Border Security: Stronger Actions Needed to Assess and Mitigate  
Risks of the Visa Waiver Program (07-SEP-06, GAO-06-1090T).	 
                                                                 
The Visa Waiver Program enables citizens of 27 countries to	 
travel to the United States for tourism or business for 90 days  
or less without obtaining a visa. In fiscal year 2005, nearly 16 
million people entered the country under the program. After the  
9-11 terrorist attacks, the risk that aliens would exploit the	 
program to enter the United States became more of a concern. This
testimony discusses our recent report on the Visa Waiver Program.
Specifically, it (1) describes the Visa Waiver Program's benefits
and risks, (2) examines the U.S. government's process for	 
assessing potential risks, and (3) assesses the actions taken to 
mitigate these risks. We met with U.S. embassy officials in six  
program countries and reviewed relevant procedures and reports on
participating countries 					 
-------------------------Indexing Terms------------------------- 
REPORTNUM:   GAO-06-1090T					        
    ACCNO:   A60411						        
  TITLE:     Border Security: Stronger Actions Needed to Assess and   
Mitigate Risks of the Visa Waiver Program			 
     DATE:   09/07/2006 
  SUBJECT:   Border security					 
	     Homeland security					 
	     Law enforcement					 
	     Passports						 
	     Program evaluation 				 
	     Reporting requirements				 
	     Risk assessment					 
	     Visas						 
	     Waivers						 
	     INS Visa Waiver Pilot Program			 

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Product.                                                 **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************
GAO-06-1090T

     

     * Summary
     * Background
     * Visa Waiver Program Has Benefits and Risks
          * Visa Waiver Program Can Pose Risks to U.S. Security, Law Enf
     * Process for Assessing Program Risks Has Weaknesses
          * Initial Steps Taken To Assess Risk of Visa Waiver Program
          * DHS Lacks a Clearly-Defined, Consistent, and Timely Process
          * DHS Cannot Effectively Monitor Ongoing Concerns in Visa Waiv
     * DHS Faces Difficulties in Mitigating Program Risks
          * DHS Has Taken Some Actions to Mitigate Risks of the Visa Wai
          * DHS Lacks Standard Procedures for Obtaining Stolen Blank Pas
          * Some Participating Visa Waiver Program Countries are Resisti
          * Inefficient Access to Interpol's Database on Lost and Stolen
     * Recommendations to Improve Program Oversight and DHS's Respo
     * Contacts and Staff Acknowledgments
     * Related GAO Products and Ongoing Reviews
          * Issued Reports
               * Ongoing Reviews
               * Order by Mail or Phone

Testimony

Before the Subcommittee on Terrorism, Technology, and Homeland Security,
Committee on the Judiciary, U.S. Senate

United States Government Accountability Office

GAO

For Release on Delivery Expected at 2:00 p.m. EDT

Thursday, September 7, 2006

BORDER SECURITY

Stronger Actions Needed to Assess and Mitigate Risks of the Visa Waiver
Program

Statement of Jess T. Ford, Director International Affairs and Trade

GAO-06-1090T

Mr. Chairman and Members of the Subcommittee:

I am pleased to be here to discuss our observations on the Visa Waiver
Program. In fiscal year 2005, nearly 16 million travelers entered the
United States under this program, which facilitates international travel
and commerce, and eases workload for consular officers at overseas posts,
by enabling citizens of 27 participating countries1 to travel to the
United States for tourism or business for 90 days or less without first
obtaining a visa.2 Participating countries were selected because their
citizens had demonstrated a pattern of compliance with U.S. immigration
laws, and the governments of these countries granted reciprocal visa-free
travel to U.S. citizens. The Visa Waiver Program was created as a pilot
program in 1986,3 and it became permanent in 2000,4 about 1 year prior to
the 9-11 terrorist attacks. After the attacks, the potential risks of the
program became more of a concern. In particular, convicted terrorist
Zacarias Moussaoui and "shoe-bomber" Richard Reid both boarded flights to
the United States with passports issued by Visa Waiver Program countries.
Moreover, the foiled alleged terrorist plot to board planes at London's
Heathrow Airport and fly to the United States with explosive materials
highlights the importance of having effective tools to ensure that only
legitimate travelers enter the United States. In May 2002, Congress
mandated that the Department of Homeland Security (DHS) evaluate and
report to Congress at least every two years on the effect that each
country's continued participation in the program has on U.S. law
enforcement and security interests.5 Effective oversight of the Visa
Waiver Program is essential to find the right balance between facilitating
legitimate travel and preventing potential terrorists, criminals, and
others that may pose law enforcement and immigration concerns from
entering the United States.6

1The participating countries are Andorra, Australia, Austria, Belgium,
Brunei, Denmark, Finland, France, Germany, Iceland, Ireland, Italy, Japan,
Liechtenstein, Luxembourg, Monaco, the Netherlands, New Zealand, Norway,
Portugal, San Marino, Singapore, Slovenia, Spain, Sweden, Switzerland, and
the United Kingdom.

2The United States also issues visas to those who intend to immigrate to
the United States. In this testimony, we use the term "visa" to refer to
nonimmigrant visas only.

3The Immigration Reform and Control Act of 1986, P.L. 99-603.

4The Visa Waiver Permanent Program Act, P.L. 106-396.

5Prior to this change, DHS was required to report at least once every 5
years. See the Enhanced Border Security and Visa Entry Reform Act, P.L
107-173.

