Homeland Security: Some Progress Made, but Many Challenges Remain
on U.S. Visitor and Immigrant Status Indicator Technology Program
(23-FEB-05, GAO-05-202).					 
                                                                 
The Department of Homeland Security (DHS) has established a	 
program--the U.S. Visitor and Immigrant Status Indicator	 
Technology (US-VISIT)--to collect, maintain, and share		 
information, including biometric identifiers, on selected foreign
nationals who travel to the United States. By congressional	 
mandate, DHS is to develop and submit for approval an expenditure
plan for US-VISIT that satisfies certain conditions, including	 
being reviewed by GAO. Among other things, GAO was asked to	 
determine whether the plan satisfied these conditions and to	 
provide observations on the plan and DHS's program management.	 
-------------------------Indexing Terms------------------------- 
REPORTNUM:   GAO-05-202 					        
    ACCNO:   A18136						        
  TITLE:     Homeland Security: Some Progress Made, but Many	      
Challenges Remain on U.S. Visitor and Immigrant Status Indicator 
Technology Program						 
     DATE:   02/23/2005 
  SUBJECT:   Immigrants 					 
	     Immigration information systems			 
	     Immigration or emigration				 
	     National defense operations			 
	     National preparedness				 
	     Program evaluation 				 
	     Program management 				 
	     Strategic planning 				 
	     Data collection					 
	     Biometrics 					 
	     Border security					 
	     Homeland security					 
	     DHS Visitor and Immigrant Status			 

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Product.                                                 **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************
GAO-05-202

     

     * Contents
          * Compliance with Legislative Conditions
          * Status of Open Recommendations
          * Observations on the Expenditure Plan
          * Conclusions
          * Recommendations for Executive Action
          * Agency Comments
     * Briefing to the Staffs of the Subcommittees on Homeland Security,
       Senate and House Committees on Appropriations
     * Comments from the Department of Homeland Security
     * GAO Contact and Staff Acknowledgments
          * GAO Contact
          * Staff Acknowledgments

                 United States Government Accountability Office

GAO Report to Congressional Committees

February 2005

HOMELAND SECURITY

  Some Progress Made, but Many Challenges Remain on U.S. Visitor and Immigrant
                      Status Indicator Technology Program

                                       a

GAO-05-202

[IMG]

February 2005

HOMELAND SECURITY

Some Progress Made, but Many Challenges Remain on U.S. Visitor and Immigrant
Status Indicator Technology Program

                                 What GAO Found

DHS's fiscal year 2005 expenditure plan and related documentation at least
partially satisfied all conditions established by the Congress, including
meeting the capital planning and investment control requirements of the
Office of Management and Budget (OMB). For example, DHS has developed a
plan and a process for developing, implementing, and institutionalizing a
program to manage risk.

In its observations about the expenditure plan and DHS's management of the
program, GAO recognizes accomplishments to date and addresses the need for
rigorous and disciplined program practices. For example, US-VISIT has
acquired the services of a prime integration contractor to augment its
ability to complete US-VISIT. However, DHS has not employed rigorous,
disciplined processes typically associated with successful programs, such
as tracking progress against commitments. More specifically, the fiscal
year 2005 plan does not describe progress against commitments made in
previous plans (e.g., capabilities, schedule, cost, and benefits).
According to GAO's analysis, delays have occurred in delivering capability
to track the entry and exit of persons entering the United States at air,
land, and sea ports of entry; the figure compares original and current
commitments in this effort, as well as progress in delivering capability.
Such information is essential for oversight.

DHS Fiscal Year 2003 and 2004 Commitments Compared with Current
Commitments and Reported Progress in Delivering Capabilities

Source: US-VISIT, GAO (analysis).

Additionally, the effort to pilot alternatives for delivering the
capability to track the departure of persons exiting the United States is
faced with a compressed time line, missed milestones, and potentially
reduced scope. In particular, the pilot evaluation period has been reduced
from 3 to 2 months, and as of early November 2004, the alternatives were
deployed and operating in only 5 of the 15 ports of entry scheduled to be
operational by November 1, 2004. According to US-VISIT officials, this is
largely due to delays in DHS granting security clearances to the civilian
employees who would operate the equipment at the ports of entry. These
changing facts and circumstances surrounding the pilot introduce
additional risk concerning US-VISIT's delivery of promised capabilities
and benefits on time and within budget.

                 United States Government Accountability Office

Contents

                                    Letter 1

Compliance with Legislative Conditions 2

Status of Open Recommendations 2

Observations on the Expenditure Plan 9

Conclusions 11

Recommendations for Executive Action 12

Agency Comments 13

Appendixes

Appendix I:Briefing to the Staffs of the Subcommittees on Homeland
Security, Senate and House Committees on Appropriations 14

Appendix II: Comments from the Department of Homeland Security 135

Appendix III:GAO Contact and Staff Acknowledgments 137
GAO Contact 137
Staff Acknowledgments 137

Contents

Abbreviations

ACE Automated Commercial Environment
ADIS Arrival Departure Information System
APIS Advance Passenger Information System
APMO Acquisition and Program Management Office
BIF Biometric Information File
CCD Consular Consolidated Database
CLAIMS 3 Computer Linked Application Information Management System
DHS Department of Homeland Security
EA enterprise architecture
IDENT Automated Biometric Identification System
NIIS I-94/Non-Immigrant Information System
NIST National Institute of Standards and Technology
OMB Office of Management and Budget
OPM Office of Personnel Management
POE port of entry
SA-CMM Software Acquisition Capability Maturity Model
SEI Software Engineering Institute
SEVIS Student Exchange Visitor Information System
TECS Treasury Enforcement Communications Systems
US-VISIT U.S. Visitor and Immigrant Status Indicator Technology

WSA Work Station Attendant

This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed in
its entirety without further permission from GAO. However, because this
work may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this material
separately.

A

United States Government Accountability Office Washington, D.C. 20548

February 23, 2005

The Honorable Thad Cochran Chairman The Honorable Robert C. Byrd Ranking
Minority Member Committee on Appropriations United States Senate

The Honorable Jerry Lewis Chairman The Honorable David R. Obey Ranking
Minority Member Committee on Appropriations House of Representatives

Pursuant to the Department of Homeland Security Appropriations Act, 2005,1
the Department of Homeland Security (DHS) submitted to the Congress in
October 2004 its fiscal year 2005 expenditure plan for the U.S. Visitor
and Immigrant Status Indicator Technology (US-VISIT) program. US-VISIT is
a governmentwide program to collect, maintain, and share information on
foreign nationals. The program's goals are to enhance the security of U.S.
citizens and visitors, facilitate legitimate trade and travel, ensure the
integrity of the U.S. immigration system, and protect the privacy of U.S.
visitors. As required by the appropriations act, we reviewed US-VISIT's
fiscal year 2005 expenditure plan. Our objectives were to (1) determine
whether the expenditure plan satisfies certain legislative conditions, (2)
determine the status of our US-VISIT open recommendations,2 and (3)
provide any other observations about the expenditure plan and DHS's
management of US-VISIT.

