Border Security: State Department Rollout of Biometric Visas on  
Schedule, but Guidance Is Lagging (09-SEP-04, GAO-04-1001).	 
                                                                 
As a complement to the Department of Homeland Security's (DHS)	 
United States Visitor and Immigrant Status Indicator Technology  
(US-VISIT) program--a governmentwide program to better control	 
and monitor the entry, visa status, and exit of visitors--the	 
State Department (State) is implementing the Biometric Visa	 
Program at all 207 overseas consulates by October 26, 2004. This 
program, required by the Enhanced Border Security and Visa Entry 
Reform Act of 2002, requires that all persons applying for U.S.  
visas have certain biometrics (fingerprints) and a digital	 
photograph collected during the visa application interview. This 
information must be cleared through the DHS Automated Biometric  
Identification System (IDENT) before an applicant can receive a  
visa. GAO reviewed State's rollout of the program, including its 
implementation progress and how State and DHS envision the	 
program being used to help adjudicate visas.			 
-------------------------Indexing Terms------------------------- 
REPORTNUM:   GAO-04-1001					        
    ACCNO:   A12191						        
  TITLE:     Border Security: State Department Rollout of Biometric   
Visas on Schedule, but Guidance Is Lagging			 
     DATE:   09/09/2004 
  SUBJECT:   Education or training				 
	     Identity verification				 
	     Immigration information systems			 
	     Immigration or emigration				 
	     Program management 				 
	     Biometrics 					 
	     Border security					 
	     Visas						 
	     Dept. of State Biometric Visa Program		 
	     DHS Visitor and Immigrant Status			 
	     Indicator Technology Program			 
                                                                 
	     INS Automated Biometric Identification		 
	     System						 
                                                                 

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Product.                                                 **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************
GAO-04-1001

United States Government Accountability Office

      GAO	Report to the Chairman, Committee on Government Reform, House of
                                Representatives

September 2004

BORDER SECURITY

State Department Rollout of Biometric Visas on Schedule, but Guidance Is Lagging

                                       a

GAO-04-1001

Highlights of GAO-04-1001, a report to the Chairman, Committee on
Government Reform, House of Representatives

As a complement to the Department of Homeland Security's (DHS) United
States Visitor and Immigrant Status Indicator Technology (US-VISIT)
program-a governmentwide program to better control and monitor the entry,
visa status, and exit of visitors-the State Department (State) is
implementing the Biometric Visa Program at all 207 overseas consulates by
October 26, 2004. This program, required by the Enhanced Border Security
and Visa Entry Reform Act of 2002, requires that all persons applying for
U.S. visas have certain biometrics (fingerprints) and a digital photograph
collected during the visa application interview. This information must be
cleared through the DHS Automated Biometric Identification System (IDENT)
before an applicant can receive a visa. GAO reviewed State's rollout of
the program, including its implementation progress and how State and DHS
envision the program being used to help adjudicate visas.

GAO recommends that DHS and State develop and provide to consular posts
guidance on how the program should be used to help adjudicate visas and
that State direct each consular post to develop an implementation plan
based on this guidance.

DHS and State generally concurred with these recommendations.

www.gao.gov/cgi-bin/getrpt?GAO-04-1001.

To view the full product, including the scope and methodology, click on
the link above. For more information, contact Jess Ford at (202) 512-4128
or [email protected].

September 2004

BORDER SECURITY

State Department Rollout of Biometric Visas on Schedule, but Guidance Is Lagging

State is installing the equipment and software for the Biometric Visa
Program on schedule and will likely meet the October 26, 2004,
implementation deadline. However, DHS and State have not fully developed
guidance for the program's use. As of September 1, 2004, State had
installed program hardware and software at 201 out of a total of 207
overseas posts and plans to complete the installation at the remaining 6
posts by September

30. The posts with the program are now collecting fingerprints of each
visa applicant and processing the prints through the DHS IDENT database.
Although the technology installation has progressed smoothly, DHS and
State have not developed and not provided comprehensive guidance that
includes directions to consular officers on when in the visa process
prints are to be scanned and when and how information from the IDENT
database on visa applicants should be considered by consular officers. In
the absence of such guidance, GAO found that consular officers are unclear
on how to use the program and the information available from IDENT on visa
applicants. For example, officers are unclear about whether fingerprints
of visa applicants should be collected before or during the visa
interview, whether information on visa applicants from the DHS database
should be considered by the visa-adjudicating officer during or after the
interview, and who should have responsibility for reviewing the IDENT
information before visa issuance. Answers to these questions could
significantly affect how each post manages workflows and processes visa
applicants, which could have staffing and resource implications.

