Border Security: More Emphasis on State's Consular Safeguards	 
Could Mitigate Visa Malfeasance Risks (06-OCT-05, GAO-06-115).	 
                                                                 
Issuing a U.S. visa to a foreign citizen in exchange for money or
something of value is a crime that can facilitate entry into the 
United States of unqualified persons, including those who may	 
wish to do our country harm. Internal controls make it difficult 
for an employee to commit visa malfeasance without being	 
detected, but, despite these safeguards, visa malfeasance does	 
occur. GAO examined (1) State's internal controls to prevent	 
nonimmigrant visa malfeasance and if they are being implemented  
and (2) visa malfeasance cases from 2001-2004 and factors cited  
by State and the Department of Justice (Justice) that contributed
to visa malfeasance and affected investigations and prosecutions.
-------------------------Indexing Terms------------------------- 
REPORTNUM:   GAO-06-115 					        
    ACCNO:   A39138						        
  TITLE:     Border Security: More Emphasis on State's Consular       
Safeguards Could Mitigate Visa Malfeasance Risks		 
     DATE:   10/06/2005 
  SUBJECT:   Border control					 
	     Border security					 
	     Fraud						 
	     Internal controls					 
	     Malfeasance					 
	     Standards						 
	     Strategic planning 				 
	     Visas						 
	     Crime prevention					 
	     Noncompliance					 

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Product.                                                 **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************
GAO-06-115

United States Government Accountability Office

GAO	Report to the Chairman, Committee on the Judiciary, House of Representatives

October 2005

BORDER SECURITY

  More Emphasis on State's Consular Safeguards Could Mitigate Visa Malfeasance
                                     Risks

                                       a

GAO-06-115

[IMG]

October 2005

BORDER SECURITY

More Emphasis on State's Consular Safeguards Could Mitigate Visa Malfeasance
Risks

                                 What GAO Found

State has a set of internal controls to prevent visa malfeasance and has
taken actions to improve them; however, these internal controls are not
being fully and consistently implemented by the posts we visited. While
State's controls are consistent with accepted control standards, we found
noncompliance with required supervisory oversight at 6 of the 11 posts we
visited. This included failure to inventory items used to issue visas,
review visa decisions, and follow State's procedures when issuing visas
for applicants referred by officers within the post. Lack of full
compliance with internal controls increases vulnerability to visa
malfeasance. State recently established two headquarters entities to
monitor post visa operations. While stronger oversight should help
strengthen compliance with internal controls, State has not developed
automated software to sort and analyze abnormalities in visa issuances
that could indicate potential malfeasance.

The Bureau of Diplomatic Security substantiated 28 visa malfeasance cases
between 2001 and 2004 involving U.S. employees. The suspects were fired,
chose to resign, or were arrested. State investigators could not tell us
how many opened cases were referred to Justice for possible prosecution
because they had not been routinely collecting that information. In fact,
their case records did not permit investigators to identify malfeasance
trends or consular managers to identify internal control weaknesses
needing attention. Justice's Public Integrity Section successfully
prosecuted 10 U.S. government employees. State Diplomatic Security and
Justice officials noted that their investigations and prosecutions were
impeded by constraints on evidence gathering. Additionally, investigators
can not obtain U.S. search warrants to search consular officer's offices
or residences overseas. Justice and State are discussing the possibility
of pursuing legal changes and other means to address these constraints.

Selected Key Internal Control Requirements and Status of Implementation
Issue Requirement Implementation

Control of accountable State's internal controls call for Most posts did
not reconcile the

items	the maintenance of careful differences between inventory records on
the use of records and stocks of blank visas controllable items. on hand
quarterly as required,

although daily reconciliations were routinely performed.

Criteria for post-referred State requires posts to Compliance with State's
referral

applicants	establish a formal post-wide policies and procedures were not
referral system, reissue the consistently followed at seven of the
procedures annually, and posts we reviewed. Moreover, four ensure that the
applicants posts did not have the required post meet the departmentwide
policy to supplement State policies. criteria specified on the forms.

Source: GAO.

United States Government Accountability Office

Contents

  Letter 1

Results in Brief 2

Background 4

Consular Affairs Has Internal Controls over the Visa Process, but

Controls Are Not Being Fully Implemented at Posts GAO

Reviewed 6 Documented Cases of Visa Malfeasance 19 Conclusions 25
Recommendations for Executive Action 26 Agency Comments and Our Evaluation
27

Appendix I: Scope and Methodology 29

Appendix II: Comments from the Department of State 32

Appendix III: GAO Contact and Staff Acknowledgments 39

Table Table 1:	State Department Key Internal Control Requirements and
Status of Implementation

Figure Figure 1: The Nonimmigrant Visa Process

Abbreviations

VAU Vulnerability Assessment Unit
CMAT Consular Management Assistance Teams

This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed in
its entirety without further permission from GAO. However, because this
work may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this material
separately.

A

United States Government Accountability Office Washington, D.C. 20548

October 6, 2005

The Honorable F. James Sensenbrenner, Jr.
Chairman
Committee on Judiciary
House of Representatives

Dear Mr. Chairman:

Issuing a U.S. visa to a foreign citizen in exchange for money or
something
of value is a crime that can facilitate entry into the United States of
unqualified persons, including those who may wish to do our country harm.
In fiscal year 2004, Department of State (State) consular officers issued
more than 5 million visas at 211 overseas posts.1 According to State's
criminal investigators, some applicants offer bribes to U.S. government
employees in an attempt to obtain visas. The integrity of U.S. government
employees and controls over the visa process are pivotal to preventing
visa
malfeasance. Visa officers are professional employees who undergo
extensive background checks, have top secret security clearances, and
receive training and guidance in visa procedures and ethical conduct.
However, some cases of visa malfeasance have occurred involving consular
officers and other U.S. government officials.2 For example, in 2004, two
consular officers were convicted and sentenced for selling visas for
hundreds of thousands of dollars between 2000 and 2003. In this case,
State's Bureau of Consular Affairs determined that the malfeasance
occurred in part because of breaches in internal control procedures. Full
compliance with internal controls makes it difficult for an employee to
commit visa malfeasance without being detected.

This report examines (1) State's internal controls to prevent visa
malfeasance, and whether they are being implemented, and (2) visa
malfeasance cases from 2001 to 2004, and factors cited by State and the
Department of Justice (Justice) that contributed to visa malfeasance and
affected investigations and prosecutions. To conduct our review, we

1For the purposes of this report, visas refer to nonimmigrant visas for
temporary entry to the United States. State also issues immigrant visas
for permanent entry to the United States.

2For the purposes of this report, visa malfeasance refers to fraud
committed by a U.S. government employee. This type of malfeasance is also
called internal fraud. External fraud or fraud committed by a visa
applicant or non-U.S. government personnel is not covered in this report.

analyzed key internal controls over the visa process identified by State.
We visited posts in six countries: Mexico, Ecuador, Peru, Vietnam,
Thailand, and India. We observed visa adjudications and assessed post
adherence to those internal controls. We also obtained statistics on cases
of visa malfeasance and the investigative outcomes. Additionally, we
discussed the investigative process with State's Bureau of Diplomatic
Security and the Office of the Inspector General. At Justice, we discussed
general factors affecting Justice's decisions to prosecute cases and
obtained data on the results of some prosecuted cases. We conducted our
review from August 2004 to July 2005 in accordance with generally accepted
government auditing standards. Appendix I provides more information on our
scope and methodology. We have issued a separate report on actions taken
to improve the visa process since 2002 and areas that need additional
management attention.3

Results in Brief	State's Bureau of Consular Affairs has a set of internal
controls to prevent visa malfeasance and has taken actions to improve
them; however, these internal controls are not being fully and
consistently implemented at the posts we visited. While State's controls
are consistent with accepted control standards, we found noncompliance
with required supervisory oversight of the visa process at 6 of the 11
posts we visited. This was manifested in a number of ways, including
failure to (1) inventory accountable items used to issue visas, (2)
independently review issued visas, and (3) follow State's established
procedures when post officers refer applicants for expedited visa
adjudication. Lack of full compliance with internal controls increases
vulnerability to visa malfeasance. Consular Affairs recently strengthened
its headquarters' oversight of post visa operations. For example, it
established a headquarters unit to monitor visa adjudications. However,
State has not developed software to sort and analyze abnormalities in visa
issuances that could indicate potential malfeasance, but is in the process
of doing so. This stronger oversight should help strengthen compliance
with internal controls.