1Pub. L. 108-334 (Oct. 18, 2004).

2Our previous recommendations regarding US-VISIT's expenditure plans were
published in GAO, Information Technology: Homeland Security Needs to
Improve Entry Exit System Expenditure Planning, GAO-03-563 (Washington,
D.C.: June 9, 2003); Homeland Security: Risks Facing Key Border and
Transportation Security Program Need to Be Addressed, GAO-03-1083
(Washington, D.C.: Sept. 19, 2003); and Homeland Security: First Phase of
Visitor and Immigration Status System Operating, but Improvements Needed,
GAO-04 586 (Washington, D.C.: May 11, 2004).

work. The full briefing, including our scope and methodology, is reprinted
as appendix I.

  Compliance with Legislative Conditions

DHS satisfied or partially satisfied each of the applicable legislative
conditions specified in the appropriations act. In particular, the plan,
including related program documentation and program officials' statements,
satisfied or provided for satisfying all key aspects of federal
acquisition rules, requirements, guidelines, and systems acquisition
management practices. Additionally, the plan partially satisfied the
conditions that specified (1) compliance with the capital planning and
investment review requirements of the Office of Management and Budget
(OMB), (2) compliance with DHS's enterprise architecture, and (3) the
plan's review and approval by DHS's Investment Review Board, the Secretary
of Homeland Security, and OMB.

  Status of Open Recommendations

DHS has completely implemented, has partially implemented, is in the
process of implementing, or plans to implement all the remaining
recommendations contained in our reports on the fiscal years 2002, 2003,
and 2004 expenditure plans. Each recommendation, along with its current
status, is summarized below:

o  Develop a system security plan and privacy impact assessment.

The department has partially implemented this recommendation. First, the
US-VISIT program has developed a security plan that provides an overview
of system security requirements, describes the controls in place or
planned for meeting those requirements, and refers to the applicable
documents that prescribe the roles and responsibilities for managing the
US-VISIT component systems. However, a security risk assessment of the
program has not been completed, and the plan does not include a date for
the assessment's completion. Second, the US-VISIT program has completed a
privacy impact assessment for Increment 2. However, the assessment does
not satisfy all aspects of OMB guidance for such an assessment, such as
fully addressing privacy issues in relevant system documentation.

o  Develop and implement a plan for satisfying key acquisition management
controls, including acquisition planning, solicitation, requirements
development and management, project management, contract tracking and
oversight, evaluation, and transition to support, and implement the
controls in accordance with the Software Engineering Institute's (SEI)
guidance.3

The department is in the process of implementing this recommendation. The
US-VISIT Acquisition and Program Management Office has initiated a process
improvement program and drafted a process improvement plan. The office has
also developed processes or plans, some of which are approved and some of
which are in draft, for all except one of SEI's Software Acquisition
Capability Maturity Model (SA-CMM(R)) Level 24 key process areas.

o  Ensure that future expenditure plans are provided to the department's
House and Senate Appropriations Subcommittees in advance of US-VISIT funds
being obligated.

With respect to the fiscal year 2005 expenditure plan, DHS implemented
this recommendation by providing the plan to the Senate and House
Subcommittees on October 19, 2004.

o  Ensure that future expenditure plans fully disclose US-VISIT system
capabilities, schedule, cost, and benefits to be delivered.

The department has partially implemented this recommendation. The
expenditure plan identifies high-level capabilities and high-level
schedule estimates. It also identifies the amounts budgeted for each
increment for fiscal years 2003 through 2005, but it does not associate
this funding with specific capabilities and benefits. Further, while the
plan identifies several benefits and associates these benefits with
increments, it does not include any information on related metrics or on
progress against achieving any of the benefits.

3Carnegie Mellon University SEI, Software Acquisition Capability Maturity
Model(R), Version 1.03 (March 2002), defines acquisition process
management controls for planning, managing, and controlling
software-intensive system acquisitions.

4The SA-CMM ranks organizational maturity according to five levels. Levels
2 through 5 require verifiable existence and use of certain key processes.

o  Ensure that future expenditure plans fully disclose how the US-VISIT
acquisition is being managed.

The department is in the process of implementing this recommendation. The
fiscal year 2005 plan describes some activities being employed to manage
the US-VISIT acquisition, such as the governance structure, program office
organizational structure, and staffing levels. However, the department
does not describe how other important aspects of the program are being
managed, such as testing, system capacity, and system configuration.

o  Ensure that human capital and financial resources are provided to
establish a fully functional and effective program office.

The department has partially implemented this recommendation. As of
October 2004, US-VISIT had filled 59 of its 115 government positions, with
plans to fill about half the vacant positions once security clearances
have been completed. As of November 2004, the program office had filled 88
of a planned 117 contractor positions. The expenditure plan indicates that
DHS has budgeted $83 million to maintain the US-VISIT program management
structure and baseline operations.

o  Clarify the operational context in which US-VISIT is to operate.

The department is in the process of implementing this recommendation. In
September 2003, DHS released version 1.0 of its enterprise architecture.
We reviewed version 1.0 and found that it is missing, either partially or
completely, all the key elements expected in a well-defined architecture,
such as descriptions of business processes, information flows among these
processes, and security rules associated with these information flows.
Since we reviewed version 1.0 of the architecture, DHS has drafted version
2.0. We have not reviewed version 2.0.

o  Determine whether proposed US-VISIT increments will produce mission
value commensurate with cost and risks.

The department is in the process of implementing this recommendation.
US-VISIT developed a cost-benefit analysis for Increment 2B,5 but it is
unclear whether this increment will produce mission value commensurate
with cost and risk. For example, the analysis addresses only government
costs and does not address potential nongovernmental costs. Further, the
analysis identifies three alternatives and identifies the third
alternative as the preferred choice. However, US-VISIT is pursuing an
alternative more closely aligned with alternative 2, because alternative 3
was considered too ambitious to meet statutorily required time lines.

o  Define US-VISIT program office positions, roles, and responsibilities.

The department has partially implemented this recommendation. US-VISIT has
developed descriptions for positions within each office, and working with
the Office of Personnel Management (OPM), it has drafted a set of core
competencies that define the knowledge, skills, abilities, and other
competencies needed for successful employee performance.

o  Develop and implement a human capital strategy for the US-VISIT program
office that provides for staffing positions with individuals who have the
appropriate knowledge, skills, and abilities.

The department has partially implemented this recommendation. The US-VISIT
program office, in conjunction with OPM, has drafted a Human Capital Plan.
The plan includes an action plan that identifies activities, proposed
completion dates, and the organization responsible for completing these
activities. The program office has completed some of the activities called
for in the plan, including the designation of a liaison responsible for
ensuring alignment between DHS and US-VISIT human capital policies.

5Increment 2B includes the electronic collection and matching of
biographic and biometric information for foreign nationals entering the
United States at the 50 busiest land ports of entry. DHS had planned to
deploy this increment by December 2004.

o  Develop a risk management plan and report all high risks and their
status to the executive body on a regular basis.