Example of Fingerprints and Photograph Capture

Contents

     Letter                                                                 1 
                                          Results in Brief                  2 
                                             Background                     3 
                           Implementation Moving Forward, yet Guidance Is   6 
                                               Lacking                     
                                             Conclusions                   14 
                                Recommendations for Executive Action       15 
                                 Agency Comments and Our Evaluation        15 
                                        Scope and Methodology              16 
Appendixes                                                              
                              Comments from the Department of Homeland     18 
               Appendix I:                    Security                     
                                            GAO Comments                   21 
              Appendix II:      Comments from the Department of State      22 
                                            GAO Comments                   28 
                              Figure 1: Biometric Fingerprint Analysis        
    Figures                  Process Figure 2: Potential Timing of IDENT    5
                                          Response on Visa                 
                                             Applicants                    11 

Abbreviations

IDENT DHS Automated Biometric Identification System INA U.S. Immigration
and Nationality Act

This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed in
its entirety without further permission from GAO. However, because this
work may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this material
separately.

A

United States Government Accountability Office Washington, D.C. 20548

September 9, 2004

The Honorable Tom Davis Chairman, Committee on Government Reform House of
Representatives

Since September 11, 2001, the U.S. government has made a concerted effort
to strengthen border security by enhancing visa issuance policies and
procedures, as well as improving screening of the millions of foreign
visitors who enter the United States annually. A major initiative is the
Department of Homeland Security's (DHS) United States Visitor and
Immigrant Status Indicator Technology (US-VISIT) program-a governmentwide
program to collect, maintain, and share information on foreign nationals
and better control and monitor the entry, visa status, and exit of
visitors. As a complement to US-VISIT, the State Department (State) is
implementing the Biometric Visa Program at all 207 nonimmigrant
visaissuing overseas consulates by October 26, 2004.1 This program
requires that all persons applying for U.S. visas have certain biometrics2
(fingerprints) and digital photographs collected during the visa
application interview and cleared through the DHS Automated Biometric
Identification System (IDENT) before receiving a visa. The program is also
consistent with the 9/11 Commission report issued on July 22, 2004, that
recommends using biometric identifiers for border and transportation
systems and a biometric entry-exit screening system for travelers.

For this report, we assessed State's implementation of the Biometric Visa
Program for nonimmigrant visas,3 including progress in installing
equipment and software and how State and DHS envision the program should
be used to help adjudicate visas. We obtained and reviewed State's

1Section 303 of the Enhanced Border Security and Visa Entry Reform Act of
2002 (Pub. L. No. 107-173) requires that no later than October 26, 2004,
the State Department issue visas that use biometric identifiers.

2Biometrics is a wide range of technologies that can be used to verify a
person's identity by measuring and analyzing his or her physiological
characteristics. In this case, and for the purposes of this report,
"biometric identifiers" refers to fingerprints. See GAO, Technology
Assessment: Using Biometrics for Border Security, GAO-03-174 (Washington,
D.C.: Nov. 14, 2002).

3In this report, we use the term "visa" to refer to nonimmigrant visas
only. The United States also grants visas to people who intend to
immigrate to the United States. A visa allows a foreign visitor to present
himself or herself at a port of entry for admission to the United States.

guidance to consular posts, analyzed technical data, and interviewed
officials from State and DHS about the Biometric Visa Program. We also
visited consular posts in El Salvador and the Dominican Republic to
observe the visa process under the new system. We conducted our review in
accordance with generally accepted government auditing standards.

Results in Brief	State is installing the equipment and software for the
Biometric Visa Program on schedule and will likely meet the October 26,
2004, implementation deadline. However, DHS and State have not developed
comprehensive guidance for the program's use. As of September 1, 2004,
State had installed program hardware and software at 201 out of a total of
207 overseas posts and plans to complete the installation at the remaining
6 posts by September 30. The posts with the program are now collecting
fingerprints of each visa applicant and processing the prints through the
DHS IDENT database. Although the technology installation has progressed
smoothly, DHS and State have not developed and not provided comprehensive
guidance to consular posts that includes directions to consular officers
on when in the visa process prints are to be scanned and when and how
information from the IDENT database on visa applicants should be
considered by consular officers in adjudicating visas. In the absence of
such guidance, we found that consular officers are unclear on how to use
the program and the information available from IDENT on visa applicants.
For example, officers are unclear about whether fingerprints of visa
applicants should be collected before or during the visa interview,
whether information on visa applicants from the DHS database should be
considered by the visa-adjudicating officer during or after the interview,
and who should have responsibility for reviewing the IDENT information
before visa issuance. Answers to these questions could significantly
affect how each post manages workflows and processes visa applicants,
which could have staffing and resource implications.

Consular officers overseas need to know how the program's information
about visa applicants is intended to be used in order to maximize program
effectiveness and determine optimal workflow management and resource
issues. Therefore, we are recommending that the Secretaries of Homeland
Security and State develop and provide to consular officers comprehensive
guidance on how all aspects of the Biometric Visa Program should be used
and that each consular post develop an implementation plan based on this
guidance.