According to the Bureau of Diplomatic Security, it substantiated 28 cases
of alleged employee visa malfeasance between 2001 and 2004. The suspects
were fired, chose to resign, or were arrested. Investigators from State's
Bureau of Diplomatic Security could not tell us how many opened cases

3See GAO, Border Security: Strengthened Visa Process Would Benefit from
Improvements in Staffing and Information Sharing, GAO-05-859 (Washington
D.C.: Sept. 13, 2005).

were referred to Justice for possible prosecution because they had not
been routinely collecting that information. In fact, their case records
did not allow for production of data on case trends, such as
vulnerabilities in the visa process, which would be useful to consular
managers. Justice's Public Integrity Section successfully prosecuted 10
government employees during this time period.4 Justice and State
Diplomatic Security officials noted that prosecutions were impeded by
legal constraints on evidence gathering. In particular, these officials
said that it is difficult to investigate and prosecute visa malfeasance
because other employee witnesses may not report their suspicions until
they are reassigned to another post, and this delay makes the timely
collection of evidence difficult. Furthermore, according to Justice and
State, conducting investigations overseas is cumbersome for various
reasons. For example, according to Justice, some host country laws can
make it difficult for investigators to obtain financial records of U.S.
employees residing overseas. Also, under U.S. law, U.S. magistrates
generally cannot issue warrants for U.S. investigators to search an
employee's office or leased residence overseas. Justice and State have
discussed for some time the possibility of pursuing additional search
authorities to address these constraints, but have not determined a course
of action.

To emphasize the importance of internal controls to consular officers,
section heads, and post managers, we recommend that the Secretary of State

o 	Develop a strategy to achieve strict compliance with internal controls.
The strategy should include a system to spot check compliance. The
strategy should also include formalized procedures in Fraud Prevention
Units to document how the post will address the risk of employee
malfeasance and emphasize the importance of reporting suspected
malfeasance to consular managers and post security officers.

o 	Improve State's existing mechanisms to combat visa malfeasance. This
could be accomplished by (1) improving the software available to the
Vulnerability Assessment Unit to automatically sort data to identify and

4State does not keep records on all cases involving prosecution of its
employees. Some of the individuals prosecuted were involved in the same
fraud schemes. The United States Attorneys Offices also prosecute
malfeasance cases. Although prosecuted by these offices, cases may be
compiled and sorted according to the statute charged, for example, 18
U.S.C. 1546, available data do not separate out visa fraud cases that
specifically charge malfeasance, as opposed to other types of visa fraud.
Thus, we did not examine such cases.

analyze abnormalities in post visa issuance statistics that could be an
indication of malfeasance and (2) enhancing the investigative case
tracking systems used by the Bureau of Diplomatic Security to better
identify trends and vulnerabilities in the visa process for use by
investigators and consular managers.

We also recommend that the Secretary of State and the Attorney General
determine whether seeking additional overseas search authorities is
warranted to facilitate investigations of visa malfeasance. If they
determine that such authorities are warranted, the Secretary of State and
the Attorney General should develop an implementation plan and notify the
Congress of any required legislative changes.

State agreed with the conclusions in our report, is taking steps to
reinforce and monitor compliance with internal controls at overseas posts,
and plans to implement our recommendations.

Background	Foreign citizens wishing to temporarily enter the United States
generally fill out a visa application; make an appointment; pay a fee;
submit photographs and other documents; provide 2-digit fingerprints; and
appear for a document review, name check against government watch lists,
and interview with a State consular officer at an American Embassy or
Consulate. Consular officers review applications, interview applicants,
execute name checks through the Consular Lookout and Support System,5 make
notations, and assess whether the applicant may be an intending immigrant,
a potential threat to national security, or otherwise ineligible.
Following these steps, the applicant is granted or refused a visa, or
subjected to additional security checks. (See fig. 1.) Consular officers
are assisted by locally hired staff who are generally not U.S. citizens.
These staff perform support tasks but do not adjudicate visas.

5This system, called CLASS, is a State name-check database that posts use
to access critical information for visa adjudication. The system contains
records provided by numerous agencies and includes information on persons
with visa refusals, immigration violations, criminal histories, and
terrorism concerns.

concerns. This guidance is provided in the Foreign Affairs Manual and the
Consular Management Handbook, as well as through periodic policy updates
of standard operating procedures transmitted to overseas posts and placed
on an intranet site.

While the Office of the Inspector General and Diplomatic Security share
authority for investigating visa malfeasance, Diplomatic Security conducts
most of the investigations. In particular, Diplomatic Security's Visa
Fraud Branch investigates visa malfeasance cases and carries out related
enforcement functions for State. These cases are typically pursued by a
regional security officer and consular management and involve observation
of the suspected employee and collection of evidence to document the
malfeasance. In cases where Justice determines sufficient evidence exits,
it will prosecute employees who are accused of malfeasance.

  Consular Affairs Has Internal Controls over the Visa Process, but Controls Are
  Not Being Fully Implemented at Posts GAO Reviewed

The Bureau of Consular Affairs has established a number of key internal
controls designed to mitigate the risk of employee malfeasance, some of
which are new or have been reinforced since September 11, 2001. Among the
controls State has emphasized are: limiting employee access to visa
issuing systems and applicants, periodic reconciliations of visa stocks,
specific criteria for post employees to follow when referring foreign
individuals seeking visas for favorable treatment by consular officials,
and mechanisms to provide oversight of key consular activities by post and
Consular Affairs headquarters management. While Consular Affairs' controls
are consistent with accepted control standards,6 we found that some of the
controls were not always being followed at the posts we visited.

    Internal Controls Are in Place, and Many Are Either New or Have Been
    Reinforced

To prevent the issuances of nonimmigrant visas to unqualified applicants,
Consular Affairs has strengthened its efforts to limit employee access to
automated systems that issue visas and has taken steps to ensure that visa
applicants cannot predict which officers will interview them.
Additionally, Consular Affairs has a series of controls over accountable
items. It has also strengthened its criteria for applicants referred by
post employees for

6"Standards for Internal Control in the Federal Government,"
(GAO/AIMD-00-21.3.1, Nov. 1999) identifies the need for internal controls
such as physical controls over vulnerable assets, segregation of duties to
reduce the risk of fraud, limited access to and accountability of
resources and systems, and top-level reviews of actual performance.

favorable consideration in obtaining a visa and expedited processing by
consular officers. Further, Consular Affairs has increased its emphasis on
both headquarters and post supervisory oversight. It also requires posts
to certify in writing annually their compliance with key internal
controls. Consular Affairs has issued guidelines on reporting suspicious
behavior that may involve malfeasance. It has also enhanced its
malfeasance prevention efforts.

Controlled Access to Visa Issuing The increased dependence of consular
officers on automated systems

Systems	requires Consular Affairs to have effective management controls
over these systems. Consular Affairs has strengthened its existing
controls over visa issuing systems by restricting employee access to key
systems and safeguarding passwords, thereby emphasizing consular officers'
accountability for visa issuance and providing an audit trail to document
which officer issued each visa. For example:

o 	The Consular System Administrator controls employees' access to the
automated consular systems by assigning user identifiers and roles.
Designated consular officers ensure appropriate access to consular
automated functions; an administrator specifically assigns each consular
employee a specific role; and the computer system only allows consular
staff to perform functions associated with that role. For example, only
officers that adjudicate visas are assigned a system role that permits
them to authorize visa issuance.

o 	In February 2004, Consular Affairs strengthened controls over access to
employee computers by requiring that passwords be known only to the users
and that they be changed semi-annually. In the past, employee passwords
were assigned by the system administrator, but are now chosen by the
employee. As an additional safeguard, employees are now reminded to lock
their computers when not at their desks, and the system is set to
automatically lock after an interval of idleness.

o 	Consular Affairs controls access of applicants to visa adjudicators and
consular staff. To prevent applicants targeting a particular consular
officer, Consular Affairs requires that consular officers interview
applicants in a random manner, with no single person controlling the
process. When translators are used, they are to be rotated among the
adjudicators.