The department has partially implemented this recommendation. The US-VISIT
program office has developed a risk management plan and process and has
established a governance structure involving three primary groups-the Risk
Review Board, Risk Review Council, and Risk Management Team. The Risk
Review Board represents the highest level of risk management within the
program and is composed of senior level staff, such as the program
director and functional area directors. However, US-VISIT has not reported
high risks beyond this board.

o  Define performance standards for each US-VISIT program increment that
are measurable and reflect the limitations imposed by relying on existing
systems.

The department is in the process of implementing this recommendation. The
US-VISIT program office has defined some technical performance
measures-such as availability, timeliness, and output quantity-for
Increments 1 and 2B, but it has not defined others, such as reliability,
resource utilization, and scalability. Additionally, US-VISIT systems
documentation does not contain sufficient information to determine the
limitations imposed by US-VISIT's reliance on existing systems that have
less demanding performance requirements, such as the 98.0 percent
availability of the Treasury Enforcement Communications Systems.6

o  Develop and approve test plans before testing begins. These test plans
should (1) specify the test environment; (2) describe each test to be
performed, including test controls, inputs, and expected outputs; (3)
define the test procedures to be followed in conducting the tests; and (4)
provide traceability between test cases and the requirements to be
verified by the testing.

The department is in the process of implementing this recommendation.
According to the US-VISIT Systems Assurance Director, the Increment 2B
system acceptance test plan was approved on October 15, 2004. However, no
documentation was provided that explicitly indicated the approval of

6The Treasury Enforcement Communications Systems is a system that
maintains lookout (i.e., watch list) data, interfaces with other agencies'
databases, and is currently used by inspectors at ports of entry to verify
traveler information and update traveler data.

the plan. Further, the test plan did not fully address the test
environment, include descriptions of tests to be performed, or provide
test procedures to be followed in conducting the tests. The plan also did
not provide traceability between test cases and the requirements to be
verified by the testing. For example, 15 of the 116 requirements did not
have test cases, and 2 requirements were labeled "not testable."

o  Ensure the independence of the Independent Verification and Validation
(IV&V) Contractor.

The department is in the process of implementing this recommendation. The
US-VISIT Information Technology (IT) Management Office is developing
high-level requirements for IV&V, including a strategy and statement of
work for acquiring an IV&V contractor.

o  Implement effective configuration management practices, including
establishing a US-VISIT change control board to manage and oversee system
changes.

The department plans to implement this recommendation. The US-VISIT
program office has not yet developed or implemented US-VISIT-level
configuration management practices or a change control board. The office
has developed a draft configuration management plan that describes key
configuration management activities that are to be defined and
implemented, such as defining and identifying processes and products to be
controlled and recording and monitoring changes to the controlled items.
The draft plan also proposes a governance structure, including change
control boards.

o  Identify and disclose management reserve funding embedded in the fiscal
year 2004 expenditure plan to the Appropriations Subcommittees.

The department has implemented this recommendation. The US-VISIT program
office reported management reserve funding of $33 million for fiscal year
2004 in a briefing to the Subcommittees on Homeland Security, Senate and
House Committees on Appropriations.

o  Ensure that all future US-VISIT expenditure plans identify and disclose
management reserve funding.

With respect to the fiscal year 2005 expenditure plan, DHS implemented
this recommendation. The fiscal year 2005 plan specified management
reserve funding of $23 million.

o  Assess the full impact of Increment 2B on land ports of entry workforce
levels and facilities, including performing appropriate modeling
exercises.

The department has partially implemented this recommendation. The US-VISIT
program office conducted an analysis to help determine the impact of
Increment 2B on workforce and travelers. According to program officials,
additional staff will not be needed to implement this increment at the
land borders. In addition, the US-VISIT program office has conducted space
utilization surveys at all of the 166 land ports of entry and has
completed survey reports at 16 of the 50 busiest land ports of entry, with
the remaining 34 reports planned to have been completed in the fall of
2004. Although the survey reports indicated that most of the ports
reviewed were at or near capacity and that facilities had no room for
expansion, the program office maintains that Increment 2B will not require
expansion of any facilities and will only require minor modifications.

o  Develop a plan, including explicit tasks and milestones for
implementing all our open recommendations and periodically report to the
DHS Secretary and Under Secretary on progress in implementing this plan;
also report this progress, including reasons for delays, in all future
US-VISIT expenditure plans.

The Department is in the process of implementing this recommendation. The
US-VISIT program office has developed a report for tracking the status of
our open recommendations. This report is shared with the program office
director but is not shared with the Secretary and Under Secretary.

  Observations on the Expenditure Plan

Our observations recognize accomplishments to date and address the need
for rigorous and disciplined program management practices relating to
describing progress against commitments, managing the exit alternatives
pilot, managing system capacity, and estimating cost, as well as
collaborating with DHS's Automated Commercial Environment (ACE) program.7
An overview of specific observations follows:

o  The program office has acquired the services of a prime integration
contractor to augment its ability to complete US-VISIT. On May 28, 2004,
and on schedule, DHS awarded a contract for integrating existing and new
business processes and technologies to a prime contractor and its related
partners.

o  The fiscal year 2005 expenditure plan does not describe progress
against commitments made in previous plans. Although this is the fourth
US-VISIT expenditure plan, it does not describe progress against
commitments made in the previous three plans. For example, the fiscal year
2004 plan committed to analyzing, field testing, and initiating deployment
of alternative approaches for capturing biometrics during the exit process
at air and sea ports of entry. However, while the fiscal year 2005 plan
states that US-VISIT was to expand its exit pilot sites during the summer
and fall of 2004 and deploy the exit solution during fiscal year 2005, it
does not explain the reason for the change or its potential impact.
Additionally, the fiscal year 2004 plan stated that $45 million in fiscal
year 2004 was to be used for exit activities. However, the fiscal year
2005 plan states that $73 million in fiscal year 2004 funds were to be
used for exit activities, but it does not highlight this difference or
address the reason for the change in amounts.

o  The exit capability alternatives are faced with a compressed time line,
missed milestones, and potentially reduced scope. In January 2004,
US-VISIT deployed an initial exit capability as a pilot to two ports of
entry, while simultaneously developing other exit alternatives. The May
2004 Exit Pilot Evaluation Plan stated that all exit pilot evaluation
tasks were to be completed by September 2004. The plan allotted about 3
months to conduct the evaluation and report the results. However, an
October 2004 schedule indicated that all exit pilot evaluation tasks were
to be

7ACE is a new trade processing system planned to support the movement of
legitimate imports and exports and strengthen border security.

completed between late October 2004 and December 2004, which is about a
2-month evaluation and reporting period. As of early November 2004, exit
alternatives were deployed and operating in only 5 of the 15 ports of
entry that were scheduled to be operational by November 1, 2004. According
to program implementation officials, this was because of delays in DHS
granting security clearances to the civilian employees who would operate
the equipment at the ports of entry.