Earlier this week, we released two reports on the Visa Waiver Program: the
first discusses the process by which the United States assesses and
mitigates the program's risks,7 and the second describes the process by
which additional countries may be admitted into the program.8 My statement
will focus on the first of these reports. Specifically, I will discuss (1)
the Visa Waiver Program's advantages and potential risks; (2) the U.S.
government's process for assessing the program's risks; and (3) the
actions that have been taken to mitigate these risks. In addition, we have
ongoing work examining international aviation passenger prescreening,
including DHS's use of passport and reservation data to screen travelers
and the pilot Immigration Advisory Program at several airports overseas,
and expect to report on our findings later this fall.

In conducting this work, we reviewed documentation, including the laws
governing the program, relevant regulations and agency operating
procedures, and DHS's Office of the Inspector General (OIG) reports. We
also examined 15 of the 25 completed reports from the 2004 review process
that assessed the participation of Visa Waiver Program countries.9
Additionally, we interviewed political, economic, consular, commercial,
and law enforcement officials at U.S. embassies in six Visa Waiver Program
countries, as well as foreign government officials in three of these
countries. We met with officials from several DHS component agencies and
offices; the Department of State (State); and the International Criminal
Police Organization (Interpol) in Lyon, France. We conducted our work in
accordance with generally accepted government auditing standards (see app.
I for a list of related GAO products and ongoing reviews).

6Since September 11, 2001, the visa issuance process has taken on greater
significance as an antiterrorism tool, as we have previously reported. GAO
has issued a series of reports on the visa issuance process. See GAO,
Border Security: Strengthened Visa Process Would Benefit from Improvements
in Staffing and Information Sharing, GAO-05-859 (Washington, D.C.: Sept.
13, 2005); Border Security: Actions Needed to Strengthen Management of
Department of Homeland Security's Visa Security Program, GAO-05-801
(Washington, D.C.: July 29, 2005); and, Border Security: Visa Process
Should be Strengthened as an Antiterrorism Tool, GAO-03-132NI (Washington,
D.C.: Oct. 21, 2002).

7GAO, Border Security: Stronger Actions Needed to Assess and Mitigate
Risks of the Visa Waiver Program, GAO-06-844 (Washington, D.C.: July 28,
2006).

8GAO, Process for Admitting Additional Countries into the Visa Waiver
Program, GAO-06-835R (Washington, D.C.: July 28, 2006).

9As of June 2006, the remaining 10 assessments were pending classification
review, and assessments of the remaining two participating countries-Italy
and Portugal-were in process.

                                    Summary

The Visa Waiver Program provides many benefits to the United States,
including facilitating international travel for millions of foreign
citizens seeking to visit the United States each year, creating
substantial economic benefits to our country. Visa waiver travelers have
represented about one-half of all nonimmigrant admissions to the United
States in recent years. The program also allows State to allocate
resources to visa-issuing posts in countries with higher-risk applicant
pools. Moreover, participating visa waiver countries offer visa-free
travel to U.S. citizens. However, travelers visiting the United States
under the Visa Waiver Program can pose potential security risks because
they are not interviewed by a consular officer prior to their travel. In
addition, border inspectors at U.S. ports of entry may not know the visa
waiver traveler's language or local fraudulent document trends in the
traveler's home country, nor have the time to conduct an extensive
interview. In contrast, visa-issuing officers at U.S. embassies generally
have more time to interview applicants-often in the applicants' native
language-and have more country-specific knowledge of passports and fraud
trends. Furthermore, lost and stolen passports from visa waiver countries
are highly prized among travelers seeking to conceal their true identities
or nationalities, increasing the likelihood that terrorists and other
criminals would attempt to obtain these documents. DHS officials have
acknowledged that an undetermined number of inadmissible aliens may have
entered the United States using a stolen or lost passport from a visa
waiver country. In fact, passports from Visa Waiver Program countries have
been used illegally by hundreds of travelers attempting to enter the
United States. For example, from January through June 2005, at U.S. ports
of entry, DHS confiscated 298 passports issued by Visa Waiver Program
countries that travelers were attempting to use fraudulently for admission
into the United States. Thus, there is a risk that the program could be
exploited for illegal entry into the United States.

DHS has developed a process for assessing the law enforcement and security
risks of the Visa Waiver Program, but this process has weaknesses. In
2002, Congress mandated that DHS review the security risks posed by each
visa waiver country's participation in the program at least every 2 years.
In 2004, DHS established the Visa Waiver Program Oversight Unit within the
Office of International Enforcement (OIE).10 DHS conducted its first
mandated biennial reviews that same year, and subsequently determined that
all of the countries it reviewed should remain in the program.11 However,
we identified several problems with the country review process.
Specifically, key interagency stakeholders,12 such as embassies overseas
and forensic document analysts, were left out of portions of the 2004
country review process, and the review process lacked clear criteria and
guidance to make key judgments. Also, the country assessments prepared by
DHS were not completed in a timely fashion and contained some dated
information that did not necessarily reflect current risks; interagency
teams conducted site visits as part of the country assessments from May
through September 2004, and transmitted the final report to Congress more
than 1 year later, in November 2005. The teams collecting information
about the visa waiver countries' risks in 2004 used, in some cases,
information that was two years old; by the time the summary report was
issued in November 2005, some of the data was over 3 years old. Moreover,
DHS has not provided sufficient resources to the Office of International
Enforcement to effectively monitor the risks posed by visa waiver
countries on an ongoing basis. While the Visa Waiver Program Oversight
Unit developed a strategic plan to monitor the program, it has been unable
to implement this plan with its current staff of only two full-time
employees. In addition, DHS has not established Visa Waiver Program points
of contact within the U.S. embassies so it can communicate directly with
foreign government contacts and field officials, who are best positioned
to monitor compliance with the program's requirements and report on
current events and issues of potential concern. Without this outreach, DHS
is not able to leverage the existing resources at U.S. embassies in all
visa waiver countries to obtain current information on potential risks, as
well as countries' progress in addressing these risks.