In commenting on a draft of our report, DHS generally concurred, stating
that GAO's identification of areas where improvements are needed in the
Biometric Visa Program will contribute to ongoing efforts to strengthen
the visa process. State acknowledged that there may be a lag in guidance
and that this may be inevitable given the rapid implementation of this
program. Both departments noted that posts have been allowed flexibility
in implementing the program based on potential staffing and facility
limitations. Our recommendations provide a basis for DHS and State to
address these potential limitations.

Background	The multibillion dollar DHS US-VISIT program aims to improve
the nation's capacity for collecting information on foreign nationals who
travel to the United States, as well as control the pre-entry, entry,
status, and exit of these travelers. The goals of US-VISIT are to
facilitate legitimate travel and trade and enhance national security.
Under the program, most foreign visitors are required to submit to
fingerprint scans of their right and left index finger and have a digital
photograph taken upon arrival at U.S. ports of entry.4

As a complement to US-VISIT, State's Biometric Visa Program, which is
budgeted at more than $162 million through fiscal year 2005, is designed
to deny U.S. visas to questionable travelers to stop them before they
enter the country and to verify the identity of legitimate travelers who
use visas to enter the United States. Under the program, consular officers
collect visa applicants' fingerprints and photographs at overseas posts to
verify the identity of foreign nationals who plan to enter the United
States. Then inspectors at U.S. ports of entry use State's records to
verify that the original visa applicant is, indeed, the person now
entering the United States on that visa. According to the Assistant
Secretary for Consular Affairs, the Biometric Visa Program will enhance
the integrity of the U.S. visa process, better equipping the consular
officers who are the nation's "first line of defense." DHS and State share
responsibility for policy and implementation of the Biometric Visa
Program. According to a Memorandum of

4US-VISIT is currently deployed at major U.S. seaports and airports and
will eventually be deployed at land ports.

Understanding5 between the Secretaries of State and Homeland Security, DHS
is responsible for establishing visa policy, reviewing implementation of
the policy, and providing additional direction, while State is responsible
for managing the visa process.

Fingerprinting Process	In September 2003, the State Department began
installing fingerprint scanners and related software at U.S. consulate
posts abroad. Foreign nationals who apply for nonimmigrant visas at U.S.
consulates with scanners are required to submit to a scan of their right
and left index fingers. Once a print is captured, it is transmitted
electronically from the consulate's server6 to State's server. The State
server then transmits the print to IDENT-a DHS database that includes some
5 million people who may be ineligible to receive a visa. Our review of
State's data on processing times indicates that transmitting the
fingerprints from posts through State to DHS and receiving a response
generally takes about 30 minutes. (See fig. 1.)

5Memorandum of Understanding Between the Secretaries of State and Homeland
Security Concerning Implementation of Section 428 of the Homeland Security
Act of 2002, Sept. 30, 2003.

6A server is a computer on a network that manages network resources, such
as storing files, managing printers, managing network traffic, or
processing database queries.

Figure 1: Biometric Fingerprint Analysis Process

               Sources: GAO analysis of State and DHS processes.

IDENT contains two sets of data: (1) "watch list" fingerprint records
including immigration violators and a subset of the Federal Bureau of
Investigation's (FBI) fingerprint database containing records on
terrorists and individuals with felony convictions7 and (2) fingerprint
and photograph records of persons previously entered into the system
either at a U.S. port of entry or by applying at a U.S. consular post for
a visa. IDENT searches for matches, triggering a response back to the
consulate indicating a "hit" or no existing record ("N/R"). A hit means a
person is on a watch list or that the person has been previously entered
into the system. Then applicants with no previous IDENT records are
entered into the system for future transactions. If the system cannot
determine whether the applicant's prints match a set previously entered,
the system sends the data to biometric

7IDENT data includes FBI information on all known and suspected
terrorists, selected wanted persons (foreign-born, unknown place of birth,
previously arrested by DHS), and previous criminal histories for high risk
countries; DHS Immigration and Customs Enforcement information on deported
felons and sexual registrants; and DHS information on previous criminal
histories. Information from the bureau includes fingerprints from the
Integrated Automated Fingerprint Identification System.

experts to determine if a subject's print has a match or that there is no
record in the system.8 These responses are sent back to the DHS IDENT
database and then routed to consulates through the State server. If an
IDENT hit response is returned on a visa applicant, the consulate's
software will not allow a visa to be printed unless it is reviewed and
cleared by a consular officer.

  Implementation Moving Forward, yet Guidance Is Lacking

State's implementation of the technology aspects of the biometric visa
program is currently on schedule to meet the October 26, 2004, deadline. A
well-planned rollout of equipment and software and fewer technical
problems than anticipated have contributed to smooth implementation of the
technological aspects of the program at the 201 posts that had the program
operating as of September 1. But amid the fast pace in rolling out the
program to meet the deadline, DHS and State have neither developed
comprehensive guidance for the program, including determining who should
scan fingerprints, where and who should review information about
applicants returned from IDENT, and technical requirements for the IDENT
system, nor provided comprehensive guidance for consular posts on how the
information about visa applicants made available through the Biometric
Visa Program should be used to help adjudicate visas.