Additionally, the Evaluation Execution Plan describes the sample size of
outbound passengers required to be evaluated at each port. This sample
size will produce a specified confidence level in the evaluation results.
Because of the reduced evaluation time frame, the program still plans to
collect the desired sample size at each port by adding more personnel to
the evaluation teams if needed. These changing facts and circumstances
surrounding the exit pilot introduce additional risk concerning US-VISIT's
delivery of promised capabilities and benefits on time and within budget.

o  US-VISIT and ACE collaboration is moving slowly. In February 2003, we
recognized the relationship between US-VISIT and ACE and recommended steps
to promote close collaboration between these two programs. Since then,
US-VISIT and ACE managers have met to identify potential areas for
collaboration between the two programs and to clarify how the programs can
best support the DHS mission and provide officers with the information and
tools they need. However, explicit plans have not been developed nor
actions taken to understand US-VISIT/ACE dependencies and relationships.
Because both programs are making decisions on how to further define,
design, develop, and implement these systems, it is important that they
exploit their relationships to reduce rework that might be needed to
integrate the programs.

o  US-VISIT system capacity is being managed in a compartmentalized
manner. Currently, DHS does not have a capacity management program.8
Instead, the US-VISIT IT Management Office relies on the respective
performance management activities of the pre-existing systems, such as
those managed by U.S. Customs and Border Protection and U.S. Immigration
and Customs Enforcement. Until US-VISIT has

8Capacity management is intended to ensure that systems are properly
designed and configured for efficient performance and have sufficient
processing and storage capacity for current, future, and unpredictable
workload requirements.

developed a comprehensive performance management and capacity planning
program, the program will continue to be reactive in its efforts to ensure
that US-VISIT system resources are sufficient to meet current workloads,
increasing the risk that it may not be able to adequately support mission
needs.

o  The cost estimating process used for Increment 2B did not follow some
key best practices. The US-VISIT cost estimate did not fully satisfy most
of the criteria called for in SEI guidance.9 For example, costs related to
development and integration tasks for US-VISIT component systems are
specified, but information about estimated software lines of code is not.
Additionally, no one outside the US-VISIT program office reviewed and
concurred with the cost estimating categories and methodology. Without
reliable cost estimates, the ability to make informed investment decisions
and effectively manage progress and performance is reduced.

Conclusions The fiscal year 2005 expenditure plan (with related program
office documentation and representations) either partially satisfies or
satisfies the legislative conditions imposed by Congress. Further, steps
are planned, initiated, under way, or completed to address all of our open
recommendations. However, overall progress in addressing the
recommendations has been slow, leaving considerable work to be done. Given
that most of these open recommendations are aimed at correcting
fundamental limitations in DHS's ability to manage the program in a way
that ensures the delivery of (1) mission value commensurate with costs and
(2) promised capabilities on time and within budget, it is important that
DHS implement the recommendations quickly and completely through effective
planning and continuous monitoring and reporting. Until this occurs, the
program will be at high risk of not meeting its stated goals on time and
within budget.

To its credit, the program office now has its prime contractor on board to
support both near-term increments and to plan for and deliver the
yet-to-bedefined US-VISIT strategic solution. However, it is important to
recognize that this accomplishment is a beginning and not an end. The
challenge for DHS is now to effectively and efficiently work with the
prime contractor in achieving desired mission outcomes.

9Carnegie Mellon University SEI, A Manager's Checklist for Validating
Software Cost and Schedule Estimates, CMU/SEI-95-SR-004 (January 1995).

To accomplish this, it is important that DHS move swiftly in building its
program management capacity, which is not yet in place, as shown by the
status of our open recommendations and our recent observations about (1)
economic justification of US-VISIT Increment 2B, (2) completion of the
exit pilot evaluation, (3) collaboration with a closely related
import/export processing and border security program, (4) system capacity
management activities, and (5) cost estimating practices. Moreover, it is
important that DHS improve its measurement and disclosure to its
Appropriations Subcommittees of its progress against commitments made in
prior expenditure plans, so that the Subcommittees' ability to effectively
oversee US-VISIT's plans and progress is not unnecessarily constrained.

Nevertheless, the fact remains that the program continues to invest
hundreds of millions of dollars for a mission-critical capability under
circumstances that introduce considerable risk that cost-effective mission
outcomes will not be realized. At a minimum, it is incumbent upon DHS to
fully disclose these risks, along with associated mitigation steps, to
executive and congressional leaders so that timely and informed decisions
about the program can be made.

  Recommendations for Executive Action

To better ensure that the US-VISIT program is worthy of investment and is
managed effectively, we reiterate our prior recommendations and further
recommend that the Secretary of Homeland Security direct the Under
Secretary for Border and Transportation Security to ensure that the
US-VISIT program director takes the following five actions:

o  Fully and explicitly disclose in all future expenditure plans how well
DHS is progressing against the commitments that it made in prior
expenditure plans.

o  Reassess its plans for deploying an exit capability to ensure that the
scope of the exit pilot provides for adequate evaluation of alternative
solutions and better ensures that the exit solution selected is in the
best interest of the program.

o  Develop and implement processes for managing the capacity of the
US-VISIT system.

o  Follow effective practices for estimating the costs of future
increments.

o  Make understanding the relationships and dependencies between the
US-VISIT and ACE programs a priority matter, and report periodically to
the Under Secretary on progress in doing so.

Agency Comments In written comments on a draft of this report, signed by
the Acting Director, Departmental GAO/IG Liaison Office (reprinted in app.
II), DHS concurred with our findings and recommendations. DHS also stated
that it appreciated the guidance that the report provides for future
efforts and described actions taken and progress made in implementing the
US-VISIT program.

We are sending copies of this report to the Chairmen and Ranking Minority
Members of other Senate and House committees and subcommittees that have
authorization and oversight responsibilities for homeland security. We are
also sending copies to the Secretary of Homeland Security, Secretary of
State, and the Director of OMB. Copies of this report will also be
available at no charge on our Web site at www.gao.gov.

Should you or your offices have any questions on matters discussed in this
report, please contact me at (202) 512-3439 or at [email protected]. Another
contact and key contributors to this report are listed in appendix III.

Randolph C. Hite Director, Information Technology Architecture

and Systems Issues

Appendix I

Briefing to the Staffs of the Subcommittees on Homeland Security, Senate and
House Committees on Appropriations

  Homeland Security: Some Progress Made, but Many Challenges Remain on U.S.
  Visitor and Immigrant Status Indicator Technology Program

Briefing to the Staffs of the
Subcommittees on Homeland Security
Senate and House Committees on Appropriations

November 23, 2004

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

o  Introduction

o  Objectives

o  Results in Brief

o  Background

o  Results

o  Legislative Conditions

o  Status of Open Recommendations

o  Observations

o  Conclusions

o  Recommendations for Executive Action

o  Agency Comments

o  Attachment 1. Scope and Methodology

o  Attachment 2. Recent Studies of US-VISIT

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

The U.S. Visitor and Immigrant Status Indicator Technology (US-VISIT)
program of the Department of Homeland Security (DHS) is a governmentwide
program to collect, maintain, and share information on foreign nationals.
The goals of US-VISIT are to

o  enhance the security of U.S. citizens and visitors,

o  facilitate legitimate travel and trade,

o  ensure the integrity of the U.S. immigration system, and

o  protect the privacy of our visitors.