Controls over Accountable Items	To reduce the risk that blank visas will
be stolen or that visas will be issued without being properly recorded in
the consular systems, it is Consular

Affairs' standard practice to safeguard blank visas and other accountable
items, closely monitor usage, conduct frequent inventories, and reconcile
discrepancies quickly. Each post must designate a primary and backup
accountable consular officer to be responsible for controlled items.
Further, Consular Affairs procedures require controlled items to be
reconciled daily, verified quarterly, and certified annually by senior
consular or post officials. At least quarterly, the accountability officer
must physically count the stock of each accountable item and reconcile the
inventory ledger, ensuring that the number of the item on hand in fact
matches the number that the ledger indicates should be on hand.
Discrepancies between inventory records and stocks of blank visas on hand
that can not be resolved must be reported within 24 hours to Consular
Affairs management.

Criteria for Post-Referred U.S. officers from any U.S. government agency
posted at embassies and

Applicants	consulates may refer to the consular section for favorable
consideration and expedited processing foreign applicants where visa
issuance would support U.S. interests or those of the mission.7 This
so-called visa referral is a means for other embassy officials to provide
additional information on a visa case and to document a perceived U. S.
national interest served in facilitating the travel of the applicant.
According to a 2005 State Inspector General's report,8 embassy staff or
prominent local figures often appeal to ambassadors or other mission
managers for favorable consideration in obtaining visas, and consular
officers have felt pressure to provide such assistance. To ensure that
post staff refer visas only for qualified applicants, Consular Affairs has
strengthened and formalized its criteria for issuing referred visas.9
Prior to 2002, posts individually interpreted the guidelines on making
referrals and many posts did not have formal referral policies. In 2002,
Consular Affairs required posts to establish a formal postwide referral
system. Under this system, referral procedures are to be reissued
annually, and supervisory consular officers are to periodically

7Class A referrals are generally for high level foreign officials,
business persons, the press, military trainees, cultural exchanges, or
well-known performers. The interview may be waived for these referrals.
Class B referrals result in procedural courtesies, such as early
appointments, and require both fingerprinting and applicant interviews.

8Report of Inspection: Nonimmigrant Visa Adjudication: the Visa Referral
Process, ISP-CA-05-56, March 2005.

9State 9 FAM Appendix K, "Visa Referral Systems," dated May 16, 2002,
provides criteria that posts must use in developing their referral
policies. Unique characteristics of a post may dictate additional
procedures that officers should follow when making a referral.

review referral activities, specifically noting frequency of referrals by
officer as well as applicant return-to-country rates. Consistent with the
new congressionally mandated biometric and interview requirements, the new
referral criteria require

o 	fingerprinting and photos of all applicants and personal interviews of
nearly all referred visa applicants,

o  mandatory use of revised referral forms,

o 	certification that the applicant is personally known to the sponsor and
presents no threat to national security,

o  supervisory approval of the referral request by the sponsor's
supervisor,

o 	scanning of applicant forms and referral requests into the nonimmigrant
visa system to provide a record and an audit trail, and

o  post management reviews of aggregate visa trends by referrer.

Since 2002, Consular Affairs has repeatedly reiterated referral criteria
in policy updates and clarifications to overseas posts. Moreover, during
our review, in June 2005, Consular Affairs again revised the referral
policy reiterating the need for senior consular officers to adjudicate
Class A referrals and requiring posts to provide the Bureau of Consular
Affairs copies of their referral policies. In addition, Consular Affairs
said that it gives briefings to every ambassador, deputy chief of mission,
and principal officer emphasizing the importance of strict compliance with
the visa referral policy, that visa referrals are tracked, and that
mission leaders bear responsibility and liability for their own referrals.

Emphasis on Supervisory Citing cases of consular malfeasance resulting
from lax supervision over

Oversight	consular functions, Consular Affairs has continually emphasized
the need for supervisory oversight of the visa function, particularly by
ambassadors, deputy chiefs of mission, or principal officers. Depending on
the size of the post, daily oversight is exercised by senior consular
officers over nonimmigrant visa section chiefs (who supervise adjudicating
officers and other consular staff) or by the most senior available post
officer. Senior consular section chiefs, who generally adjudicate
referrals or other visas at smaller posts, are supervised by senior post
managers. Consular Affairs requires that supervisors review all visa
refusals daily and perform spot-

checks of issuances, as well as undertake periodic reviews of post
referrals.

Supervisors have tools to assist with this responsibility. For example,
the Nonimmigrant Visa application allows on-line oversight through reports
of consular activities, such as daily visa refusals and issuances,
including the time of visa issuance; the applicants interviewed and their
nationalities; and the types of visas issued, including those for
visitors, students, businesspersons, professionals, and performing
artists, as well as the reasons for denials. Additionally, reports
providing aggregate information on the number and types of referrals made
by each post officer and their disposition are available. A recent
enhancement to the system permits supervisors to view applications and
referral forms showing applicant's purpose of travel and whether the
referral was signed appropriately and reviewed as required.

Consular Affairs also has emphasized in cables and training the importance
of ambassadors, deputy chiefs of mission, and principal officers'
supervisory role in reviewing the visa function. According to State
officials, training courses for these offices have included information on
the consular function, oversight responsibilities, and employee
malfeasance. According to State training records, the senior managers at
six posts we visited had received this training.

Certification of Internal Controls	To ensure that the internal controls
over the visa process are being implemented, State requires that chiefs of
mission certify annually that the controls are adequate.10 In addition,
since September 2002, State has required that consular managers certify
their compliance with key controls over the visa process to chiefs of
mission and to Consular Affairs. Each year, posts are required to issue a
report certifying their compliance with internal controls, including
routine inventory counts of controlled items, established referral
policies and procedures, and supervisory reviews of visa refusals and
issuances. In October 2004, Consular Affairs required the review of 19
controls by each post.

10State Cables to posts 247059 and 201680, "Annual Certification of
Consular Management Controls" dated August 2003 and September 2004,
respectively.

Assessing Visa Malfeasance and Reporting Suspicious Behavior

Increased Headquarters' Oversight

To safeguard the visa process, consular sections are required to assess
post vulnerability to employee malfeasance.11 Posts are to identify
internal visa malfeasance risks, such as inadequate oversight procedures,
and to assess post vulnerability to external fraud, such as bribery.12 To
assess this vulnerability, Consular Affairs has established Fraud
Prevention Units at posts and designated Fraud Prevention Manager
positions. The units are responsible for detecting suspected fraud by visa
applicants as well as possible employee malfeasance, and coordinating with
the regional security officer and local law enforcement authorities as
necessary. The positions are often filled on a part-time basis by consular
officers who are responsible for making vulnerability assessments along
with their other duties.13

Consular Affairs also has guidance on reporting suspicious behavior.
Employees are required to report suspicions of employee malfeasance to the
senior consular manager at post and the regional security officer, unless
one of them is believed to be involved in the malfeasant activity.14
Further, State's guidance on reporting malfeasance emphasizes the need to
protect the integrity of an investigation and the commitment of
confidentiality to the source of an allegation. As such, State's standard
operating procedures call for potential malfeasance information to be
closely held at post and in the department.

With 211 visa issuing posts, State requires adequate and continuous
oversight to reduce the risks of visa malfeasance.15 Headquarters

11Standard Operating Procedure 56, "Checklist for Preventing and/or
Reporting Consular Malfeasance," December 2003 and updated in State cable
141874, "Reminder-Reporting Consular Malfeasance," August 1, 2005.