10OIE is located in the Office of Policy Development under the direction
of the Assistant Secretary of Homeland Security for Policy.

11DHS's Office of Policy began this review in early 2004, several months
before the Visa Waiver Program Oversight Unit was established in July of
that year.

12The interagency working group charged in 2004 with assessing
participating countries' adherence to the program's statutory requirements
comprised officials from Justice's Office of International Affairs,
State's Bureau of Consular Affairs, and several components within DHS,
including the Intelligence and Analysis Directorate, Custom and Border
Protection's Office of Field Operations, and Immigration and Customs
Enforcement's Forensic Document Laboratory, among others. Representatives
from some of these agencies formed the in-country site visit teams.

DHS has taken some actions to mitigate the risks of the Visa Waiver
Program. Specifically, DHS identified security concerns in several
participating countries during the 2004 assessment process, and, for
example, terminated the use of the German temporary passport under the
program. However, the department has faced difficulties in further
mitigating program risks, particularly regarding lost and stolen passport
reporting-a key vulnerability. For example, not all countries have
consistently reported their data to the United States on stolen blank
passports, even though reporting such data is vital to mitigating program
risks. In one instance, a visa waiver country reported to the United
States the theft of nearly 300 blank passports more than 9 years after the
theft occurred. In 2002, timely reporting of such thefts became a
statutory requirement for continued participation in the program, but DHS
has not issued standard operating procedures for countries to report these
data. DHS has also sought to expand this requirement to include the
reporting of data, to the United States and Interpol,13 about lost and
stolen issued14 (as well as blank) passports; however, the United States
lacks a centralized mechanism for foreign governments to report all stolen
passports, and DHS has not identified the U.S. government entity to which
participating countries should report this information. While most visa
waiver countries contribute to Interpol's database, four do not. Moreover,
some countries that do contribute do not do so on a regular basis,
according to Interpol officials. In addition, Interpol's data on lost and
stolen travel documents is not automatically accessible to U.S. border
inspectors at primary inspection-one reason why it is not an effective
border screening tool, according to DHS, State, and Justice officials.
According to the Secretary General of Interpol, until DHS can
automatically query Interpol's data, the United States will not have an
effective screening tool for checking passports. However, DHS has not yet
finalized a plan to obtain this systematic access to Interpol's data.

In our report, we made several recommendations to DHS to strengthen its
ability to assess the risks of the Visa Waiver Program, including a
recommendation to create real-time monitoring mechanisms to improve
communication between the department and overseas posts, and to provide
additional resources for the Visa Waiver Program Oversight Unit. We also
made a series of recommendations to mitigate the program's risks,
including communicating clear standard operating procedures for the
reporting of lost and stolen, blank and issued, passport data. Finally, we
included a matter for congressional consideration: to improve the
timeliness of DHS's assessments of the risks of each country's continued
participation in the program, Congress should consider establishing a
deadline by which the department must complete its biennial country
assessments and report to Congress. DHS either agreed with, or stated that
it is considering, all of our recommendations. Regarding our matter for
congressional consideration, DHS did not support the establishment of a
deadline for the biennial report to Congress. Instead, DHS suggested that
Congress should require continuous and ongoing evaluation of the risks of
each country's continued participation in the program.

13Interpol is the world's largest international police organization, with
184 member countries. Created in 1923, it facilitates cross-border police
cooperation, and supports and assists all organizations, authorities, and
services whose mission is to prevent or combat international crime. In
July 2002, Interpol established a database on lost and stolen travel
documents. As of June 2006, the database contained about 11.6 million
records of lost and stolen passports.

14Issued passports have been officially personalized with the bearer's
biographical information.

                                   Background

The Immigration Reform and Control Act of 1986 created the Visa Waiver
Program as a pilot program.15 It was initially envisioned as an
immigration control and economic promotion program, according to State.
Participating countries were selected because their citizens had a
demonstrated pattern of compliance with U.S. immigration laws, and the
governments of these countries granted reciprocal visa-free travel to U.S.
citizens. In recent years, visa waiver travelers have represented about
one-half of all nonimmigrant admissions to the United States. In 2002, we
reported on the legislative requirements to which countries must adhere
before they are eligible for inclusion in the Visa Waiver Program.16 In
general, to qualify for visa waiver status, a country must:

           o  maintain a nonimmigrant refusal rate of less than 3 percent for
           its citizens who apply for business and tourism visas.
           o  certify that it issues machine-readable passports to its
           citizens; and

           o  offer visa-free travel for U.S. citizens.

           Following the 9-11 attacks, Congress passed additional laws to
           strengthen border security policies and procedures, and DHS and
           State instituted other policy changes that have affected the
           qualifications for countries to participate in the Visa Waiver
           Program. For example, all passports issued after October 26, 2005,
           must contain a digital photograph printed in the document, and
           passports issued to visa waiver travelers after October 26, 2006,
           must be electronic (e-passports).17 In addition, the May 2002
           Enhanced Border Security and Visa Reform Act required that
           participating countries certify that the theft of their blank
           passports is reported to the U.S. government in a timely manner.

           Visa Waiver Program Has Benefits and Risks
			  
			  The Visa Waiver Program has many benefits. The program was created
           to facilitate international travel without jeopardizing the
           welfare or security of the United States, according to the
           program's legislative history. According to economic and
           commercial officers at several of the U.S. embassies we visited,
           visa-free travel to the United States boosts international
           business travel and tourism, as well as airline revenues, and
           creates substantial economic benefits to the United States.
           Moreover, the program allows State to allocate its resources to
           visa-issuing posts in countries with higher-risk applicant pools.
           In 2002, we reported that eliminating the program would increase
           State's resource requirements as millions of visa waiver travelers
           who have benefited from visa-free travel would need to obtain a
           visa to travel to the United States if the program did not
           exist.18 Specifically, if the program were eliminated, we
           estimated that State's initial costs at that time to process the
           additional workload would likely range between $739 million and
           $1.28 billion and that annual recurring costs would likely range
           between $522 million and $810 million. In addition, visa waiver
           countries could begin requiring visas for U.S. citizens traveling
           to the 27 participating countries for temporary business or
           tourism purposes, which would impose a burden of additional cost
           and time on U.S. travelers to these countries.