    State Is Expected to Meet the Legislative Deadline

State planned the rollout of the equipment (hardware and software) to take
advantage of already-scheduled contractor upgrades to software and
hardware at many of the overseas posts,9 thereby decreasing the overall
burden on the posts and managing the costs of the program. The program's
funding was included in the department's appropriation-nearly $54 million
for fiscal years 2003 and 2004-and is projected at more than $108 million
for fiscal year 2005. In addition, State arranged for additional
installation teams to be deployed as needed to avoid potential delays in
the implementation schedule for posts.

Overall, implementation of the technological aspects of the Biometric Visa
Program is on schedule. According to State officials at headquarters and
at

8One in 1,000 cases require examination by a fingerprint expert, according
to State officials.

9On a revolving 24- to 36-month schedule, State replaces hardware and
upgrades or installs software at the consular posts. Where possible, State
added the installation of the fingerprint capture software and the
fingerprint scanners to these scheduled visits.

the two posts we visited, State has experienced fewer technical problems
than anticipated. Early on, State had a few difficulties in transmitting
data between the posts and the DHS IDENT, primarily related to server and
firewall (computer security) issues. According to State, most issues were
resolved within a few days.

Fingerprinting Raising Issues in According to State, the time required to
collect fingerprints has not

Visa Process	significantly affected interview times. State officials
estimate that it can take as little as a few seconds to collect prints,
and the average time is about 30 seconds. In San Salvador, El Salvador,
and Santo Domingo, Dominican Republic, we observed that capturing prints
for some applicants fell within these time frames but, in some cases, the
fingerprint collection times were significantly longer. In one case, it
took more than 10 minutes for an elderly woman to understand the
interviewing officer's verbal instructions on where to place her finger so
that the prints could be captured. For security reasons, interviewing
officers are separated by a glass window from the applicants. As a result,
they can only give verbal instructions or hold up a finger to demonstrate
which one to use, and they cannot physically touch an applicant's finger
to position it correctly on the scanner.

According to State's data, from February to August 2004, the total
biometric visa process averaged about 30 minutes for an applicant's prints
to be sent from an overseas post to the State server, then on to DHS for
IDENT analysis, and then for the response to be returned through State's
server to the post. To date, the analysis time required by the IDENT
database to search for a match to an applicant's prints has fallen within
the time frame agreed to by State and DHS-within 15 minutes if no human
analysis is required.10 If human analysis is required, DHS has up to 24
hours to provide a response back to the post.

Our observations at posts in San Salvador and Santo Domingo demonstrated
the importance of the length of the time required to receive an IDENT
response. We observed that most interviews average only a few minutes, but
the IDENT response time currently is 30 minutes. Thus, if

10State officials told us that DHS and State have an informal arrangement
that the response time must be within 15 minutes for IDENT analysis or, if
biometric experts must examine the prints, up to 24 hours. The officials
said that State and DHS are formalizing this agreement in a memorandum of
understanding.

interviewing officers collect prints during interviews, the IDENT
responses will not be available to these consular officers by the end of
the interviews.

IDENT response time could potentially affect visa issuance times because a
visa cannot be issued to an applicant until the post has received the
IDENT response on the person. Long delays in the IDENT response times
could have a major effect on the visa issuance process and inconvenience
visa applicants. Consular Affairs has encouraged officials to issue visas
the day after interviews since part of the visa process now relies on
another agency's system. However, some posts still issue same-day visas,
such as Santo Domingo.

Implementation Continues at While the IDENT database response times have
not adversely affected visa

Largest-Volume Posts	processes to date, officials remain cautious about
the potential for IDENT database capacity issues and longer response times
as the large-volume posts are added to the program. State began the
program's rollout at smalland medium-sized posts to work out potential
problems before deploying it at posts with the largest applicant volumes.
As of September 1, 2004, 201 of the 207, or 97 percent, of the visa
issuance posts have implemented the program. In terms of nonimmigrant visa
application volume, this number represents about 89 percent of the total
worldwide volume. Taipei, Taiwan; and Manila, Philippines; are the last
"extra-large volume" visa issuing posts that are scheduled to become
operational in the program in mid-September.

DHS and State are closely monitoring the IDENT response times as the final
6 consular posts-representing 11 percent of the worldwide visa application
volume-are added to the program. Increased volumes of visa applications
combined with the increased volume of entrants at U.S. ports of entry due
to summer tourism could potentially affect the speed of IDENT's response.
In addition, IDENT processing may be further affected by the September 30,
2004, requirement that the database system analyze fingerprint records for
all visitors from countries in the Visa Waiver Program11 at U.S. ports of
entry.