12External fraud involves non-U.S. government employee assistance to
individuals attempting to enter the United States illegally.

13State established a Fraud Prevention Program in 1986 to combat visa
fraud. Fraud Prevention Units at overseas posts have dedicated
investigator positions, which generally are staffed by local hires. As of
2005, 13 Consular Affairs Officer positions worldwide were dedicated
full-time to fraud prevention programs.

14Standard Operating Procedure 56, "Checklist for Preventing and/or
Reporting Consular Malfeasance," December 2003 and updated in State cable
141874, "Reminder-Reporting Consular Malfeasance," August 1, 2005.

15Consular Management Handbook Section 600, Management Controls,
Anti-Fraud, and Malfeasance, March 9, 2001.

management is an essential part of that oversight. To assist headquarters
in monitoring post operations, State established the Vulnerability
Assessment Unit (VAU) jointly staffed by Consular Affairs and Diplomatic
Security. In addition, Consular Affairs established Consular Management
Assistance Teams (CMAT). VAU, established in 2003, attempts to detect and
prevent possible employee malfeasance by analyzing consular data from
State's Consular Consolidated Database. VAU reviews several different
reports for variations that could indicate malfeasance. Among other
things, these reports and other information can (1) identify whether
senior officers with responsibility for reviewing adjudications have
access to automated systems to do required reviews of visa adjudications,
as well as whether they are actually doing so; (2) determine whether post
employees follow procedures and use appropriate forms to make referrals
for applicants; (3) review issuance and refusal rates of adjudicators; and
(4) review rates of visa refusals overturned by senior officers. In 2003,
State instituted CMATs to perform informal reviews of consular functions.
The teams, which are provided VAU reports on consular activities, examine
access controls, inventory reconciliations, training and knowledge of
consular applications, appropriate use of referral procedures, supervisory
reviews of daily adjudications, and other visa issues. Posts are selected
for CMAT examination if there is knowledge of a management problem and a
review can help to identify a systemic problem, if posts request a review,
or if there has been a previous case of malfeasance at the post. CMAT
reports, which may include recommendations to improve post management, are
sent to State's Bureau of Consular Affairs and to the posts. State has
conducted 81 CMAT reviews, including reviews of several posts twice, since
program inception.

    Internal Controls Not Fully and Consistently Implemented

Consular Affairs has established and reinforced a system of internal
controls, described above, designed to reduce visa malfeasance risks;
however, we found that the controls were not being fully and consistently
implemented. All the posts we visited had limited employee access to
systems and applicant access to consular staff. However, we found that
inventory counts of accountable items were performed inconsistently.
Further, the referral policy was not followed. Also, supervisory
adjudication reviews were not performed consistently. Moreover, we found
that some posts had certified compliance with these controls when we, and
in some cases, CMAT teams, indicated that they were not in compliance. In
addition, staff were unclear on employee malfeasance reporting policies.
Finally, headquarters oversight has been hindered by the lack of enhanced
technical tools to identify potential malfeasance. Table 1 summarizes the

results of our review of internal controls over the visa process at the 11
posts we visited.

Table 1: State Department Key Internal Control Requirements and Status of
Implementation

     Issue           Requirement                   Implementation             
Access to  These controls restrict      We found that all 11 posts were in 
sensitive  employee access to key                      compliance with the 
              systems, safeguard        internal controls designed to prevent 
    systems   passwords, and require    unauthorized                          
              additional oversight over personnel from having access to       
                  controlled items.     sensitive systems.                    

Access to adjudicators	Consular sections are to ensure random access When
able, most posts have implemented the systems between applicants and
adjudicators. and procedures necessary to ensure random access

a

between applicants and adjudicators.

Control of accountable Specific records must be kept regarding the Most
posts did not reconcile the differences between items shipment, use, and
destruction of controllable items inventory records and stocks of blank
visas on hand on a daily, quarterly, and annual basis. quarterly as
required, although daily reconciliations were routinely performed.

Criteria for applicants referred by officerswithin the post Posts must
establish a formal post-wide referral system, reissue the procedures
annually, and ensure that the applicants meet the departmentwide criteria
specified on the referral forms. Compliance with State's referral policies
and procedures were not consistently followed at seven of the posts we
reviewed. Moreover, four posts did not have the required post policy
supplementing State issued policies. Emphasis on

 Supervisory reviews are required daily on all visa Required daily supervisory
                         reviews of visa adjudications

post supervisory oversight

refusals and spot-checks of issuances, as well as monthly reviews of post
referrals.

              were not always done at six of the posts we visited.

Certification of internal Chiefs of missions must certify annually that We
found that six posts had erroneously certified their

controls	internal controls are adequate. These certifications compliance
with internal controls and some posts are based on consular managers'
assessment of submitted incomplete certifications. the section's adherence
to internal controls.

Assessing visa Posts are required to have  Although posts told us they     
                  fraud prevention            have fraud prevention           
    malfeasance   programs to address visa     programs, many posts did not   
                  fraud risks, including              have the plans          
                  employee malfeasance risks. documented. None of the posts   
                           Moreover, Consular indicated they had              
                  Affairs encourages posts to          written procedures for 
                  develop standard              mitigating malfeasance risks. 
                  procedures for all consular 
                          functions.          

Reporting of suspicious Internal control standards require agencies to
Many staff at the posts we visited were not aware that

behavior	clearly establish areas of authority and appropriate suspected
malfeasance should be reported to the lines for reporting malfeasance.
Consular Affairs Regional Security Officer. This could compromise requires
suspected malfeasance be reported to subsequent investigations. Consular
Affairs Managers and the Regional Security Officer.

Increased HQ oversight	Internal control standards require top level
analysis State has established two units that provide top-level of agency
performance. management with information on post performance.

Source: GAO.

aPosts with one or two consular officers have difficulty ensuring random
access to adjudicators.

Access to Visa Systems and Staff Controlled

Inventory Reconciliations Performed Inconsistently

Referral Policy Not Followed

To reduce the risks of visa malfeasance, all the posts we visited had
complied with department directives to limit employee access to visa
issuing systems. This compliance ensured that employees only had
appropriate level access to accomplish their responsibilities. We also
observed at all posts that consular staff did not have exposed passwords
at their workspace, and they logged off systems each time they left their
desks. Moreover, most posts ensured that applicants did not have access to
consular sections and that consular staff and applicants were interviewed
in a random manner.

To prevent malfeasant issuance of visas, Consular Affairs requires that
blank visas (visa foils) be counted and safeguarded along with other
controlled equipment.16 We found that not all posts reconciled visa
inventories as required. Seven posts had not conducted quarterly
reconciliations as required, although posts did routinely perform daily
reconciliations. Moreover, some posts had certified that they had complied
with inventory controls when they had not, and other posts did not
accurately characterize their compliance. For example:

o 	At one post, the accountable consular officer was absent and the back
up officer did not have the combination to the controlled area. Therefore,
we could not review inventory logs nor could the backup perform the
required daily reconciliation.

o 	Two posts had discrepancies in their monthly reconciliations due to
miscounting. At one post, this discrepancy was discovered later when the
post prepared for a CMAT review.

A referral is also a useful foreign policy tool. However, if it is not
implemented properly, it could create risks in the visa process by
allowing expedited visa processing for potentially unqualified applicants
to enter the United States. We found problems with the implementation and
monitoring of referrals at seven posts. Moreover, in 2002, an Inspector
General Report cited several instances where malfeasant employees sold
referrals and recommended strengthening the nonimmigrant visa referral
policy. The cases cited by the Inspector General involved Drug Enforcement

16Consular Management Handbook, Section 654.5-2, "Receipt, Inventory, and
Accountability," March 9, 2001, and Standard Operating Procedure 55:
Accountability of Controlled Consular Items, December 2003.