           Visa Waiver Program Can Pose Risks to U.S. Security,
			  Law Enforcement, and Immigration Interests
			  
			  The Visa Waiver Program, however, can also pose risks to U.S.
           security, law enforcement, and immigration interests because some
           foreign citizens may exploit the program to enter the United
           States. First, visa waiver travelers are not subject to the same
           degree of screening as travelers who must first obtain a visa
           before arriving in the United States (see fig. 1). Visa waiver
           travelers are first screened in person by a DHS Customs and Border
           Protection (CBP) inspector once they arrive at the U.S. port of
           entry, perhaps after having already boarded an international
           flight bound for the United States with a fraudulent travel
           document. According to the DHS OIG, primary border inspectors are
           at a disadvantage when screening Visa Waiver Program travelers
           because they may not know the alien's language or local fraud
           trends in the alien's home country, nor have the time to conduct
           an extensive interview. In contrast, non-visa-waiver travelers,
           who must obtain a visa from a U.S. embassy or consulate, receive
           two levels of screening before entering the country-in addition to
           the inspection at the U.S. port of entry, these travelers undergo
           an interview by consular officials overseas, who conduct a
           rigorous screening process when deciding to approve or deny a
           visa. As we have previously reported, State has taken a number of
           actions since 2002 to strengthen the visa issuance process as a
           border security tool.19 Moreover, consular officers have more time
           to interview applicants and examine the authenticity of their
           passports, and may also speak the visa applicant's native
           language, according to consular officials. Therefore, inadmissible
           travelers who need visas to enter the United States may attempt to
           acquire a passport from a Visa Waiver Program country to avoid the
           visa screening process.

           Figure 1: Comparison of Screening for U.S. Visas versus Arrival
           Inspection Screening at U.S. Air Port of Entry

           Another risk inherent in the program is the potential exploitation
           by terrorists, immigration law violators, and other criminals of a
           visa waiver country's lost or stolen passports. DHS intelligence
           analysts, law enforcement officials, and forensic document experts
           all acknowledge that misuse of lost and stolen passports is the
           greatest security problem posed by the Visa Waiver Program. Lost
           and stolen passports from visa waiver countries are highly prized
           travel documents, according to the Secretary General of Interpol.
           Moreover, Visa Waiver Program countries that do not consistently
           report the losses or thefts of their citizens' passports, or of
           blank passports, put the United States at greater risk of allowing
           inadmissible travelers to enter the country.

           Fraudulent passports from Visa Waiver Program countries have been
           used illegally by travelers seeking to disguise their true
           identities or nationalities when attempting to enter the United
           States. For example, from January through June 2005, DHS reported
           that it confiscated, at U.S. ports of entry, 298 fraudulent or
           altered passports issued by Visa Waiver Program countries that
           travelers were attempting to use for admission into the United
           States. Although DHS has intercepted some travelers with
           fraudulent passports at U.S. ports of entry, DHS officials
           acknowledged that an undetermined number of inadmissible aliens
           may have entered the United States using a lost or stolen passport
           from a visa waiver country. According to State, these aliens may
           have been inadmissible because they were immigration law
           violators, criminals, or terrorists. For example:

           o  In July 2005, two aliens successfully entered the United States
           using lost or stolen Austrian passports. DHS was not notified that
           these passports had been lost or stolen prior to this date; the
           aliens were admitted, and there is no record of their departure,
           according to CBP. In October 2005, CBP referred this case to DHS's
           Immigration and Customs Enforcement for further action.

           o  In June 2005, CBP inspectors admitted into the United States
           two aliens using Italian passports that were from a batch of
           stolen passports. CBP was notified that this batch was stolen;
           however, the aliens altered the passport numbers to avoid
           detection by CBP officers. DHS has no record that these
           individuals departed the United States.

           Process for Assessing Program Risks Has Weaknesses
			  
			  DHS has taken several steps to assess the risks of the Visa Waiver
           Program. However, we identified problems with the country review
           process by which DHS assesses these risks, namely a lack of
           inclusiveness, transparency, and timeliness. Furthermore, OIE is
           unable to effectively monitor the immigration, law enforcement,
           and security risks posed by visa waiver countries on a continuing
           basis because of insufficient resources.

           Initial Steps Taken To Assess Risk of Visa Waiver Program
			  
			  In April 2004, the DHS OIG identified significant areas where DHS
           needed to strengthen and improve its management of the Visa Waiver
           Program. For example, the OIG found that a lack of funding,
           trained personnel, and other issues left DHS unable to comply with
           the mandated biennial country assessments. In response to these
           findings, DHS established OIE's Visa Waiver Program Oversight Unit
           in July 2004, and named a director to manage the office. The
           unit's mission is to oversee Visa Waiver Program activities and
           monitor countries' adherence to the program's statutory
           requirements, ensuring that the United States is protected from
           those who wish to do it harm or violate its laws, including
           immigration laws. Since the unit's establishment, DHS, and
           particularly OIE, has made strides to address concerns raised by
           the 2004 OIG review. For example, DHS completed comprehensive
           assessments of 25 of the 27 participating countries and submitted
           a six-page report to Congress in November 2005 that summarized the
           findings from the 2004 assessments.