11Under the Visa Waiver Program, citizens of 27 countries are not required
to obtain visas for business or pleasure stays of short duration.

Overall Impact of IDENT Responses on Visa Decisions Is Low

According to State, the overall impact of IDENT responses on visa issuance
decisions has been relatively low to date, primarily due to the program's
infancy. According to State officials, nearly 1.7 million sets of visa
applicant prints had been processed by August 19, 2004, and of those,
1,197 were identified as watch list hits-having derogatory criminal or
immigration information on file. At the two posts we visited, nine
applicant records were returned as watch list hits between February and
May 2004. The adjudicating officers had already refused eight of the
applicants on other grounds12 during their interviews; one applicant's
visa had been preliminarily approved by the interviewing officer pending
review of the IDENT response, but then due to the derogatory information
IDENT returned, the visa was not issued.

    Guidance Lagging behind Implementation

Due to the rapid deployment of the hardware and software technology to
meet the required deadline, comprehensive guidance on using the Biometric
Visa Program and the information available through IDENT has lagged behind
implementation. State and DHS have yet to agree on the details of how all
aspects of the program will be used, including determining who should scan
fingerprints, where and who should review information about applicants
returned from IDENT, and technical requirements for the IDENT system, and
have not provided comprehensive guidance for consular posts on how the
information about visa applicants made available through the Biometric
Visa Program should be used to help adjudicate visas. State consular
officers using IDENT face a range of issues without such guidance,
including the following:

o 	Workflow management: the time, place, and person responsible for
collecting fingerprints and reviewing IDENT responses on applicants. At
some posts, staff other than the interviewing officer take the
fingerprints of visa applicants, but some interviewing officers told us
that they prefer to take prints from those that they interview to ensure
accountability. While Santo Domingo has designated a window to scan
applicants' prints prior to the interview, sometimes that window may be
needed for interviews during heavy volume. Both San Salvador and

12The most common reason for denial of a visa is that the applicant
intends to come to the United States and remain. Section 214(b) of the
U.S. Immigration and Nationality Act (INA) presumes that every alien
(other than a nonimmigrant) is an immigrant until he or she establishes
eligibility for nonimmigrant status under the INA. See 8 U.S.C. S:1184(b)
and 8 U.S.C. S:1101(a)(15).

Santo Domingo have designated an officer to review and clear all hit
information on applicants, so some interviewing officers do not look at
IDENT responses for those they interview.

o 	Information availability: the information available to the consular
officers and how easily it can be accessed. We observed that a line on the
interviewers' computer screens notified them with a "Hit" or "N/R" when
information on an applicant was returned from IDENT. The officers open a
screen that displays IDENT information to learn more about the hit-for
example, was it a previous entry into the United States where prints and
photograph were taken or derogatory criminal information? While the former
might corroborate an applicant's story, the latter may indicate grounds
for refusing a visa.

o 	System requirements: the IDENT turnaround time necessary to ensure
timely visa issuance. For example, if a designated officer will review all
the IDENT information, and posts are no longer issuing same-day visas, an
IDENT response time of up to a few hours may be acceptable.

Because they lack specific guidance on the system's use, consular officers
at overseas posts are unclear as to how they should implement the
Biometric Visa Program and are currently using the returned IDENT
responses in nonuniform ways. For example, we found that, in cases where
the IDENT response information is available to the overseas post by the
time of the interview, some consular officers review information before
the interview, some review it during the interview, and some do not review
it at all, relying on a designated officer or the line chief to review the
information after the interview is completed and before affected visas are
printed. (See fig. 2.) One State official noted that key information about
an applicant could be overlooked if the interviewing officer was not the
same officer who reviews the IDENT information, such as the timing and
frequency of prior visits to the United States.

Figure 2: Potential Timing of IDENT Response on Visa Applicants

Source: GAO analysis of State consular process.

In September 2003, we identified the US-VISIT program as a high-risk
endeavor.13 We reported that an operation such as US-VISIT requires an
operational context-or "enterprise architecture"-that is, a program design
that sets out the key program decisions, such as what functions are to be
performed and by whom, when and where they are to be performed, what
information is to be used to perform them, and what rules and standards
will govern the application of technology to support them. In the absence
of an enterprise architecture, certain policy and standards information
necessary to effectively define, establish, and implement the US-VISIT
program was not available.

