Border Security: US-VISIT Program Faces Strategic, Operational,
and Technological Challenges at Land Ports of Entry (06-DEC-06,
GAO-07-248).
The Department of Homeland Security (DHS) established the U.S.
Visitor and Immigrant Status Indicator Technology (US-VISIT)
program to collect, maintain, and share data on selected foreign
nationals entering and exiting the United States at air, sea and
land ports of entry (POEs). These data, including biometric
identifiers like digital fingerprints, are to be used to screen
persons against watch lists, verify visitors' identities, and
record arrival and departure. GAO was asked to review
implementation at land POE facilities and in doing so GAO
analyzed: (1) efforts to implement US-VISIT entry capability; (2)
efforts to implement US-VISIT exit capability; and (3) DHS's
efforts to define how US-VISIT fits with other emerging border
security initiatives. GAO reviewed DHS and US-VISIT program
documents, interviewed program officials, and visited 21 land
POEs with varied traffic levels on both borders.
-------------------------Indexing Terms-------------------------
REPORTNUM: GAO-07-248
ACCNO: A63924
TITLE: Border Security: US-VISIT Program Faces Strategic,
Operational, and Technological Challenges at Land Ports of Entry
DATE: 12/06/2006
SUBJECT: Biometric identification
Biometric visas
Border patrols
Border security
Homeland security
Identification cards
Information management
Internal controls
Standards
Strategic planning
Visas
Waivers
Program implementation
DHS Visitor and Immigrant Status
Indicator Technology Program
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO Product. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
******************************************************************
GAO-07-248
* [1]Results in Brief
* [2]Background
* [3]Legislative Overview
* [4]Management and Implementation of US-VISIT
* [5]US-VISIT Scope, Operations, and Processing at Land POEs
* [6]Overview of Land POE Facilities
* [7]DHS Has Installed US-VISIT Biometric Entry Capability at Nea
* [8]US-VISIT Biometric Entry Capability Was Installed at Nearly
* [9]Steps Have Been Taken to Address Operational Challenges Iden
* [10]Management Controls Did Not Always Alert US-VISIT and CBP to
* [11]DHS Cannot Currently Implement a Biometric US-VISIT Exit Cap
* [12]Various Factors Have Prevented US-VISIT from Implementing a
* [13]The US-VISIT Program Office Is Testing Nonbiometric Technolo
* [14]Initial Results of Testing Using RFID Technology Indicate Pr
* [15]DHS Has Not Articulated How US-VISIT Strategically Fits with
* [16]Conclusions
* [17]Recommendations for Executive Action
* [18]Agency Comments and Our Evaluation
* [19]Alaska (3)
* [20]Arizona (8)
* [21]California (6)
* [22]Idaho (2)
* [23]Maine (15)
* [24]Michigan (6)
* [25]Minnesota (8)
* [26]Montana (13)
* [27]New Hampshire (1)
* [28]New Mexico (3)
* [29]New York (16)
* [30]North Dakota (18)
* [31]Ohio (1)
* [32]Texas (25)
* [33]Vermont (14)
* [34]Washington (13)
* [35]Canada (1)
* [36]GAO Contact
* [37]Acknowledgments
* [38]GAO's Mission
* [39]Obtaining Copies of GAO Reports and Testimony
* [40]Order by Mail or Phone
* [41]To Report Fraud, Waste, and Abuse in Federal Programs
* [42]Congressional Relations
* [43]Public Affairs
Report to Congressional Requesters
United States Government Accountability Office
GAO
December 2006
BORDER SECURITY
US-VISIT Program Faces Strategic, Operational, and Technological
Challenges at Land Ports of Entry
GAO-07-248
Contents
Letter 1
Results in Brief 5
Background 10
DHS Has Installed US-VISIT Biometric Entry Capability at Nearly All Land
POEs, but Faces Challenges Identifying and Monitoring the Operational
Impacts on POE Facilities 23
DHS Cannot Currently Implement a Biometric US-VISIT Exit Capability at
Land POEs and Faces Uncertainties as Testing of an Alternative Exit
Strategy Continues 38
DHS Has Not Articulated How US-VISIT Strategically Fits with Other
Land-Border Security Initiatives 53
Conclusions 57
Recommendations for Executive Action 60
Agency Comments and Our Evaluation 60
Appendix I Objective, Scope, and Methodology 65
Appendix II Visa Waiver Countries 70
Appendix III Legislative Overview of the US-VISIT Program 71
Appendix IV The 20 Busiest Land Ports of Entry (POE) by Volume of
Individuals Entering the United States in Fiscal Year 2005 75
Appendix V Land Ports of Entry (POE) at Which US-VISIT Has Been Installed
76
Appendix VI Actions Taken by US-VISIT Program Office to Mitigate Privacy
Risks Associated with RFID at Land POEs 81
Appendix VII US-VISIT Test of Radio Frequency Identification (RFID)
Readers Upon Exit and Re-entry at Selected Land POEs 84
Appendix VIII Comments from the U.S. Department of Homeland Security 89
Appendix IX GAO Contact and Acknowledgments 93
Tables
Table 1: Summary of the Scope, Schedule for Completion, and Intended
Functionality of the US-VISIT Increment Schedule 13
Table 2: US-VISIT Appropriations Enacted, Fiscal Years 2003 Through 2007
(in millions of dollars) 13