           DHS Lacks a Clearly-Defined, Consistent, and Timely Process to
			  Assess Risks of Visa Waiver Program
			  
			  Despite these steps to strengthen and improve the management of
           the program, we identified several problems with the mandated
           biennial country assessment process, by which DHS assesses the
           risks posed by each of the visa waiver countries' continued
           participation in the program. For the 2004 assessments, we found
           the following:

           o  Some key stakeholders were excluded from the process. After
           conducting the site visits and contributing to the reports on the
           site visits, DHS and the interagency working group did not seek
           input from all site visit team members while drafting and clearing
           the final country assessments and subsequent report to Congress.
           For example, DHS's forensic document analysts, who participated in
           the site visits in 2004, told us that they did not see, clear, or
           comment on the draft country assessments, despite repeated
           attempts to obtain copies of them. Additionally, at the time of
           our visits, ambassadors or deputy chiefs of mission in each of the
           six posts told us that they were not fully aware of the extent to
           which assessments for the country where they were posted discussed
           law enforcement and security concerns posed by the continued
           participation of the country in the program. Without this
           information, key stakeholders could not be effective advocates for
           U.S. concerns.

           o  The reviews lacked clear criteria to make key judgments. We
           found that DHS did not have clear criteria to determine at what
           point security concerns uncovered during their review would
           trigger discussions with foreign governments about these concerns
           and an attempt to resolve them. State officials agreed that
           qualitative and/or quantitative criteria would be useful when
           making these determinations, although DHS stated that the criteria
           should be flexible.

           o  DHS and its interagency partners neither completed the 25
           country assessments nor issued the summary report to Congress in a
           timely manner. The interagency teams conducted site visits as part
           of the country assessments from May through September 2004, and
           transmitted the final summary report to Congress more than 1 year
           later, in November 2005. OIE, State, and Justice officials
           acknowledged that the assessments took too long to complete. The
           teams collecting information about the visa waiver countries'
           risks in 2004 used, in some cases, information that was two years
           old; by the time the summary report was issued in November 2005,
           some of the data was over 3 years old. As a result of this lengthy
           process, the final report presented to Congress did not
           necessarily reflect the current law enforcement and security risks
           posed by each country, or the positive steps that countries had
           made to address these risks.

           DHS Cannot Effectively Monitor Ongoing Concerns in Visa Waiver Countries
			  
			  OIE is limited in its ability to achieve its mission because of
           insufficient staffing. The office has numerous responsibilities,
           including conducting the mandated biennial country reviews;
           monitoring law enforcement, security, and immigration concerns in
           visa waiver countries on an ongoing basis; and working with
           countries seeking to become members of the Visa Waiver Program. In
           2004, the DHS OIG found that OIE's lack of resources directly
           undercut its ability to assess a security problem inherent in the
           program-lost and stolen passports. The office received funding to
           conduct the country reviews in 2004 and 2005; however, OIE
           officials indicated that a lack of funding and full-time staff has
           made it extremely difficult to conduct additional overseas
           fieldwork, as well as track ongoing issues of concern in the 27
           visa waiver countries-a key limitation in DHS's ability to assess
           and mitigate the program's risks. According to OIE officials, the
           unit developed a strategic plan to monitor the program, but has
           been unable to implement its plan with its current staffing of two
           full-time employees, as well as one temporary employee from
           another DHS component. Without adequate resources, OIE is unable
           to monitor and assess participating countries' compliance with the
           Visa Waiver Program's statutory requirements.

           In addition to resource constraints, DHS has not clearly
           communicated its mission to stakeholders at overseas posts, nor
           identified points of contact within U.S. embassies, so it can
           communicate directly with field officials positioned to monitor
           countries' compliance with Visa Waiver Program requirements and
           report on current events and issues of potential concern. In
           particular, within DHS's various components, we found that OIE is
           largely an unknown entity and, therefore, is unable to leverage
           the expertise of DHS officials overseas. A senior DHS
           representative at one post showed us that her organizational
           directory did not contain contact information for OIE.
           Additionally, a senior DHS official in Washington, D.C., told us
           that he may find out about developments-either routine or
           emergent-in visa waiver countries by "happenstance." Due to the
           lack of outreach and clear communication about its mission, OIE is
           limited in its ability to monitor the day-to-day law enforcement
           and security concerns posed by the Visa Waiver Program, and the
           U.S. government is limited in its ability to influence visa waiver
           countries' progress in meeting requirements.

           DHS Faces Difficulties in Mitigating Program Risks			  
			 
			  DHS has taken some actions to mitigate the risks of the Visa
           Waiver Program. However, though the law has required the timely
           reporting of blank passport thefts for continued participation in
           the Visa Waiver Program since 2002, DHS has not established and
           communicated time frames and operating procedures to participating
           countries. In addition, DHS has sought to expand this requirement
           to include the reporting of data, to the United States and
           Interpol, on lost and stolen issued passports; however,
           participating countries are resisting these requirements, and DHS
           has not yet issued guidance on what information must be shared,
           with whom, and within what time frame. Furthermore, U.S. border
           inspectors are unable to automatically access Interpol's data on
           reported lost and stolen passports, which makes detection of these
           documents at U.S. ports of entry more difficult.

           DHS Has Taken Some Actions to Mitigate Risks of the Visa Waiver
			  Program
			  
			  As previously mentioned, during the 2004 assessment process, the
           working group identified security concerns in several
           participating countries, and DHS took actions to mitigate some of
           these risks. Specifically, DHS determined that several thousand
           blank German temporary passports20 had been lost or stolen, and
           that Germany had not reported some of this information to the
           United States. As a result, as of May 1, 2006, German temporary
           passport holders are not allowed to travel to the United States
           under the Visa Waiver Program without a visa. In addition, DHS has
           enforced an October 26, 2005, deadline requiring travelers under
           the Visa Waiver Program to have digital photographs in their
           passports.