Administration and Department of Commerce employees, but sales of
referrals by State employees have also occurred.17

Consular Affairs has issued and reinforced guidance on referrals to posts
three times since 2002. However, the Inspector General noted in March 2005
that the Bureau of Consular Affairs needed to be better informed of
referral procedures in place at overseas posts. The report cited concerns
that not all posts were following State guidance and recommended that
posts verify that applicants had returned at the end of their authorized
stay in the United States.18 State subsequently required posts to conduct
periodic studies on whether referred applicants left the United States
before their visa expired. State requires that all posts have a referral
policy that defines specific criteria referred applicants must meet. The
post policies are intended as a supplement to overall Consular Affairs
guidance on referrals. As a further safeguard, referrals must be (1)
adjudicated by senior consular officers, (2) reviewed by supervisors, and
(3) monitored by post management.19 Class A referents,20 generally
high-level foreign government, business, or cultural officials, are
fingerprinted and undergo a document review but do not have to be
interviewed by the consular section.21 We found that four posts did not
have a current post-specific referral policy. Furthermore, based on our
spot-checks of visa referral records, there was no evidence at six posts
that some supervisors had performed the required reviews. In fact, at
three of these posts, the supervisors, principal officers, or deputy
chiefs of mission were not enabled to access the systems designed to
permit and document supervisory review. Consular Affairs indicated that it
encourages supervisors to document their review within the consular
computer

17Inspector General report, "Review of Nonimmigrant Visa Issuance Policy
and Procedures," Memorandum Report ISP-I-03-26, December 2002.

18Inspector General report, "Nonimmigrant Visa Adjudication: the Visa
Referral Process," ISP-CA-05-56, March 2005.

19State 102994, "Standard Operating Procedure 66-Referral Policy
Clarification," May 2004.

20Class B referrals result in procedural courtesies such as expedited
appointments and applicants are interviewed.

21State requires employees who make referrals to attest to consular
officers that they know the referred applicant personally, that the
issuance of the visa to the applicant is in the national interest of the
United States, and that the applicant does not constitute a threat to the
safety or security of the United States.

system. Our review of referral forms and applications revealed that not
all referred applicants met State's referral criteria. For example,

o 	A senior consular officer at one post issued referrals that did not
meet Class A criteria, including approving referrals for the secretary of
a foreign official and the adult children of foreign officials on personal
travel, when only minor children accompanying the official qualify.

o 	One post could not identify the individual who had made a referral. The
recent referral was approved by the consular section in February 2005. The
individual making the referral did not appear on the post roster, and the
post agency where the referrer was assigned could not identify the
individual at the time of our visit. U.S. personnel not under the
authority of the Chief of Mission cannot use the referral system,
according to Consular Affairs. As a result, the post was unable to verify
that the referral was legitimate.

To monitor the referral process, State requires consular managers to
review referral adjudications daily (as they do other issuances) and to
annually examine 12 months of referrals for anomalies. To comply, all
posts had prepared, as required, executive management aggregate reports of
referrals by employee. Our review of these aggregate reports indicated no
abnormalities; however, when we reviewed individual referral and applicant
forms available online, we found that referrals had not been submitted or
adjudicated appropriately. For example:

o 	One referral was made by a local employee, when only U.S. officers at
the post are allowed to make referrals.

o 	At one post, a referral was made and adjudicated by the same officer.
Consular officers may not refer and approve the same applicants for visas.
This referral was for a cousin of a consular section employee, and
consular officers are not allowed to adjudicate matters involving friends.

o 	Three posts had incorrectly used the Class A referral for local
employees on personal travel. State permits Class A referrals for locally
employed staff only for official travel.

Supervisory Adjudication Reviews Inconsistent

Certification of Internal Controls May Not Disclose Shortcomings

Nonimmigrant Visa chiefs are to review daily all refusals and a sample of
issuances.22 When visa section chiefs adjudicate, senior consular officers
are to perform the reviews, while at small posts with one or two consular
officers, the deputy chief of mission, principle officer, or other senior
post staff are to do so. State policy recommends on-line reviews, but
permits paper reviews as well. Reviewers have an automated system that
provides management reports that would reveal anomalies in consular
officer visa issuances. However, we found little evidence that reviews
were being undertaken consistently at the posts we visited. For example:

o 	Six posts did not consistently perform State required daily reviews of
visa issuances and refusals. For example, at one post a review of the
Nonimmigrant Visa system showed that required daily reviews had not been
done for a month.

o 	At one post, with the consular section located in a different building
from the embassy, we saw several months of visa adjudications on the floor
awaiting review by the deputy chief of mission.

o 	A review of Nonimmigrant Visa adjudication reports at the posts we
visited showed that some posts consistently reviewed daily visa applicant
refusals, but did not follow Consular Affairs' policy to spotcheck daily
visa issuances.

Due to inaccurate or incomplete submissions, the certifications of
consular management controls may not provide the level of assurance
desired that internal controls are being followed. For example:

o 	Seven of the posts we visited had not conducted quarterly
reconciliations, as required, although five had certified compliance with
inventory controls. The October 2004 CMAT reviews of two of these posts
had found similar problems, noting that required inventory controls had
not been reconciled on a quarterly basis, although all had routinely
performed daily reconciliations.

o 	Some posts submitted the required certifications but did not indicate
whether they were in compliance. Two posts, for example, reported

229 FAM 41.121 PN1.2-8 (2/25/2002) and State cable to posts 034743, "Front
Office Oversight of Consular Function-A Reference Tool Continued,"
February 2004.

reviewing controlled items, but did not note whether they were reconciled.

Staff Unaware of Malfeasance Many consular staff at most posts were aware
that they should report

Reporting Procedures

Headquarters Oversight Hindered by the Lack of Enhanced Technical Tools

suspected visa malfeasance but did not know the appropriate reporting
procedures. Internal control standards require agencies to clearly
establish areas of authority and appropriate lines for reporting. State
policy requires that suspicions of malfeasance at posts be reported to
Consular Affairs' consular section chiefs and Diplomatic Security's
regional security officers, unless they are the subject of the
allegations.23 In practice, most consular staff we spoke with said they
report suspicions of consular malfeasance up their chain of command.24 If
suspected malfeasance is not promptly reported to the regional security
officer, subsequent investigations could be affected. In August 2005,
Consular Affairs and Diplomatic Security provided more explicit guidance
to the field on the actions that posts, in particular consular and
security officers, must take in the event they suspect or uncover
malfeasance.

Consular Affairs' headquarters oversight unit, the VAU, does not have
adequate tools to assist their review of the visa process to identify
fraud trends. The Consular Consolidated Database contains various reports
that provide information on daily visa issuances, denials, and referrals
by consular staff. Currently, the VAU can only recall this information on
an adhoc basis, which is time consuming for the two staff assigned to the
unit. For example, it took several hours for us and a VAU staff to review
two categories of data-assigned roles allowing post staff to use consular
databases and whether daily reviews of visa refusals and issuances were
being conducted at five posts. Moreover, the unit has no automated means
to sort data and generate reports that flag unusual variances in visa
issuances or to track trends. As a result, the unit is currently reactive,
focusing its research on supporting allegations and investigations of
malfeasance and generating reports on individual post consular activities
in preparation for CMAT team visits to posts. Unit officials indicated
that they

23State 346750, Standard Operating Procedure 56, "Checklist for Preventing
and/or Reporting Consular Malfeasance," December 2003.

24Consular sections and Diplomatic Security investigators have different
but valid objectives in addressing alleged visa malfeasance. For example,
Diplomatic Security officials we spoke with prefer that allegations be
reported to post security officers rather than consular officers to
protect the integrity of the investigative process, while Consular
Affairs' priority is to immediately stop the possibility of visa issuances
to unqualified applicants.

are working toward developing a more proactive approach to malfeasance
analysis that will allow automated searches of anomalies, fraudulent or
not, through a more efficient data mining and search capability. The new
capability will include identification of consular activity outside of
normal operating patterns, unusual timing of issuances, adjudications made
by someone unauthorized to do so by controlled systems, and overrides of
visa refusals, and would also result in further inquiry into the
anomalies. Consular Affairs indicated that the software enhancements'
usefulness would be tested beginning in late September 2005.