In the same report, we recommended that DHS establish an advisory board
comprising representatives from key US-VISIT federal stakeholder
organizations that would oversee US-VISIT management including overall

Enterprise Architecture Program Design Lacking for US-VISIT

13See GAO, Homeland Security: Risks Facing Key Border and Transportation
Security Program Need to Be Addressed, GAO-03-1083 (Washington, D.C.:
Sept. 19, 2003).

vision and strategic direction. This board was created and has been
operational since January 26, 2004, but has not yet provided stakeholder
agencies with a clearly defined vision and operational context for the
various components under US-VISIT. For example, DHS awarded a contract in
June that includes developing a detailed Program Plan for US-VISIT that
would focus on such areas as business functionality, information
technology strategy, facilities strategy, and implementation. State
officials indicated that they are waiting for DHS to articulate its vision
on these areas, which would guide further State actions on the Biometric
Visa Program.

In our current review, we found that the lack of a clear enterprise
architecture, or operational context, for US-VISIT affects State's
Biometric Visa Program, which, although administered by State, falls under
the overall visa policy area of the DHS Directorate of Border and
Transportation Security. In the absence of a cohesive vision defined by
DHS and State for using the information available through the Biometric
Visa Program, State will have difficulty providing guidance and technical
requirements for IDENT response time and determining optimal workflow
processes to enable users to maximize the program's effectiveness.

In May 2004, we reported14 that designing, developing, and implementing a
biometrics program requires consideration of factors such as how the
technology will be used, cost-benefit analysis, trade-offs between the
increased security that the use of biometrics would provide, and the
effect on areas such as privacy and convenience. For a biometric security
program, the high-level goals of the program need to be defined, and the
concept of operations that will embody the people, process, and
technologies required to achieve these goals needs to be developed.

Potential Program Uses and The Biometric Visa Program has the potential to
be a powerful tool for

Related Issues	protecting the nation's borders, while facilitating
legitimate travel to the United States. The program can enhance the
integrity of U.S. visas, provide a "safety net" for consular officers to
ensure that they catch individuals who have been watchlisted, and equip
consular posts as "forward based defense." However, there is no
comprehensive guidance that articulates the program's many potential uses
and provides guidance to consular officers on how best to implement them.

14GAO, Aviation Security: Challenges in Using Biometric Technologies,
GAO-04-785T (Washington, D.C.: May 19, 2004).

o 	Through the collection of fingerprints at consular posts and their
transmission to IDENT, the program ensures that biometric data on all visa
applicants becomes part of the DHS US-VISIT database. According to State
and DHS, this process enhances the integrity of U.S. visas by ensuring
that the same person who applies for a visa is the one who enters the
United States using that visa.15 In May 2004, GAO reported16 that
biometric programs depend on accurate processes for the initial collection
and verification of applicants' identities and biometrics. To date,
however, State has not clarified guidance for important aspects of
scanning fingerprints. The interviewing officers in San Salvador noted
that assisting applicants to understand the fingerprinting process (for
example, how to place their fingers on the scanners) sometimes led them to
give the applicants more time in their interviews than previously. In
addition, some officers noted that the mechanics of taking the prints
interrupted the flow of the interview, and officers lost some of the key
first impressions that helped them make adjudication decisions. Some felt
that having someone beside the interviewing officer collect the prints
helped to speed the process and enable interviewing officers to conduct
the interviews.

o 	The program can also provide a "safety net" for visa decisions to catch
those on the watch list. State is already using the program in this way,
as noted earlier, in the case where the interviewing officer initially
approved an applicant for a visa, but the visa was not issued when IDENT
returned derogatory information. State does not have a specific category
designated for refusing visas due to derogatory information returned by
IDENT and, therefore, State could not provide data on the total number of
such refusals. Many of the 18 adjudicating officers we interviewed at the
consular posts in San Salvador and Santo Domingo indicated that they liked
having the information available from the IDENT database, which may have
additional information on potential immigration violations or criminal
records that they can review prior to visa issuance.

15DHS currently does not have information on individuals apprehended at
ports of entry when their prints and photographs did not match those
captured at the consular posts for the visa they were using. On July 19,
2004, DHS implemented a system to assist in identifying such cases and
will have better information in the future.

16GAO-04-785T.

o 	The program has the potential to equip consular posts as "forward based
defense" to prevent potential terrorists and problematic or other
questionable travelers from entering the United States. Along with the
watch list information, the response from the DHS IDENT database also
includes information on travelers' entries to the United States that have
been obtained by the US-VISIT program at major seaports and land ports,
including photographs, fingerprint records, and date and time of each
entry. This information can establish an applicant's travel patterns,
which could help to inform interviewing officers. For example, in San
Salvador we observed that the IDENT record on one applicant showed that
she had entered the United States a number of times over the past several
months. Since we had observed the interviewing throughout the day, we knew
that this woman was a flight attendant, and the IDENT record corroborated
her story. However, the officer who reviewed her IDENT record was not the
same one who interviewed her earlier in the day, so the information meant
little to him, but he cleared her visa for issuance regardless. According
to State, consular officers are trained to use the best information
available to them to make the best decision as early as possible in the
information chain, but interviewing officers are not currently required to
review applicants' IDENT information. Had the interviewing officer
reviewed this applicant's IDENT response, he or she would have seen the
US-VISIT photographs of the applicant in her uniform, verifying both her
identity and her legitimate need for a visa.