           DHS Lacks Standard Procedures for Obtaining Stolen Blank Passport
			  Data
			  
			  A key risk in the Visa Waiver Program is stolen blank passports
           from visa waiver countries, because detecting these passports at
           U.S. ports of entry is extremely difficult, according to DHS. Some
           thefts of blank passports have not been reported to the United
           States until years after the fact, according to DHS intelligence
           reports. For example, in 2004, a visa waiver country reported the
           theft of nearly 300 stolen blank passports to the United States
           more than 9 years after the theft occurred. The 2002 Enhanced
           Security and Visa Entry Reform Act provides that the Secretary of
           Homeland Security must terminate a country from the Visa Waiver
           Program if he and the Secretary of State jointly determine that
           the country is not reporting the theft of its blank passports to
           the United States on a timely basis. However, DHS has not
           established time frames or operating procedures to enforce this
           requirement. While the statute requires visa waiver countries to
           certify that they report information on the theft of their blank
           passports to the United States on a timely basis, as of June 2006,
           DHS has not defined what constitutes "timely" reporting. Moreover,
           the United States lacks a centralized mechanism for foreign
           governments to report all stolen passports. In particular, DHS has
           not defined to whom in the U.S. government participating countries
           should report this information.

           Some Participating Visa Waiver Program Countries are Resisting
			  Additional Reporting to United States and Interpol
			  
			  In addition to blank passports, lost or stolen issued passports
           also pose a risk because they can be altered. In June 2005, DHS
           issued guidance to participating Visa Waiver Program countries
           requiring that they certify their intent to report lost and stolen
           passport data on issued passports by August 2005. However, DHS has
           not yet issued guidance on what information must be shared, with
           whom, and within what time frame. Moreover, some visa waiver
           countries have not yet agreed to provide this information to the
           United States, due in part to concerns over the privacy of their
           citizens' biographical information. In addition, several consular
           officials expressed confusion about the current and impending
           requirements about sharing this data, and felt they were unable to
           adequately explain the requirements to their foreign counterparts.

           In June 2005, the U.S. government also announced its intention to
           require visa waiver countries to certify their intent to report
           information on both lost and stolen blank and issued passports to
           Interpol. In 2002, Interpol developed a database of lost and
           stolen travel documents to which its member countries may
           contribute on a voluntary basis. While most visa waiver countries
           use and contribute to Interpol's database, four do not. Moreover,
           some countries that do contribute do not do so on a regular basis,
           according to Interpol officials. Participating countries have
           expressed concerns about reporting this information, citing
           privacy issues; however, Interpol's database on lost and stolen
           travel documents does not include the passport bearers'
           biographical information, such as name and date of birth.21
           According to the Secretary General of Interpol, in light of the
           high value associated with passports from visa waiver countries,
           it is a priority for his agency to encourage countries to
           contribute regularly to the database.

           Inefficient Access to Interpolï¿½s Database on Lost and Stolen
			  Passports
			  
			  Though information from Interpol's database could potentially stop
           inadmissible travelers from entering the United States, CBP's
           border inspectors do not have automatic access to the database at
           the primary inspection point at U.S. ports of entry-the first line
           of defense against those who might exploit the Visa Waiver Program
           to enter the United States. The inspection process at U.S. ports
           of entry can include two stages-a primary and secondary
           inspection. If, during the primary inspection, the inspector
           suspects that the traveler is inadmissible either because of a
           fraudulent passport or other reason, the inspector refers the
           traveler to secondary inspection. At secondary inspection, border
           inspectors can contact officials at the National Targeting Center,
           who can query Interpol's stolen-travel-document database to
           determine if the traveler's passport had been previously reported
           lost or stolen, but is not yet on CBP's watch list.22 However,
           according to DHS, State, and Justice officials, because Interpol's
           data on lost and stolen travel documents is not automatically
           accessible to border inspectors at primary inspection, it is not
           currently an effective border screening tool. Moreover, according
           to the Secretary General of Interpol, until DHS can automatically
           query Interpol's data, the United States will not have an
           effective screening tool for checking passports. According to
           Interpol officials, the United States is working actively with
           Interpol on a potential pilot project that would allow for an
           automatic query of aliens' passport data against Interpol's
           database at primary inspection at U.S. ports of entry. However,
           DHS has not yet finalized a plan to do so.

           Recommendations to Improve Program Oversight and DHSï¿½s Response
			  
			  In our report, we made a series of recommendations to improve the
           U.S. government's process for assessing the risks in the Visa
           Waiver Program, including recommending that DHS provide additional
           resources to strengthen OIE's visa waiver monitoring unit;
           finalize clear, consistent, and transparent protocols for the
           biennial country assessments and provide these protocols to
           stakeholders at relevant agencies at headquarters and overseas;
           create real-time monitoring arrangements for all 27 participating
           countries; and establish protocols for direct communication
           between overseas posts and OIE's Visa Waiver Program Oversight
           Unit. In addition, we made recommendations to improve U.S. efforts
           to mitigate program risks, including requiring that all visa
           waiver countries provide the United States and Interpol with
           non-biographical data from lost or stolen issued passports, as
           well as from blank passports; developing clear standard operating
           procedures for the reporting of lost and stolen blank and issued
           passport data; and developing and implementing a plan to make
           Interpol's stolen travel document database automatically available
           during primary inspection at U.S. ports of entry. Given the
           lengthy time it took for DHS to issue the November 2005 summary
           report to Congress, and to ensure future reports contain timely
           information when issued, we also proposed that Congress establish
           a biennial deadline by which DHS must complete the country
           assessments and report to Congress.