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

The US-VISIT program involves the interdependent application of people,
processes, technology, and facilities.

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

The Department of Homeland Security Appropriations Act, 2005,1 states that
DHS may not obligate $254 of the $340 million appropriated for the
US-VISIT program until the Senate and House Committees on Appropriations
receive and approve a plan for expenditure that

o  meets the capital planning and investment control review requirements
established by the Office of Management and Budget (OMB), including OMB
Circular A-11, part 7;2

o  complies with DHS's enterprise architecture;

o  complies with the acquisition rules, requirements, guidelines, and
systems acquisition management practices of the federal government;

o  is reviewed and approved by the DHS Investment Review Board, the
Secretary of Homeland Security, and OMB; and

o  is reviewed by GAO.

1Pub. L. 108-334 (Oct. 18, 2004).
2OMB Circular A-11 establishes policy for planning, budgeting,
acquisition, and management of federal capital assets.

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

On October 19, 2004, DHS submitted its fiscal year 2005 expenditure plan
for $340 million to the House and Senate Appropriations Subcommittees on
Homeland Security.

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

As agreed, our objectives were to

1. determine whether the US-VISIT fiscal year 2005 expenditure plan
satisfies the legislative conditions,

2. determine the status of our US-VISIT open recommendations, and

3. provide any other observations about the expenditure plan and DHS's
management of US-VISIT.

We conducted our work at US-VISIT offices in Rosslyn, Virginia, from June
2004 through November 2004, in accordance with generally accepted
government auditing standards. Details of our scope and methodology are
described in attachment 1 of this briefing.

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

Fiscal Year 2005 US-VISIT Expenditure Plan's Satisfaction of Legislative
Conditions

aSatisfies or provides for satisfying many, but not all, key aspects of
the condition that we reviewed. bSatisfies or provides for satisfying
every aspect of the condition that we reviewed.

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

Status of Actions to Implement Our 19 Open Recommendations

aActions are planned to implement the recommendation.
bActions have been initiated to implement the recommendation.
cActions are under way to implement the recommendation.
dActions have been taken that fully implement the recommendation.
eThe Software Acquisition Capability Maturity Model (SA-CMM(R)) developed
by Carnegie Mellon University's Software Engineering Institute (SEI)
defines acquisition process management controls for planning, managing,
and controlling software-intensive system acquisitions.
fWith respect to the fiscal year 2005 expenditure plan.

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

Status of Actions to Implement Our 19 Open Recommendations

gThe purpose of independent verification and validation is to provide an
independent review of processes and products throughout the acquisition
and deployment phase.

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

Summary of GAO Observations

o  The program office has acquired the services of a prime integration
contractor to augment its ability to complete US-VISIT.

o  The fiscal year 2005 Expenditure Plan does not describe progress
against commitments (e.g., capabilities, schedule, cost, and benefits)
made in previous plans.

o  The exit capability alternatives evaluation is faced with a compressed
time line, missed milestones, and potentially reduced scope.

o  US-VISIT and Automated Commercial Environment (ACE)3 collaboration is
moving slowly.

o  US-VISIT system capacity is being managed in a compartmentalized
manner.

o  The cost estimating process used for Increment 2B did not follow some
key best practices.

3ACE is a new trade processing system planned to support the movement of
legitimate imports and exports and strengthen border security.

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

To assist DHS in managing US-VISIT, we are making five recommendations to
the Secretary of DHS.

In their comments on a draft of this briefing, US-VISIT program officials
stated that they generally agreed with our findings, conclusions, and
recommendations.

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

The US-VISIT program is a governmentwide endeavor intended to enhance the
security of U.S. citizens and visitors, facilitate legitimate travel and
trade, ensure the integrity of the U.S. immigration system, and protect
the privacy of our visitors. US-VISIT is to accomplish these things by

o  collecting, maintaining, and sharing information on certain foreign
nationals who enter and exit the United States;

o  identifying foreign nationals who (1) have overstayed or violated the
terms of their visit; (2) can receive, extend, or adjust their immigration
status; or (3) should be apprehended or detained by law enforcement
officials;

o  detecting fraudulent travel documents, verifying traveler identity, and
determining traveler admissibility through the use of biometrics; and

o  facilitating information sharing and coordination within the border
management community.

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

US-VISIT Program Office Structure

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

Acquisition Strategy

DHS plans to deliver US-VISIT capability incrementally. Currently, DHS has
decided that there will be four increments, with Increments 1 through 3
being interim, or temporary, solutions, and Increment 4 being the
yet-to-be-defined future vision for US-VISIT. Increments 1 through 3
include the interfacing and enhancement of existing system capabilities
and the deployment of these capabilities to air, sea, and land ports of
entry (POE). These increments are to be largely acquired through the
implementation of existing contracts and task orders.

In May 2004, DHS awarded an indefinite-delivery/indefinite-quantity4 prime
contract to Accenture and its partners.5 This collection of contractors is
known as the Smart Border Alliance.

4An indefinite-delivery/indefinite-quantity contract provides for an
indefinite quantity, within stated limits, of supplies or services during
a fixed period of time. The government schedules deliveries or performance
by placing orders with the contractor. 5Accenture's partners include,
among others, Raytheon Company, the Titan Corporation, and SRA
International, Inc.

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

According to the contract, the prime contractor will support the
integration and consolidation of processes, functionality, and data, and
will develop a strategy to build on the technology and capabilities
already available to fully support the US-VISIT vision. Meanwhile, the
US-VISIT program will continue to leverage existing contractors in
deploying the interim solution using the prime contractor to assist.

                                   Appendix I
                  Briefing to the Staffs of the Subcommittees
                     on Homeland Security, Senate and House
                          Committees on Appropriations

Increment 1 Status

Increment 1 (air and sea) includes the electronic collection and matching
of biographic and biometric information at all major air and some sea POEs
for selected foreign travelers with visas.6 As of September 30, 2004,
Increment 1 was expanded to include foreign nationals from visa waiver
countries.

On January 5, 2004, Increment 1 capability was deployed to 115 airports
and 14 seaports for entry and as a pilot to 2 POEs for exit.7 US-VISIT is
evaluating three additional exit alternatives and has recently deployed
these alternatives to three additional POEs.8

68 C.F.R. 235.1(d)(1)(iv) and 215.8(a)(2) state that classes of travelers
that are not subject to US-VISIT are foreign nationals admitted on A-1,
A-2, C-3 (except for attendants, servants, or personal employees of
accredited officials), G-1, G-2, G-3, G-4, NATO-1, NATO-2, NATO-3, NATO-4,
NATO-5, or NATO-6 visas; certain Taiwan officials who hold E-1 visas and
members of their immediate families who hold E-1 visas, unless the
Secretary of State and the Secretary of Homeland Security jointly
determine that a class of such aliens should be subject to the rule;
children under the age of 14; persons over the age of 79; classes of
aliens to whom the Secretary of Homeland Security and the Secretary of
State jointly determine it shall not apply; and an individual alien to
whom the Secretary of Homeland Security, the Secretary of State, or the
Director of Central Intelligence determines shall not be subject to the
rule.