  Documented Cases of Visa Malfeasance

Between 2001 and 2004, Diplomatic Security substantiated through
investigation 28 cases of U.S. employee visa malfeasance that resulted in
various actions.25 In examining these case files, we could not discern why
the malfeasance occurred in part because the data were not contained in
Diplomatic Security case files or because in some instances the case was
ongoing. However, in examining case data on several prosecuted cases, we
found that a breakdown in post adherence to internal controls could have
been a contributing factor. Several factors impede visa malfeasance
investigations, including differences in U.S. and foreign laws,
investigative techniques, and other issues. Malfeasance prosecutions also
face several impediments.

                Nature and Substance of Malfeasance Allegations

Cases are opened only for those allegations found to be supported by some
evidence, even if that evidence is eventually determined to be unreliable.
Allegations of visa malfeasance, initiated from tips or reporting of
suspicious activity, are vetted through post security officers and
investigated when warranted. According to Diplomatic Security
Investigators, the investigative process can result in several outcomes:

o  unfounded, with no reliable evidence found to support the allegation;

o 	unsubstantiated, with some evidence found that might indicate
wrongdoing, but not sufficient to establish culpability and build a
criminal case; or

25Diplomatic Security reported opening about 140 cases involving employee
visa malfeasance allegations between 2001 and 2004.

o 	substantiated, with sufficient evidence found to support the allegation
of malfeasance.

Substantiated cases lead to further investigation and typically result in
resignation, termination, arrest, or referral to Justice for criminal
prosecution.

The 28 substantiated cases of visa malfeasance between 2001 and 2004
resulted in various dispositions, according to Diplomatic Security
records. Thirteen investigations resulted in arrests, 13 resulted in
termination of the employee, and 2 resulted in employee resignations.
Generally, the officers involved in these cases were arrested and the
majority of Foreign Service Nationals were terminated. Most of the 28
cases we reviewed involved the alleged sale of visas by both consular and
other post officers and Foreign Service nationals. However, possibly
because the information provided was not complete, we could not identify
any particular trend in the cases we reviewed covering 2001 to 2004 or in
the 28 cases that were substantiated. Diplomatic Security does not have
the capability to automatically pinpoint specific types of visa
malfeasance or perform trend analyses. As a law enforcement entity,
Diplomatic Security and its regional security officers overseas focus on
gathering sufficient evidence to substantiate the allegation and do not
focus on what allowed the alleged activity to occur. Consequently, in
reviewing the information provided, we could not consistently determine
across cases, for example, how the alleged malfeasance was discovered, the
exact nature of the malfeasance, the rank of the individual allegedly
involved in the malfeasance, and whether similar allegations were made
when the individual was at other posts. This type of information would
benefit investigations and could be a tool for consular management's
monitoring and training efforts. Diplomatic Security officials
acknowledged this capability would be useful but noted that progress in
developing this capability has been slow because Diplomatic Security has
other priorities.

Of the 28 cases substantiated, at least 10 individuals have been
prosecuted.26 The individuals prosecuted received prison terms ranging
from 18 to 63 months, and two individuals were given probation. In some of
these cases, it appeared that the lack of adherence to internal controls
could have played a role in allowing employee malfeasance to go undetected
for a considerable period of time. Consular officials indicated that
strict compliance to internal controls could not prevent malfeasance.
However, they acknowledged that lack of strict compliance could create an
environment that would make it easier to commit malfeasance. The following
are examples of visa malfeasance or alleged visa malfeasance and how lack
of strict compliance with internal controls may have been a contributing
factor in creating an environment where the malfeasance could take place.

o 	Consular Affairs requires supervisors to review reports on visa
refusals and issuances to detect anomalous activity.27 Between 2000 and
2003, two consular employees at one post sold visas to unqualified
applicants. Diplomatic Security said it did not know how many visas were
sold. However, 181 visas were revoked after the malfeasance was
discovered. Diplomatic Security believes that many of the persons with
revoked visas had already entered the country. We believe that strict
compliance with internal controls could have identified this malfeasance
earlier. Applicants for nonimmigrant visas generally apply at an embassy
or consulate with jurisdiction over their place of normal residence,
although they are not required to do so. However, in this case, there were
a large number of third country nationals receiving visas from the same
officer. Supervisory review of the issuances to the third country
nationals or review of a standard report on visa issuances could have
alerted management to this unusual activity. The consular officer ceased
the illegal activity following a supervisory reprimand but soon was able

26State was not able to provide comprehensive data on the total number of
visa malfeasance cases brought to court. We were able to obtain data from
Justice's Public Integrity Section for the 10 prosecutions involving State
or other U.S. employees. Justice prosecuted 14 additional persons involved
in visa malfeasance schemes who were not employed by the U.S. government.
The U.S. Attorneys Offices may also prosecute visa malfeasance cases.
Although these cases may be compiled and sorted according to the statute
charged, for example, 18 U.S.C. 1546, available Offices data do not
separate out visa fraud cases that specifically charge internal consular
malfeasance, as opposed to other types of visa fraud. Thus, we did not
examine such cases.

27Consular Management Handbook, section 642.1, March 9, 2001, updated in
August 2003 in Standard Operating Procedure 31, "Visa Referral Program."

to resume selling visas. The convicted employees received a 63-month
sentence and forfeited $750,000 in illicit gains.

o 	Consular managers are required to continually oversee visa functions
and suspicions of malfeasance must be examined carefully. Between 2000 and
2002 a senior consular officer at a small post accepted fraudulent
applications and documents from a visa broker, issued them outside the
normal process, and returned visas to the broker. After a supervisory
reprimand, the officer revised the fraud scheme and conspired with the
broker to approve visas for applicants with false passports. The officer
received money for processing 85 visas, was convicted, and received a
24-month sentence.

During the course of our work, State reported another case of visa
malfeasance where we believe that lack of strict compliance with internal
controls could have been a contributing factor. State requires consular
and post management to periodically review referral activities and check
on the return rates of applicants receiving a visa. Between 1999 and 2001,
a State political officer at a small post allegedly referred unqualified
applicants for visas, according to a State press release issued in April
2005. In the absence of the senior consular officer, the political officer
was also responsible for visa adjudications and allegedly provided blank
visa applications to an individual, assisted in filling them out, and then
issued them to unqualified applicants. In return for these services the
officer allegedly received a vintage BMW motorcycle. The officer was
arrested in 2005.

Consular Affairs emphasized that although some of its officers have
engaged in visa malfeasance, other U.S. government employees and Foreign
Service nationals have as well. Between 2000 and 2001, a U.S.based Foreign
Agricultural Service officer recommended 99 unqualified applicants and was
able to influence the visa process through his recommendations and the
submission of fraudulent documents, according to court documents. In
exchange, the officer received bribes totaling $77,400. The officer, who
was given the names of ineligible applicants by visa brokers,28 provided
the applicants, on U.S. Department of Agriculture letterhead, letters
stating that the individuals were agricultural specialists invited to the
United States for official meetings. The officer then sent follow-up faxes
to posts confirming the invitations. The individuals, who all

28Visa brokers are individuals that assist visa applicants in obtaining a
visa, often through fraudulent means.

listed the same destination address, presented the letters at embassy visa
offices and unlawfully obtained visas. The officer was sentenced to 21
months in prison for participating in the visa malfeasance scheme.

    Factors Affecting Visa Malfeasance Investigations

Visa malfeasance investigations are impeded by several factors, according
to Diplomatic Security officials, including untimely reporting of alleged
visa malfeasance. The ability to gather evidence is adversely affected,
for example, when allegations are made several years after the alleged
malfeasance occurred and witnesses have been reassigned, or are
unavailable. In particular, entry-level officers, fearing reprisal, may
delay reporting malfeasance until after they have been reassigned to a new
post, according to State officials. In such cases, reconstructing the
actions constituting any malfeasance is difficult because years may have
passed since the incident occurred.