           DHS either agreed with, or stated that it is considering, all of
           our recommendations. Regarding our matter for congressional
           consideration, DHS did not support the establishment of a deadline
           for the biennial report to Congress. Instead, DHS suggested that
           Congress should require continuous and ongoing evaluation. With
           continuous review, DHS stated that it would be able to constantly
           evaluate U.S. interests and report to Congress on the current
           2-year reporting cycle on targeted issues of concern, rather than
           providing a historical evaluation. We agree that continuous and
           ongoing evaluation is necessary, and that is why we recommended
           that DHS create real-time monitoring arrangements and provide
           additional resources to the Visa Waiver Program Oversight Unit to
           achieve this goal. Regarding the mandated biennial country
           assessments, we believe that they can serve a useful purpose if
           they are completed in a timely fashion.

           In closing, the Visa Waiver Program aims to facilitate
           international travel for millions of people each year and promote
           the effective use of government resources. Effective oversight of
           the program entails balancing these benefits against the program's
           potential risks. To find this balance, the U.S. government needs
           to fully identify the vulnerabilities posed by visa waiver
           travelers, and be in a position to mitigate them. It is imperative
           that DHS commit to strengthen its ability to promptly identify and
           mitigate risks to ensure that the Visa Waiver Program does not
           jeopardize U.S. security interests. This is particularly important
           given that many countries are actively seeking to join the
           program.

           Mr. Chairman, this concludes my prepared statement. I will be
           happy to answer any questions you or Members of the Subcommittee
           may have.

           Contacts and Staff Acknowledgments
			  
			  For questions regarding this testimony, please call Jess T. Ford,
           (202) 512-4128 or [email protected]. Individuals making key
           contributions to this statement include John Brummet, Assistant
           Director, and Kathryn H. Bernet, Joseph Carney, and Jane S. Kim.

           Related GAO Products and Ongoing Reviews
			  
			  Issued Reports
			  
			  Border Security: More Emphasis on State's Consular Safeguards
           Could Mitigate Visa Malfeasance Risks. GAO-06-115 . October 6,
           2005

           Border Security: Strengthened Visa Process Would Benefit From
           Improvements in Staffing and Information Sharing. GAO-05-859 .
           September 13, 2005

           Border Security: Actions Needed to Strengthen Management of
           Department of Homeland Security's Visa Security Program.
           GAO-05-801 . July 29, 2005.

           Border Security: Streamlined Visas Mantis Program Has Lowered
           Burden on Foreign Science Students and Scholars, but Further
           Refinements Needed. GAO-05-198 . February 18, 2005.

           Border Security: State Department Rollout of Biometric Visas on
           Schedule, but Guidance Is Lagging. GAO-04-1001 . September 9,
           2004.

           Border Security: Additional Actions Needed to Eliminate Weaknesses
           in the Visa Revocation Process. GAO-04-795 . July 13, 2004.

           Border Security: Improvements Needed to Reduce Time Taken to
           Adjudicate Visas for Science Students and Scholars. GAO-04-371 .
           February 25, 2004.

           Border Security: New Policies and Procedures Are Needed to Fill
           Gaps in the Visa Revocation Process. GAO-03-798 . June 18, 2003.

           Border Security: Implications of Eliminating the Visa Waiver
           Program. GAO-03-38 . November 22, 2002.

           Technology Assessment: Using Biometrics for Border Security.
           GAO-03-174 . November 15, 2002.

           Border Security: Visa Process Should Be Strengthened as an
           Antiterrorism Tool. GAO-03-132NI . October 21, 2002.

           Ongoing Reviews
			  
			  Review of International Aviation Passenger Prescreening. Requested
           by the Chairman and Ranking Member, Committee on the Judiciary,
           and the Ranking Member, Committee on Homeland Security, House of
           Representatives. Report expected in the fall of 1006.

           Review of the Department of State's Measures to Ensure the
           Integrity of Travel Documents. Requested by the Chairman,
           Committee on the Judiciary, House of Representatives; Chairman
           John N. Hostettler and member Darrell E. Issa, Subcommittee on
           Immigration, Border Security and Claims, Committee on the
           Judiciary, House of Representatives; and, Chairman Lamar S. Smith,
           Subcommittee on Courts, the Internet, and Intellectual Property,
           Committee on the Judiciary, House of Representatives. Report
           expected in the spring of 2007.

           Review of the Department of State's Effort to Address Delays in
           Visa Issuance. Requested by the Chairman and Ranking Member of the
           Committee on Government Reform, House of Representatives. Report
           expected in the spring of 2007.

           Review of Immigrant Visa Processing. Requested by the Ranking
           Member, Committee on Homeland Security, House of Representatives.
           Report expected in mid-2007.

           GAOï¿½s Mission
			  
			  The Government Accountability Office, the audit, evaluation and
           investigative arm of Congress, exists to support Congress in
           meeting its constitutional responsibilities and to help improve
           the performance and accountability of the federal government for
           the American people. GAO examines the use of public funds;
           evaluates federal programs and policies; and provides analyses,
           recommendations, and other assistance to help Congress make
           informed oversight, policy, and funding decisions. GAO's
           commitment to good government is reflected in its core values of
           accountability, integrity, and reliability.

           Obtaining Copies of GAO Reports and Testimony
			  
			  The fastest and easiest way to obtain copies of GAO documents at
           no cost is through GAO's Web site ( www.gao.gov ). Each weekday,
           GAO posts newly released reports, testimony, and correspondence on
           its Web site. To have GAO e-mail you a list of newly posted
           products every afternoon, go to www.gao.gov and select "Subscribe
           to Updates."

