant to provide information associated with their online presence.

According to statements filed to the U.S. Federal Register, the Department of Homeland Security argued, “collecting social media data will enhance the existing investigative process and provide Department of Homeland Security (DHS) greater clarity and visibility to possible nefarious activity and connections by providing an additional tool set which analysts and investigators may use to better analyze and investigate the case.”

The DHS began screening social media posts made by visa applicants in December 2015.

The emphasis on social media profiles from the CBP came in the wake of the terrorist attack in San Bernardino, Calif. It was reported after the attack that one of the shooters had communicated with friends via Facebook Messenger and pledged her support for jihad.

It was initially reported the shooter had made the posts publicly, but the FBI corrected reports saying the messages were sent directly to friends and not shared on her public profile. Reading messages like those would require having a person’s password to access their account.