According to a senior State official, the department envisions that as the
program matures, the information it provides on visa applicants may prove
increasingly useful for adjudicating officers. However, he acknowledged
that the department's current focus is compliance with the legislated
requirement to implement the Biometric Visa Program by October 26, 2004;
as a result, State has not fully developed policies and guidance in
advance of the program's implementation.

Conclusions	At the cost of some $162 million, the new Biometric Visa
Program coupled with the DHS US-VISIT program has, according to State,
improved the integrity of the visa process and has potential to better
identify visa applicants and travelers of concern to U.S. law enforcement,
while also facilitating travel by legitimate travelers. Although State's
rollout of the technology aspects of the Biometric Visa Program has
exceeded expectations regarding schedule and technical issues, the lag in
guidance has resulted in consular officers at overseas posts being unclear
as to how they are to use the available IDENT information on applicants.
In the

absence of guidance on how the information available through the program
is to be used, consular posts are not able to identify optimal workflow
arrangements, facility setup, and staffing issues that may be necessary
for interviewing officers to make visa decisions and to process visas
efficiently and effectively. We raise these issues so that facility and
resource issues can be better addressed as the program is implemented.

  Recommendations for Executive Action

GAO is making two recommendations in this report:

o 	We recommend that the Secretaries of Homeland Security and State
develop and provide comprehensive guidance to consular posts that includes
direction to consular officers on how to best implement the Biometric Visa
Program. The guidance should address the planned uses for the Biometric
Visa Program at consular posts including directions to consular officers
on when in the visa process prints are to be scanned and when and how
information from the IDENT database on visa applicants should be
considered by consular officers during their interviews. In developing the
guidance, State and DHS should consider factors such as program security
goals, resources in terms of personnel and costs, response times, and the
burden on the applicant.

o 	We also recommend that the Secretary of State direct each consular post
to develop an implementation plan based on this guidance.

  Agency Comments and Our Evaluation

We provided a draft of this report to the Departments of Homeland Security
and State for their comment. Their comments, along with our responses to
specific points, are reprinted in appendixes I and II, respectively.

The Department of Homeland Security said that it generally concurred with
the report and our recommendations and that GAO's identification of areas
where improvements are needed in the Biometric Visa Program will
contribute to ongoing efforts to strengthen the visa process. The State
Department acknowledged that there may be a lag in guidance and that this
may be inevitable given the rapid implementation of this program. Both
departments noted that the consular posts have been permitted flexibility
in implementing the program to account for personnel and facility
limitations. While we understand these resource concerns, we believe it is
important that the departments reach agreement and provide guidance to
consular posts on how information made available to consular posts

through the Biometric Visa Program is intended to be used to help consular
officers adjudicate visas. With this guidance, consular posts would be
able to better assess personnel and facility constraints and develop
specific plans to better implement the program, including requesting
additional resources if necessary. In addition, both departments provided
further information on what they have done to implement the program and
its accomplishments.

  Scope and Methodology

To assess State's implementation of the Biometric Visa Program for
nonimmigrant visas, including the program's progress and how State plans
to use it, we interviewed State officials and reviewed their schedule for
rollout. We also visited the DHS Biometric Support Center to observe the
fingerprint expert backup for IDENT analysis and interviewed DHS officials
on their roles in support of State's visa program. We obtained data from
State and DHS on IDENT response times and reviewed State's methodology for
collecting and reporting this information. We determined that the data
reliability was sufficient for our reporting purposes. We performed
fieldwork at consular posts in San Salvador, El Salvador, and Santo
Domingo, Dominican Republic. According to State, these two highvolume
posts process visa applicants from both rural and urban populations-a
classification that represents extremes in the visa applicant pool better
than variation across world geographic regions. We observed the visa
process incorporating the collection of biometric fingerprints, review of
IDENT response information, and clearance of hits for visa printing. We
conducted our work between April and August 2004 in accordance with
generally accepted government auditing standards.

We are sending copies of this report to interested Members of Congress,
the Secretary of State, and the Secretary of Homeland Security. We also
will make copies available to others upon request. In addition, the report
will be available at no charge on the GAO Web site at http://www.gao.gov.

If you or your staff has any questions concerning this report, please
contact
me at (202) 512-4128 or at [email protected]. Key contributors to this report
were John Brummet, Sharron Candon, Jeanette Espinola, Jon Fremont,
Janey Cohen, and Martin de Alteriis.

Jess T. Ford Director, International Affairs and Trade

Appendix I

Comments from the Department of Homeland Security

Note: GAO comments supplementing those in the report text appear at the
end of this appendix.

See comment 1.

See comment 2.