           Order by Mail or Phone
			  
			  The first copy of each printed report is free. Additional copies
           are $2 each. A check or money order should be made out to the
           Superintendent of Documents. GAO also accepts VISA and Mastercard.
           Orders for 100 or more copies mailed to a single address are
           discounted 25 percent. Orders should be sent to:

           U.S. Government Accountability Office 441 G Street NW, Room LM
           Washington, D.C. 20548

           To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax:
           (202) 512-6061

           To Report Fraud, Waste, and Abuse in Federal Programs
			  
			  Contact:

           Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail:
           [email protected] Automated answering system: (800) 424-5454 or
           (202) 512-7470

           Congressional Relations
			  
			  Gloria Jarmon, Managing Director, [email protected] (202) 512-4400
           U.S. Government Accountability Office, 441 G Street NW, Room 7125
           Washington, D.C. 20548

           Public Affairs
			  
			  Paul Anderson, Managing Director, [email protected] (202)
           512-4800 U.S. Government Accountability Office, 441 G Street NW,
           Room 7149 Washington, D.C. 20548

15P.L. 99-603.

16See GAO, Border Security: Implications of Eliminating the Visa Waiver
Program, GAO-03-38 (Washington, D.C.: Nov. 22, 2002).

17Travelers with passports issued after the deadline that do not meet
these requirements must obtain a visa from a U.S. embassy or consulate
overseas before departing for the United States. In general, e-passports
will contain a chip embedded in the passport that will store the same
information that is printed on the data page of the passport, such as
name, date of birth, gender, place of birth, dates of passport issuance
and expiration, place of issuance, passport number, and a photo image of
the bearer.

18 GAO-03-38 .

19 GAO-05-859 and GAO-03-132NI .

20German temporary passports are valid for one year, and are less
expensive than standard German passports. In addition, they are issued at
more than 6,000 locations across Germany, whereas the Ministry of Interior
issues the standard passports centrally.

21Interpol's database includes the passport's identity number, the country
of issuance, and the country where the loss or theft occurred. According
to officials from Justice's Interpol-U.S. National Central Bureau, it is
particularly important that countries report this information, as well as
the date of the theft and the issuance date.

22Interpol's data on lost and stolen passports are not available when
border inspectors screen travelers' passports at primary inspection unless
Interpol has shared this information with the United States in separate
reports and it has been manually entered into DHS watch lists.

(320455)

This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed in
its entirety without further permission from GAO. However, because this
work may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this material
separately.

www.gao.gov/cgi-bin/getrpt? GAO-06-1090T .

To view the full product, including the scope
and methodology, click on the link above.

For more information, contact Jess Ford at (202) 512-4128 or
[email protected].

Highlights of GAO-06-1090T , a testimony before the Chairman, Subcommittee
on Terrorism, Technology, and Homeland Security, Committee on the
Judiciary, U.S. Senate

September 7,2006

BORDER SECURITY

Stronger Actions Needed to Assess and Mitigate Risks of the Visa Waiver
Program

The Visa Waiver Program enables citizens of 27 countries to travel to the
United States for tourism or business for 90 days or less without
obtaining a visa. In fiscal year 2005, nearly 16 million people entered
the country under the program. After the 9-11 terrorist attacks, the risk
that aliens would exploit the program to enter the United States became
more of a concern. This testimony discusses our recent report on the Visa
Waiver Program. Specifically, it (1) describes the Visa Waiver Program's
benefits and risks, (2) examines the U.S. government's process for
assessing potential risks, and (3) assesses the actions taken to mitigate
these risks. We met with U.S. embassy officials in six program countries
and reviewed relevant procedures and reports on participating countries.

What GAO Recommends

In our report, we made a series of recommendations to DHS to strengthen
its ability to assess and mitigate the program's risks, such as providing
more resources to the program's monitoring unit and issuing standards for
the reporting of lost and stolen passport data. We also stated that
Congress should consider establishing a deadline for the mandated biennial
report to Congress. DHS generally agreed with our report and
recommendations, but did not agree that Congress should establish a
deadline for the biennial report.

The Visa Waiver Program has many benefits as well as some inherent risks.
It facilitates travel for millions of people and eases consular workload,
but poses challenges to border inspectors, who, when screening visa waiver
travelers, may face language barriers or lack time to conduct in-depth
interviews. Furthermore, stolen passports from visa waiver countries are
prized travel documents among terrorists, criminals, and immigration law
violators, creating an additional risk. While the Department of Homeland
Security (DHS) has intercepted many fraudulent documents at U.S. ports of
entry, DHS officials acknowledged that an undetermined number of
inadmissible aliens may have entered the United States using a stolen or
lost passport from a visa waiver country.

DHS's process for assessing the risks of the Visa Waiver Program has
weaknesses. In 2002, Congress mandated that, every 2 years, DHS review the
effect that each country's continued participation in the program has on
U.S. law enforcement and security interests, but did not set a reporting
deadline. In 2004, DHS established a unit to oversee the program and
conduct these reviews. We identified several problems with the 2004 review
process, as key stakeholders were not consulted during portions of the
process, the review process lacked clear criteria and guidance to make key
judgments, and the final reports were untimely. Furthermore, the
monitoring unit cannot effectively achieve its mission to monitor and
report on ongoing law enforcement and security concerns in visa waiver
countries due to insufficient resources.

DHS has taken some actions to mitigate the program's risks; however, the
department has faced difficulties in further mitigating these risks. In
particular, the department has not established time frames and operating
procedures regarding timely stolen passport reporting-a program
requirement since 2002. Furthermore, DHS has sought to require the
reporting of lost and stolen passport data to the United States and the
International Criminal Police Organization (Interpol), but it has not
issued clear reporting guidelines to participating countries. While most
visa waiver countries report to Interpol's database, four do not. Further,
DHS is not using Interpol's data to its full potential as a border
screening tool because U.S. border inspectors do not automatically access
the data at primary inspection.
*** End of document. ***