7At that time, the pilot employed a self-serve kiosk to capture biographic
information and biometric data (two index fingerprints). The pilots are
deployed to Miami Royal Caribbean seaport and the Baltimore/Washington
International Airport.

8Chicago O'Hare International Airport, Denver International Airport, and
Dallas/Ft. Worth International Airport.

                                   Appendix I
                  Briefing to the Staffs of the Subcommittees
                     on Homeland Security, Senate and House
                          Committees on Appropriations

The three alternatives are as follows:

o The enhanced kiosk captures a digital photograph and prints out a
receipt.

o The mobile device includes a handheld wireless unit at the gates to
capture electronic fingerprints and photographs.

o The hybrid combines the enhanced kiosk, which is used to generate a
receipt, with the mobile device, which scans the receipt and the
electronic fingerprint of the traveler at the gate to verify exit.

As of November 18, 2004, US-VISIT had processed about 13 million foreign
nationals, including about 2 million from visa waiver countries. According
to US-VISIT, it had positively matched over 1,500 persons against watch
list databases.

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

Increment 2 Plans

Increment 2 is divided into three Increments-2A, 2B, and 2C.

o  Increment 2A (air, sea, and land) is to provide all POEs the capability
to process machine-readable visas and other travel and entry documents
that use biometric identifiers; it is to be implemented by October 26,
2005.9

o  Increment 2B (land) is to expand the Increment 1 solution for entry to
secondary inspection10 at the 50 highest volume land POEs by December 31,
2004.11 According to the US-VISIT Increment 2B Manager, US-VISIT deployed
Increment 2B as a pilot to three sites on November 15, 2004.12

9Pub. L. 108-299 (Aug. 9, 2004) extended the deadline from October 26,
2004, to October 26, 2005.

10Secondary inspection is used for more detailed inspections that may
include checking more databases, conducting more intensive interviews, or
both.

11As required by the Immigration and Naturalization Service Data
Management Improvement Act of 2000, 8 U.S.C. 1365a(d)(2).

12The three sites are Laredo, Texas; Port Huron, Michigan; and Douglas,
Arizona.

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

o  Increment 2C (border technology and infrastructure) is to deliver a
solution that captures both entry and exit information using technologies
such as radio frequency technology13 at primary inspection and exit lanes.
US-VISIT plans to deploy this technology to one or more POEs by June 2005.

Increment 3 Plans

o  Increment 3 (land) is to expand Increment 2B system capability to the
remaining 115 land POEs. It is to be implemented by December 31, 2005.14

Increment 4 Plans

o  Increment 4 (long-term strategy) is the yet-to-be-defined future vision
of US-VISIT program capability, which US-VISIT officials have stated will
likely consist of a series of releases. The program is currently working
with its prime contractor and partners to develop an overall vision for
immigration and border management operations.

13Radio frequency (RF) technology relies on proximity cards and card
readers. RF devices read the information contained on the card when the
card is passed near the device and can also be used to verify the identity
of the cardholder.

14As required by the Immigration and Naturalization Service Data
Management Improvement Act of 2000, 8 U.S.C. 1365a(d)(3).

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

For facilities, US-VISIT is installing the infrastructure, such as new
computer workstations, printers, peripherals (fingerprint scanning
machines/camera), modifications to the counters, and printer stands, and
ensuring adequate power availability for the collection of biometric and
biographical information in secondary inspection areas for Increment 2B.
DHS is working with the Federal Highway Administration, state
transportation departments, and the U.S. General Services Administration
on a "proof of concept" for the new RF technology associated with
Increment 2C, which is still in the preliminary stages.

For human capital, DHS does not anticipate the need for additional
inspection staff for Increment 2B.

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

Component Systems

US-VISIT (Increments 1 through 4) will potentially include the interfacing
of over 19 existing systems. Examples of systems included in Increment 1
and 2B are as follows:

o  Treasury Enforcement Communications Systems (TECS) is a system that
maintains lookout (i.e., watch list) data,15 interfaces with other
agencies' databases, and is currently used by inspectors at POEs to verify
traveler information and update traveler data. Within TECS are several
databases, including the following:

o  Advance Passenger Information System (APIS) includes arrival and
departure manifest information provided by air and sea carriers.

o  Crossing History includes information about individuals' crossing
histories.

15Lookout data sources include DHS's Customs and Border Protection and
Immigration and Customs Enforcement; the Federal Bureau of Investigation
(FBI); legacy DHS systems; the U.S. Secret Service; the U.S. Coast Guard;
the Internal Revenue Service; the Drug Enforcement Agency; the Bureau of
Alcohol, Tobacco, & Firearms; the U.S. Marshals Service; the U.S. Office
of Foreign Asset Control; the National Guard; the Treasury Inspector
General; the U.S. Department of Agriculture; the Department of Defense
Inspector General; the Royal Canadian Mounted Police; the U.S. State
Department; Interpol; the Food and Drug Administration; the Financial
Crimes Enforcement Network; the Bureau of Engraving and Printing; and the
Department of Justice Office of Special Investigations.

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

o  Biographic Watchlist includes biographic information on individuals of
interest.

o  Secondary includes the results of prior secondary inspections performed
on an individual, including if the person was admitted or denied entry.

o  US-VISIT Biometric Information File (BIF) includes keys or links to
other databases in TECS, IDENT, and ADIS and includes such information as
fingerprint identification numbers, name, and date of birth.

o  Addresses includes addresses of individuals.

o  I-94/Non-Immigrant Information System (NIIS) includes information from
I94 forms.

o  US-Visa (Datashare) includes Department of State records of visa
applications, such as photographs, biographic information, and fingerprint
identification number.

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

o  Arrival Departure Information System (ADIS) is a database that stores
traveler arrival and departure data and that provides query and reporting
functions.

o  Automated Biometric Identification System (IDENT) is a system that
collects and stores biometric data about foreign visitors.16

o  Student Exchange Visitor Information System (SEVIS) is a system that
contains information on foreign students.

o  Computer Linked Application Information Management System (CLAIMS 3) is
a system that contains information on foreign nationals who request
benefits, such as change of status or extension of stay.

o  Consular Consolidated Database (CCD) is a system that includes
information on whether a visa applicant has previously applied for a visa
or currently has a valid U.S. visa.

16Includes data such as FBI information on all known and suspected
terrorists, selected wanted persons (foreign-born, unknown place of birth,
previously arrested by DHS), and previous criminal histories for high-risk
countries; DHS Immigration and Customs Enforcement information on deported
felons and sexual registrants; and DHS information on previous criminal
histories and previous IDENT enrollments. Information from the FBI
includes fingerprints from the Integrated Automated Fingerprint
Identification System.