Table 3: Land POEs visited by GAO, August 2005 to February 2006 66
Table 4: Countries Participating in the Visa Waiver Program 70
Table 5: RFID Read Rate Test Results for Persons in Vehicles and
Pedestrians Exiting the Country with RFID-Readable Documents 85
Table 6: RFID Test Read Rates for Persons Re-Entering the Country in
Vehicles at Locations Where US-VISIT Tested RFID Technology 87
Table 7: RFID Test Read Rates for Pedestrians Re-entering the Country at
Locations Where US-VISIT Tested RFID Technology 87
Figures
Figure 1: Persons Processed under US-VISIT as a Percentage of all Border
Crossings at Land, Air, and Sea Ports of Entry, Fiscal Year 2004 16
Figure 2: US-VISIT Equipment (computer, camera, and printer) at a Land POE
Secondary Inspection Area 18
Figure 3: Overview of US-VISIT Enrollment at Land POEs for Visitors with
and without Visas Entering the Country for the First Time 20
Figure 4a: Land POE at Blaine-Peace Arch in Blaine, Washington 21
Figure 4b: Land POE Facility at the Detroit-Windsor Tunnel in Detroit,
Michigan 22
Figure 4c: Land POE Facility at Rouses Point, New York 23
Figure 5: Nogales-Morley Gate POE, Arizona 28
Figure 6: Aerial View of San Ysidro, California, POE 40
Figure 7a: Metal Gantry with RFID Readers and Antennas at the Thousand
Islands Bridge POE, Alexandria Bay, New York 45
Figure 7b: RFID Portals Positioned Next to Exit Doors at the Blaine-Peace
Arch POE in Washington State 46
Figure 8a: RFID Installation at the Nogales-Mariposa POE in Arizona,
Facing Toward Mexico 49
Figure 8b. Two Pedestrians Exiting the Country at the Nogales-Mariposa
POE, Arizona, Walking Toward Mexico 50
Abbreviations
AIDMS Automated Identification Management System
APIS Advance Passenger Information System
BCC Border Crossing Card
CBP Customs and Border Protection
DHS Department of Homeland Security
DMIA Immigration and Naturalization Service Data Management Improvement
Act
FBI Federal Bureau of Investigation
ICAO International Civil Aviation Organization
ICE Immigration and Customs Enforcement
IDENT Automated Biometric Identification System
IIRIRA Illegal Immigration Reform and Immigrant Responsibility Act
INS Immigration and Naturalization Service
OIG Office of Inspector General
POE port of entry
RFID radio frequency identification
SBI Secure Border Initiative
TECS Treasury Enforcement Communications System
US-VISIT United States Visitor and Immigrant Status Indicator Technology
VWP Visa Waiver Program
WHTI Western Hemisphere Travel Initiative
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed in
its entirety without further permission from GAO. However, because this
work may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this material
separately.
United States Government Accountability Office
Washington, DC 20548
December 6, 2006
Congressional Requesters
This report is a publicly available version of our report on the
implementation of the U.S. Visitor and Immigrant Status Indicator
Technology (US-VISIT) program at land ports of entry (POE).^1 Our original
report was designated For Official Use Only because, according to the
Department of Homeland Security (DHS), it contained specific information
of a sensitive nature.
In the years since the 2001 terrorist attacks, the need to secure U.S.
borders has taken on added importance and has received increasing
attention from Congress and the public. In an effort to avoid repetition
of such attacks, and improve overall national security, Congress and the
Administration have sought better ways to record and track the entry and
departure of foreign visitors who pass through U.S. POEs by air, land, or
sea, to verify their identities, and to authenticate their travel
documentation. In March 2003, responsibility for these efforts was
transferred from the former Immigration and Naturalization Service to DHS.
Pursuant to several statutory mandates, DHS, in consultation with the
Department of State, established an automated visitor system to integrate
information on the entry and exit from the United States of foreign
nationals, called the US-VISIT Program.
According to DHS, the purpose of US-VISIT is to enhance the security of
U.S. citizens and visitors, facilitate legitimate travel and trade, ensure
the integrity of the U.S. immigration system, and protect visitors'
privacy. The program is managed by the US-VISIT Program Office, which is
headed by the US-VISIT Director, who currently reports to the DHS Deputy
Secretary. US-VISIT is used in the field by officers with U.S. Customs and
Border Protection (CBP), a separate DHS component. US-VISIT processing is
one of many activities that takes place at POEs, where CBP officers
enforce U.S. immigration laws governing the admissibility of the millions
of aliens entering and U.S. citizens reentering the country daily; screen
cargo for weapons or illegal or dangerous goods; prevent narcotics,
agricultural pests, and smuggled goods from entering the country; and
identify and arrest those with outstanding criminal warrants.