Appendix I Comments from the Department of Homeland Security

Appendix I Comments from the Department of Homeland Security

          Appendix I Comments from the Department of Homeland Security

The following are GAO's comments on the Department of Homeland Security's
letter dated August 24, 2004.

  GAO Comments 1.

2.

We adjusted our wording throughout the report to clarify that our
observations and recommendations are focused on the need for comprehensive
guidance on how information available through the program is to be used by
consular officers and not on the overall policy framework for US-VISIT and
the Biometric Visa Program.

While we understand posts' resource concerns, we believe it is important
that the departments reach agreement and provide guidance to consular
posts on how information on applicants that is available through the
Biometric Visa Program is intended to be used to help consular officers
adjudicate visas. With this guidance, consular posts would be able to
better assess personnel and facility constraints and develop specific
plans to better implement the program, including requesting additional
resources if necessary.

                                  Appendix II

                     Comments from the Department of State

Note: GAO comments supplementing those in the report text appear at the
end of this appendix.

Appendix II
Comments from the Department of State

                                 See comment 1.

Appendix II
Comments from the Department of State

                                 See comment 2.

                                 See comment 1.

                                 See comment 3.

Appendix II
Comments from the Department of State

                                 See comment 2.

Appendix II
Comments from the Department of State

                                 See comment 2.

                                 See comment 3.

Appendix II
Comments from the Department of State

                                  Appendix II
                     Comments from the Department of State

The following are GAO's comments on the Department of State's letter dated
August 18, 2004.

  GAO Comments 1.

2.

3.

We adjusted our wording throughout the report to clarify that our
observations and recommendations are focused on the need for comprehensive
guidance on how information available through the program is to be used by
consular officers and not on the overall policy framework for US-VISIT and
the Biometric Visa Program.

State has provided some guidance telegrams to posts over the course of the
implementation of the Biometric Visa Program, including two telegrams sent
to posts in July following GAO fieldwork at two overseas consular posts in
May. The telegrams include guidance on such areas as moving away from
same-day visa issuance toward mail or courier visa delivery to applicants,
how to fix potential misidentifications for applicants' fingerprints, and
clarifications on FBI information available in watch list IDENT returns.
However, these telegrams do not include guidance on certain key items we
have identified, for example (1) how data on applicants' travel patterns
and/or previous enrollment in the database should be considered by
adjudicating officers and (2) who should review and clear information
returned from IDENT on applicants prior to visa issuance. Guidance on such
issues could help set parameters for consular posts to most effectively
implement the program and help them identify resource or facility
constraints that might impair the program's full and effective
implementation.

While we understand posts' resource concerns, we believe it is important
that the departments reach agreement and provide guidance to consular
posts on how information on applicants that is available through the
Biometric Visa Program is intended to be used to help consular officers
adjudicate visas. With this guidance, consular posts would be able to
better assess personnel and facility constraints and develop specific
plans to better implement the program, including requesting additional
resources if necessary.

GAO's Mission	The Government Accountability Office, the audit, evaluation
and investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the performance
and accountability of the federal government for the American people. GAO
examines the use of public funds; evaluates federal programs and policies;
and provides analyses, recommendations, and other assistance to help
Congress make informed oversight, policy, and funding decisions. GAO's
commitment to good government is reflected in its core values of
accountability, integrity, and reliability.

Obtaining Copies of The fastest and easiest way to obtain copies of GAO
documents at no cost

is through GAO's Web site (www.gao.gov). Each weekday, GAO postsGAO
Reports and newly released reports, testimony, and correspondence on its
Web site. To Testimony have GAO e-mail you a list of newly posted products
every afternoon, go to

www.gao.gov and select "Subscribe to Updates."

Order by Mail or Phone	The first copy of each printed report is free.
Additional copies are $2 each. A check or money order should be made out
to the Superintendent of Documents. GAO also accepts VISA and Mastercard.
Orders for 100 or more copies mailed to a single address are discounted 25
percent. Orders should be sent to:

U.S. Government Accountability Office 441 G Street NW, Room LM Washington,
D.C. 20548

To order by Phone:	Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202)
512-6061

  To Report Fraud, Contact:
  Waste, and Abuse in Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: [email protected] Programs Automated answering system: (800)
424-5454 or (202) 512-7470

Congressional	Gloria Jarmon, Managing Director, [email protected] (202)
512-4400 U.S. Government Accountability Office, 441 G Street NW, Room 7125

Relations Washington, D.C. 20548

Public Affairs	Jeff Nelligan, Managing Director, [email protected] (202)
512-4800 U.S. Government Accountability Office, 441 G Street NW, Room 7149
Washington, D.C. 20548

                               Presorted Standard
                              Postage & Fees Paid
                                      GAO
                                Permit No. GI00

United States
Government Accountability Office
Washington, D.C. 20548-0001

Official Business
Penalty for Private Use $300

Address Service Requested
*** End of document. ***