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

Increment 1 Processes

According to DHS, Increment 1 includes the following five processes:
pre-entry, entry, status management, exit, and analysis, which are
depicted in the graphic below.

                                   Appendix I
                  Briefing to the Staffs of the Subcommittees
                     on Homeland Security, Senate and House
                          Committees on Appropriations

Pre-entry Process:

Pre-entry processing begins with initial petitions for visas, grants of
visa status, or the issuance of travel documentation. When a foreign
national applies for a visa at a U.S. consulate, biographic and biometric
data are collected. The biometric data (i.e., fingerprint scan of the
right and left index fingers) are transmitted from State to DHS, where the
fingerprints are run against IDENT to verify identity. The results of the
biometric check are transmitted back to State. A "hit" response prevents
State's system from printing a visa for the applicant until the
information is reviewed and cleared by a consular officer.

Commercial air and sea carriers are required by law to transmit crew and
passenger manifests before arriving in the United States.17 These
manifests are transmitted through APIS. The APIS lists are run against the
biographic lookout system and identify those arrivals who have biometric
data available.

In addition, POEs review the APIS list for a variety of factors that would
target arriving crew and passengers for additional processing.

178 U.S.C. 1221(a).

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

Entry Process:

When the foreign national arrives at a primary POE inspection booth, the
inspector, using a document reader, scans the machine-readable travel
documents. APIS returns any existing records on the foreign national,
including manifest data matches and biographic lookout hits. When a match
is found in the manifest data, the foreign national's name is highlighted
and outlined on the manifest data portion of the screen.

Biographic information, such as name and date of birth, is displayed on
the bottom half of the screen, as well as the photograph from State's CCD.
TECS also returns information about whether there are, within IDENT,
existing fingerprints for the foreign national.

The inspector switches to another screen and scans the foreign national's
fingerprints (left and right index fingers) and takes a photograph. The
system accepts the best fingerprints available within the 5-second
scanning period. This information is forwarded to IDENT, where it is
checked against stored fingerprints in the IDENT lookout database.

                                   Appendix I
                  Briefing to the Staffs of the Subcommittees
                     on Homeland Security, Senate and House
                          Committees on Appropriations

If no prints are currently in IDENT, the foreign national is enrolled in
US-VISIT (i.e., biographic and biometric data are entered). If the foreign
national's fingerprints are already in IDENT, the system performs a 1:1
match (a comparison of the fingerprint taken during the primary inspection
to the one on file) to confirm that the person submitting the fingerprints
is the person on file. If the system finds a mismatch of fingerprints or a
watch list hit, the foreign national is sent to secondary inspection for
further screening or processing.

While the system is checking the fingerprints, the inspector questions the
foreign national about the purpose of his or her travel and length of
stay. The inspector adds the class of admission and duration of stay
information into TECS, and stamps the "admit until" date on the I-94
form.18

If the foreign national is ultimately determined to be inadmissible, the
person is detained, lookouts are posted in the databases, and appropriate
actions are taken.

18The I-94 form is used to track the arrival and departure of
nonimmigrants. It is divided into two parts. The first part is an arrival
portion, which includes, for example, the nonimmigrant's name, date of
birth, and passport number. The second part is a departure portion, which
includes the name, date of birth, and country of citizenship.

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

Within 2 hours after a flight lands and all passengers have been
processed, TECS is to send ADIS the records showing the class of admission
and the "admit until" dates that were modified by the inspector.

Status Management Process:

The status management process manages the foreign national's temporary
presence in the United States, including the adjudication of benefits
applications and investigations into possible violations of immigration
regulations.

Commercial air and sea carriers are required by law to transmit departure
manifests electronically for each passenger.19 These manifests are
transmitted through APIS and shared with ADIS. ADIS matches entry and exit
manifest data to ensure that each record showing a foreign national
entering the United States is matched with a record showing the foreign
national exiting the United States. ADIS also provides the ability to run
queries on foreign nationals who have entry information but no
corresponding exit information. ADIS receives status information from
CLAIMS 3 and SEVIS on foreign nationals.

198 U.S.C. 1221(b).

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

Exit Process:

The exit process includes the carriers' electronic submission of departure
manifest data to APIS. This biographic information is passed to ADIS,
where it is matched against entry information. As we have previously
discussed, when the foreign national departs the country through a pilot
location, the departure is processed by one of three alternative pilot
methods. The alternative used is dependent on the departure port. Within
each port, one or more alternatives will be deployed. Not all alternatives
are deployed to every pilot port. All three alternatives are generally
operated by a Work Station Attendant (WSA), although the mobile device can
sometimes be operated by a law enforcement officer. Foreign nationals are
informed of the requirement to process through exit upon departure.

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

The three alternatives are as follows.

o  Enhanced kiosk: The traveler approaches the kiosk for departure
processing. At the kiosk, the traveler, guided by a WSA if needed, scans
the machinereadable travel documents, provides electronic fingerprints,
and has a digital photograph taken. A receipt is printed to provide
documentation of compliance with the exit process and to assist in
compliance on the traveler's next attempted entry to the country. After
the receipt prints, the traveler proceeds to his/her departure gate. At
the conclusion of the transaction, the collected information is
transmitted to IDENT.

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

o  Mobile device: At the departure gate, and just before the traveler
boards the departure craft, either a WSA or law enforcement officer scans
the machinereadable travel documents, scans the traveler's fingerprints
(right and left index fingers), and takes a digital photograph. A receipt
is printed to provide documentation of compliance with the exit process
and to assist in compliance on the traveler's next attempted entry to the
country. The device wirelessly transmits the captured data in real time to
IDENT via the Transportation Security Administration's Data Operations
Center.

If the device is being operated by a WSA, the WSA provides a printed
receipt to the traveler, and the traveler then boards the departure craft.
If the mobile device is being operated by a law enforcement officer, the
captured biographic and biometric information is checked in near real time
against watch lists. Any potential match is returned to the device and
displayed visually for the officer. If no match is found, the traveler
boards the departure craft.

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

o  Hybrid: Using an enhanced kiosk, the traveler, guided by a WSA if
needed, scans the machine-readable travel documents, provides electronic
fingerprints, and has a digital photograph taken.

As with the enhanced kiosk alternative, a receipt is printed to provide
documentation of compliance with the exit process and to assist in
compliance on the traveler's next attempted entry to the country. However,
this receipt has biometrics (i.e., the traveler's fingerprints and
photograph) embedded on the receipt. At the conclusion of the transaction,
the collected information is transmitted to IDENT.

The traveler presents his or her receipt to the WSA or law enforcement
officer at the gate or departure area, who scans the receipt using a
mobile device. The traveler's identity is verified against the biometric
data embedded on the receipt. Once the traveler's identity is verified,
he/she is allowed to board the departure craft. The captured information
is not transmitted in real time back to IDENT. Data collected on the
mobile device are periodically uploaded through the kiosk to IDENT.