When visa malfeasance occurs overseas, differences in legal systems can
pose obstacles to investigators. Local laws may not permit the use of U.S.
investigative techniques such as recorded conversations, undercover
operations, or interrogation of suspects, according to Diplomatic Security
officials. Additionally, according to Diplomatic Security investigators,
investigations of local employees may be complicated due to differences in
U.S. and foreign laws. According to Diplomatic Security officials, bribery
is not a criminal offense in some countries and therefore it is difficult
and sometimes impossible to obtain local warrants for searches in these
countries.

Conflicting priorities may also impede evidence gathering. For example, at
one post, the Diplomatic Security investigator noted that he had to
concentrate on ensuring the security of the post and was not able to
devote adequate attention to investigating a recent allegation of visa
malfeasance.29 Diplomatic Security officials confirmed that protecting
personnel and infrastructure is the first priority of post security
officers. Additionally, when malfeasance is suspected, Consular Affairs'
and Diplomatic Security's differing objectives may affect evidence
gathering. Diplomatic Security officials abroad and in headquarters, as
well as Justice officials, all noted that documenting the illegal activity
and gathering a sufficient amount of evidence to make a criminal case
often requires

29Diplomatic Security is in the process of adding additional officers at
25 posts to concentrate on investigations of visa fraud, including visa
malfeasance.

allowing the suspect to continue working, unaware of the investigation.
Consular Affairs noted that when this occurs, consular management closely
reviews the suspect's adjudications and monitors his or her activities to
prevent issuances to ineligible applicants. However, Consular Affairs
management interviewed on this issue expressed a preference for removing
suspected individuals from their positions as quickly as possible. At one
post, the ambassador, at the recommendation of the senior consular
officer, took action to remove an employee under investigation in order to
stop even the possibility that a visa could be issued to an ineligible
applicant, thereby ending the covert investigation. As a result, a
criminal case could not be developed, and the employee was dealt with
administratively and was fired.

    Malfeasance Prosecutions Face Impediments

Justice's efforts to prosecute malfeasance are limited by a range of
factors, including the inability to use U.S. warrants to search U.S.
employees' offices and residences overseas, according to Justice. U.S.
magistrates generally cannot issue warrants for overseas searches.
Further, Justice officials noted that they only accept for prosecution
cases with sufficient evidence to warrant convictions.

Under Rule 41 of the Federal Rules of Criminal Procedures, U.S.
magistrates do not have the authority to issue search warrants for
locations outside their districts, such as an embassy or residence
overseas.30 According to Diplomatic Security officials, the ability to
obtain U.S. search warrants, rather than relying on local warrants issued
and executed by the host government, is important since investigations of
visa malfeasance generally focus on embassy property or diplomatic
residences. The U.S. mission31 and the residences of certain U.S.
diplomats in country are inviolable, which means that agents of the host
government may not enter

30The U.S.A. PATRIOT Act (P.L. 107-56) amended Rule 41 to allow
magistrates to issue search warrants for property, but only in cases
involving domestic and international terrorism; according to Diplomatic
Security officials, this is generally not applicable to a typical case of
visa malfeasance. According to a Justice official, in 1990 the United
States Judicial Conference approved an amendment to Rule 41 that would
have provided U.S. magistrates search warrant authority. However, in
reviewing the recommendation, the Supreme Court concluded that the matter
required further consideration and no action has been taken.

31The U.S. mission generally refers to the buildings and land used for the
purpose of the mission. This includes the embassies and consulate, as well
as the residence of the head of the mission.

the premises without the consent of the head of the mission, according to
State officials. State officials also told us that the United States will
never waive inviolability for the U.S. mission, and, therefore,
investigators could not rely on a host country's warrant to search an
employee's office at the U.S. mission. However, in certain instances,
State officials said that they would waive inviolability for the personal
residences of U.S. diplomats, located outside the U.S. mission.

In instances where inviolability is waived, the United States can use
current tools, such as letter rogatories32 and Mutual Legal Assistance
Treaties, to request that a host government issue and execute a search
warrant under the host government's laws. Nonetheless, Diplomatic Security
officials cited many difficulties they say can arise when using these
tools. For example, according to these officials, differences between the
United States' and some host government's techniques in gathering evidence
can affect the admissibility of that evidence in U.S. courts. As a result
of these and other difficulties, diplomatic security officials told us
that they do not often utilize these tools to obtain local search
warrants.

In discussing with State and Diplomatic Security officials the possibility
of obtaining additional search authorities under U.S. law, these officials
raised issues regarding the magnitude of the need, as well as concerns
over sovereignty and reciprocity. For example, Diplomatic Security
officials indicated that in approximately six cases in the past year they
would have wanted to conduct searches of employee residences and offices
in connection with suspected visa malfeasance. State officials raised
concerns that should the United States execute U.S. search warrants
overseas, host governments could view this as a challenge to their
sovereignty. Further, if the United States were to execute U.S. warrants
overseas, the question arises whether the United States would have to
extend the same privilege to foreign governments to execute their own
warrants here in the United States.

Conclusions	A visa system that is beyond reproach, with strong internal
controls to protect against consular malfeasance, is critical to ensuring
the integrity of

32Letter Rogatories are letters of request from a court in one country to
a foreign court requesting judicial assistance. Such requests can include
the obtaining of testimony or other evidence from a person located in the
foreign country. Requests rest entirely on the comity of courts towards
each other, and customarily embody a promise of reciprocity.

visa decisions, national security, and U.S. immigration objectives. There
is no way to prevent applicants from offering bribes; therefore, State
recognizes that along with the integrity of its employees, an effective
internal control program is needed to guard against employee malfeasance.
Established internal controls make it more difficult for an employee to
commit visa malfeasance. State has established a system of internal
controls. However, at the posts we visited, we found that compliance with
some of these internal controls was inconsistent. This increases the risk
of visa malfeasance. Furthermore, most consular staff we spoke with did
not know the appropriate way to report suspicions of employee visa
malfeasance, which could hinder investigations. A further weakness to
investigations is the lack of data on allegations and investigations to
identify vulnerable points in the visa process. Finally, U.S.
investigators cannot obtain a U.S. search warrant to search the offices or
residences overseas of employees, which, according to Justice and
Diplomatic Security officials, affects their ability to gather evidence in
malfeasance cases. However, there are numerous factors that would need to
be considered in pursuing additional search authorities.

  Recommendations for Executive Action

To emphasize the importance of internal controls to consular officers,
section heads, and post managers, we recommend that the Secretary of State
take the following two actions:

o 	Develop a strategy to achieve strict compliance with internal controls.
The strategy should include a system to spot check compliance. The
strategy should also include formalized procedures in Fraud Prevention
Units to document how the post will address the risk of employee
malfeasance and emphasize the importance of reporting suspected internal
malfeasance to consular managers and post security officers.

o 	Improve State's existing mechanisms to combat visa malfeasance. This
could be accomplished by (1) improving the software available to the
Vulnerability Assessment Unit to automatically sort data to identify and
analyze abnormalities in post visa issuance statistics that could be an
indication of malfeasance and (2) enhancing the investigative case
tracking systems used by the Bureau of Diplomatic Security in order to
better identify trends and vulnerabilities in the visa process for use by
investigators and consular managers.

We also recommend that the Secretary of State and the Attorney General
determine whether seeking additional overseas search authorities is

warranted to facilitate investigations of visa malfeasance. If they
determine that such authorities are warranted, the Secretary of State and
the Attorney General should develop an implementation plan and notify the
Congress of any required legislative changes.

  Agency Comments and Our Evaluation

We provided a draft of this report to the Departments of State and
Justice. The Department of State provided written comments, which are
included in appendix II. State concurred with our conclusions and
recommendations and has begun taking actions to improve and monitor posts'
adherence to internal controls. Specifically, the department said it will
review and approve post referral policies, and it has established an
ombudsman to ensure that there is no undue influence on consular officers
to issue visas. To monitor compliance with internal controls, the
department plans to establish an automated control system for controlled
items, field test an automated data mining system of consular activities,
and launch a worldwide fraud case tracking system in 2006. Lastly, the
department said it will work with the Attorney General to determine if
additional authority for overseas searches of employees' residences and
offices is warranted and, if so, how it could best be achieved. Justice
did not comment on our recommendations, but provided technical comments,
which we incorporated in the report as appropriate.