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

Analysis:

An ongoing analysis capability is to provide for the continuous screening
against watch lists of individuals enrolled in US-VISIT for appropriate
reporting and action. As more entry and exit information becomes
available, it can be used to analyze traffic volume and patterns as well
as to perform risk assessments. The analysis is to be used to support
resource and staffing projections across the POEs, strategic planning for
integrated border management analysis performed by the intelligence
community, and determination of travel use levels and expedited traveler
programs.

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

Increment 2B Processes

As mentioned previously, US-VISIT has recently deployed Increment 2B
(which is focused on land POEs) as a pilot and plans to fully deploy the
increment by December 31, 2004. Increment 2B is similar to Increment 1,
with several noteworthy differences.

o  No advance passenger information is to be available to the inspector
before the traveler arrives for inspection.

o  Travelers subject to US-VISIT are to be processed at secondary
inspection, rather than at primary inspection.

o  Inspectors' workstations are to use a single screen, which eliminates
the need to switch between the TECS and IDENT screens.

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

o  Form I-94 data are to be captured electronically. The form is populated
by data obtained when the machine-readable zone of the travel document is
swiped. If visa information about the traveler exists in the Datashare
database,20 it is used to populate the form. Fields that cannot be
populated electronically are manually entered. A copy of the completed
form is printed and given to the traveler for use upon exit.

o  No electronic exit information is to be captured.

20Datashare includes a data extract from State's CCD system and includes
the visa photograph, biographical data, and the fingerprint identification
number assigned when a nonimmigrant applies for a visa.

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

Simplified Diagram of US-VISIT Increment 1 and 2B Systems

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

Chronology of US-VISIT Expenditure Plans

Since November 2002, four US-VISIT expenditure plans have been submitted.

o  On November 15, 2002, the Immigration and Naturalization Service
(INS)21 submitted to its appropriations subcommittees its first
expenditure plan, which outlined $13.3 million in expenditures for
contract activities; design, development, and deployment of the Visa
Waiver Support System; facilities assessments; biometric standards
development; prototyping; IBIS support activities; travel; program office
operations; and fingerprint scanner procurements.

o  On June 5, 2003, the second expenditure plan outlined $375 million in
expenditures for system enhancements and infrastructure upgrades, POE
information technology (IT) and communication upgrades, facilities
planning analysis and design, program management support, proof of concept
demonstrations, operations and system sustainment, and training.

21Effective March 1, 2003, INS became part of DHS.

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

o  On January 27, 2004, the third expenditure plan outlined $330 million
in expenditures for exit pilots; capability to read biometrically enabled
travel documents; land infrastructure upgrades; system development and
testing; radio frequency technology deployment to the 50 busiest land
POEs; technical infrastructure planning and development; program
management; and operations and maintenance.

o  The current and fourth expenditure plan, submitted on October 19, 2004,
outlines $340 million in expenditures (see table, next slide).

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

Increment 1-Air and Sea: Includes deploying an exit capability to capture
departure information and acquiring lease space for exit at air and sea
POEs.

Increment 2A-Air, Sea, and Land: Includes continued work on developing and
testing the US-VISIT equipment and software necessary to biometrically
compare and authenticate travel documents.

Increment 2C-Border Technology and Infrastructure: Includes testing,
modeling, and deploying technology to provide the capability to view
previously collected biographic and biometric data of enrolled travelers
and integrating Border Crossing Card biometric data with IDENT.

Increment 3-Land: Includes extending the Increment 2B capability to
collect biometric data and verify identity at the 115 remaining land POEs.

Increment 4-Long-Term Strategy: Includes developing the long-term
strategy; integrating the strategy with the interim system, legacy
systems, and the DHS enterprise architecture; and planning for facilities
compliance.

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

Program Management: Includes maintaining the program management structure
and baseline operations.

Operations and Maintenance: Includes operations and maintenance of
existing information systems and support costs for ongoing software
configuration and maintenance.

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

The US-VISIT expenditure plan satisfies or partially satisfies each of the
legislative conditions.

Condition 1. The plan, including related program documentation and program
officials' statements, partially satisfies the capital planning and
investment control review requirements established by OMB, including OMB
Circular A-11, part 7, which establishes policy for planning, budgeting,
acquisition, and management of federal capital assets.

The table that follows provides examples of the results of our analysis.

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

                                   Appendix I
                  Briefing to the Staffs of the Subcommittees
                     on Homeland Security, Senate and House
                          Committees on Appropriations

Condition 2. The plan, including related program documentation and program
officials' statements, partially satisfies the condition that it provide
for compliance with DHS's enterprise architecture (EA).

DHS released version 1.0 of the architecture in September 2003.22 We
reviewed the initial version of the architecture and found that it was
missing, either partially or completely, all the key elements expected in
a well-defined architecture, such as a description of business processes,
information flows among these processes, and security rules associated
with these information flows.23 Since we reviewed version 1.0, DHS has
drafted version 2.0 of its EA. We have not reviewed this draft.

22Department of Homeland Security Enterprise Architecture Compendium
Version 1.0 and Transitional Strategy.

23GAO, Homeland Security: Efforts Under Way to Develop Enterprise
Architecture, but Much Work Remains, GAO-04-777 (Washington, D.C.: Aug. 6,
2004).

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

According to officials from the Office of the Chief Strategist, concurrent
with the development of the strategic vision, the US-VISIT program office
has been working with the DHS EA program office in developing version 2.0
to ensure that US-VISIT is aligned with DHS's evolving EA. According to
these officials, US-VISIT representatives participate in both the DHS EA
Center of Excellence and the DHS Enterprise Architecture Board.24

In July 2004, the Center of Excellence reviewed US-VISIT's submission for
architectural alignment with some EA components, but not all.
Specifically, the submission included information intended to show
compliance with business and data components, but not, for example, the
application and technology components. According to the head of DHS's EA
Center of Excellence, the application and technical components were
addressed by this center, which found that US-VISIT was in compliance.

24The Center of Excellence supports the Enterprise Architecture Board in
reviewing component documentation. The purpose of the Board is to ensure
that investments are aligned with the DHS EA.

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

Based on its review, the DHS Enterprise Architecture Board recommended
that the US-VISIT program be given conditional approval to proceed for
investment, provided that the program resubmit its documentation upon
completion of its strategic plan, which is anticipated in January 2005.
DHS has not yet provided us with sufficient documentation to allow us to
understand DHS architecture compliance methodology and criteria, or
verifiable analysis justifying the conditional approval.

Appendix I
Briefing to the Staffs of the Subcommittees
on Homeland Security, Senate and House
Committees on Appropriations

Condition 3. The plan, including related program documentation and program

officials' statements, satisfies the condition that it comply with the
acquisition rules,

requirements, guidelines, and systems acquisition management practices of
the

federal government.

The plan provides for satisfying this condition, in part, by describing
efforts to

develop Software Engineering Institute (SEI) Software Acquisition
Capability

Maturity Model (SA-CMM
*** End of document. ***