As agreed with your office, unless you publicly announce its contents
earlier, we plan no further distribution of this report until 30 days
after its issue date. At that time, we will send copies of the report to
relevant congressional committees and subcommittees, the Secretary of
State, the Attorney General, and other interested parties. In addition,
this report will be available at no charge on the GAO Web site at
http://www.gao.gov.

If you or your staff have any questions about this report, please contact
me
at (202) 512-4128. Contact points for our Offices of Congressional
Relations
and Public Affairs may be found on the last page of this report. GAO staff
who made major contributions to this report are listed in appendix III.

Sincerely yours,

Jess T. Ford
Director, International Affairs and Trade

Appendix I

Scope and Methodology

The scope of our work covered the visa application and adjudication
process at selected U.S. Consulates and Embassies overseas. To assess the
policies and procedures governing visa operations, we obtained copies of
written procedures and interviewed officials from the Bureau of Consular
Affairs. At the embassies and consulates we visited, we interviewed
foreign service nationals, foreign service officers, adjudicating
officers, the Nonimmigrant Visa section chiefs, the consular section
chiefs, and the deputy chiefs of mission or principal officers. When
available, we also interviewed consuls general and ambassadors.

To assess the internal controls designed to prevent the illegal provision
of visas, we asked State to identify the policies, procedures, and key
internal controls governing visa operations. State identified a number of
key internal controls, and, in particular, identified the Consular
Management Handbook (Chapter 600), their Standard Operating Procedures,
and the relevant sections of the Foreign Affairs Manual as sources for
these controls. We obtained and examined the Department of State's
Consular Management Handbook, Standard Operating Procedures, key sections
of the Foreign Affairs Manual, and documents related to how the department
develops and enforces standards of conduct for visa adjudication officers
from the department's Bureau of Consular Affairs. To determine if
supervisors were reviewing records of visa issuances, we reviewed on line
reports at posts and at the Vulnerability Assessment Unit (VAU). To assess
whether the key internal controls were being followed, we examined post
records for the year preceding our visit, except in the case of referral
policies, where we examined judgmental samples of four months of referrals
at each post.

We visited 11 consular posts in six countries to observe and verify the
implementation of the key internal controls. These posts are Nogales,
Guadalajara, and Mexico City, Mexico; Quito and Guayaquil, Ecuador; Lima,
Peru; Ho Chi Minh City and Hanoi, Vietnam; Bangkok and Chiang Mai,
Thailand; and Mumbai, India. To select the posts to visit, we reviewed
overall post staffing data and issuance rates and selected posts that had
both large and small staffing levels with varied experience. Selected
posts performed a varying amount of adjudications, and some had regional
responsibilities for fraud detection and investigations. Some posts had
also undergone internal reviews and permitted examination of external
oversight functions. Lastly, some posts selected had been the subject of
fraud allegations, enabling the review of investigative procedures. Our
reported results apply to the posts we visited, and we cannot generalize
the results to posts not visited.

Appendix I Scope and Methodology

To assess the nature and extent of malfeasance, we examined records
provided by State's Bureau of Diplomatic Security on investigations of
visa malfeasance involving employees between 2001 and 2004. We reviewed
140 cases collected by Diplomatic Security covering alleged visa
malfeasance involving employees over the last 4 years. The cases reviewed
represented 2004, 2003, and 2002, as well as prominent, but not all cases
from 2001. The reports included information on the types of employees
being investigated for visa malfeasance, such as U.S. Foreign Service
officers, and employees of other U.S. government agencies overseas and
locally hired staff. Diplomatic Security does not maintain automated data
on employee malfeasance, and it obtained these reports for us by reviewing
its files on all types of visa fraud and identifying those where employee
malfeasance was involved. While Diplomatic Security reported that it made
its best efforts to obtain complete data from 2002 through 2004, it could
not assure us that it had identified every case that had been opened and
involved employee malfeasance. These data covered 2001 to 2004 because
this was the most recent information available. However, there were a
number of limitations in these data. For example, the information
available did not include a comprehensive set of allegations, nor
completely describe the nature of the fraudulent activity under
investigation. We determined that these data were sufficiently reliable to
provide details on approximate figures of the employee malfeasance cases
that were opened, as well as details about the types of cases. We also
obtained information from the Department of Justice on visa fraud
prosecutions by the Public Integrity Section conducted between January
2001 and March 2005. These data allowed us to determine how many cases
this office in Justice has pursued in the last 4 years, as well as the
status or outcome of those cases. Additionally, we interviewed officials
from State's Office of the Inspector General, Consular Affairs' Office of
Fraud Prevention, and its VAU. We observed VAU officials as they conducted
their analysis and queries. We interviewed the fraud prevention staff and
management at all the embassies and consulates visited, and also
interviewed the Regional Security Officers and Assistant Regional Security
Officers/Investigators at all posts where such officers were posted and
available.

To determine how State and Justice interact to investigate suspicious
activity and allegations of employee malfeasance, we interviewed officials
from State's Bureaus of Consular Affairs and Diplomatic Security, and
Justice's Criminal Division, Public Integrity Section, and the Executive
Office for United States Attorneys.

Appendix I Scope and Methodology

We conducted our work from August 2004 through July 2005 in accordance
with generally accepted government auditing standards.

                                  Appendix II

                     Comments from the Department of State

Appendix II
Comments from the Department of State

Appendix II
Comments from the Department of State

Appendix II
Comments from the Department of State

Appendix II
Comments from the Department of State

Appendix II
Comments from the Department of State

Appendix II
Comments from the Department of State

Appendix III

                     GAO Contact and Staff Acknowledgments

                      GAO Contact Jess Ford (202) 512-4128

Staff 	In addition to the person named above, John Brummet, Assistant
Director; Claude Adrien; Joseph Carney; Martin de Alteriis; Etana Finkler;
Patricia

Acknowledgments Martin; and Mary Moutsos made key contributions to this
report.

GAO's Mission	The Government Accountability Office, the audit, evaluation
and investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the performance
and accountability of the federal government for the American people. GAO
examines the use of public funds; evaluates federal programs and policies;
and provides analyses, recommendations, and other assistance to help
Congress make informed oversight, policy, and funding decisions. GAO's
commitment to good government is reflected in its core values of
accountability, integrity, and reliability.

Obtaining Copies of The fastest and easiest way to obtain copies of GAO
documents at no cost

is through GAO's Web site (www.gao.gov). Each weekday, GAO postsGAO
Reports and newly released reports, testimony, and correspondence on its
Web site. To Testimony have GAO e-mail you a list of newly posted products
every afternoon, go to

www.gao.gov and select "Subscribe to Updates."

Order by Mail or Phone	The first copy of each printed report is free.
Additional copies are $2 each. A check or money order should be made out
to the Superintendent of Documents. GAO also accepts VISA and Mastercard.
Orders for 100 or more copies mailed to a single address are discounted 25
percent. Orders should be sent to:

U.S. Government Accountability Office 441 G Street NW, Room LM Washington,
D.C. 20548

To order by Phone:	Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202)
512-6061

  To Report Fraud, Contact:
  Waste, and Abuse in Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: [email protected] Programs Automated answering system: (800)
424-5454 or (202) 512-7470

Congressional	Gloria Jarmon, Managing Director, [email protected] (202)
512-4400 U.S. Government Accountability Office, 441 G Street NW, Room 7125

Relations Washington, D.C. 20548

Public Affairs	Paul Anderson, Managing Director, [email protected] (202)
512-4800 U.S. Government Accountability Office, 441 G Street NW, Room 7149
Washington, D.C. 20548
*** End of document. ***