^1 A port of entry is generally a physical location, such as a pedestrian
walkway and/or a vehicle plaza with booths, and associated inspection and
administration buildings, at a land border crossing point, or a restricted
area inside an airport or seaport, where entry into the country by persons
and cargo arriving by air, land, or sea is controlled by U.S. Customs and
Border Protection (CBP).
US-VISIT is designed to use biographic information (e.g., name,
nationality, and date of birth) and biometric information (e.g., digital
fingerprint scans and photographs) to verify the identity of those covered
by the program. The program applies to certain visitors whether they hold
a nonimmigrant visa or are traveling from a country that has a visa waiver
agreement with the United States under the Visa Waiver Program.^2 U.S.
citizens, lawful permanent residents, and most Canadian and Mexican^3
citizens are currently exempt from being processed under US-VISIT upon
entering and exiting the country.^4 Foreign nationals subject to US-VISIT
who intend to enter the country encounter different inspection processes
at different types of POEs depending on their mode of travel. Foreign
nationals subject to US-VISIT who intend to enter the United States at an
air or sea POE are to be processed, for purposes of US-VISIT, in the
primary inspection area upon arrival. Generally, these visitors are
subject to prescreening before they arrive via passenger manifests, which
are forwarded to CBP by commercial air or sea carrier in advance of
arrival.^5 By contrast, foreign nationals intending to enter the United
States at land POEs are generally not subject to prescreening because they
arrive in private vehicles or on foot and there is no manifest to record
their pending arrival. Thus, when foreign nationals subject to US-VISIT
arrive at a land POE, they are directed by CBP officers from the primary
inspection area to the secondary inspection area for further processing.
At all POEs, visitors covered by US-VISIT who are determined to be
admissible are issued an I-94 arrival/departure form, which, among other
things, records their date of arrival and the date their authorized period
of admission expires. The requirement that arriving nonimmigrants admitted
to the United States, unless otherwise exempted, be issued an I-94 as
evidence of the terms of their admission predates implementation of
US-VISIT and was incorporated into US-VISIT processing.^6
2The Visa Waiver Program enables nationals of certain countries to travel
to the United States for tourism or business for stays of 90 days or less
without obtaining a visa. Most western European countries participate in
this program, along with Japan, Singapore, Australia, Brunei, and New
Zealand. Appendix II lists all 27 Visa Waiver Program countries.
^3To visit the United States, Mexican citizens generally need either a
Mexican passport and U.S. visa, or a Border Crossing Card (BCC), which is
issued to Mexican visitors who wish to enter the country for business or
pleasure for no more than 6 months. The BCC contains machine-readable
biographic and biometric information. Mexican citizens with BCCs who are
traveling within 25 miles of the border, (75 miles in Arizona, if entering
through certain POEs near Tucson) and who plan to stay no more than 30
days, are generally not subject to US-VISIT processing upon entry. A
Mexican citizen is subject to US-VISIT requirements, however, if a CBP
officer determines that the entrant intends to stay more than 30 days or
travel beyond the 25- or 75-mile limit.
^4On July 27, 2006 DHS issued a Notice of Proposed Rulemaking that, if
finalized, would expand the scope of US-VISIT to include, among others,
lawful permanent residents, aliens seeking admission on immigrant visas,
refugees and asylees, and certain categories of Canadians. DHS did not
report how many additional persons would be covered by US-VISIT if the
rule were adopted.
Many aspects of US-VISIT program implementation have been driven or
defined by various legislative mandates. These include a 2001 statutory
requirement to focus particularly on the use of biometric technology in
developing the integrated entry-exit system subsequently named US-VISIT; a
2002 statutory requirement to develop biometric identifier standards to be
used to verify the identity of persons seeking to enter the United States
at POEs; and a requirement to install at all POEs equipment and software
to allow biometric comparison and authentication of U.S. visas and other
travel and entry documents issued to aliens, as well as Visa Waiver
Program participant passports. In addition, by law, an integrated entry
and exit data system was to be implemented at all U.S. POEs, including
land POEs, by December 31, 2005, but there was no specific requirement to
collect any new data on foreign nationals departing at land POEs by that
date. The Intelligence Reform and Terrorism Prevention Act of 2004, on the
other hand, did require the collection of biometric exit data for all
individuals subject to US-VISIT, but it did not set a deadline for
implementation of this requirement.
^5Under the Enhanced Border Security and Visa Entry Reform Act of 2002
(Pub. L. No. 107-173, S 402(a), 116 Stat. 543, 557-59), commercial air and
sea carriers are to transmit crew and passenger manifests to appropriate
immigration officials before arrival of an aircraft or vessel in the
United States. These manifests are transmitted to CBP through the Advanced
Passenger Information System (APIS), which helps officers identify (1)
those arrivals for which biometric data are available and (2) foreign
nationals who need to be scrutinized more closely.
^6Visitors traveling on nonimmigrant visas are issued Form I-94 and
visitors from Visa Waiver Program countries are issued Form I-94W. Both
forms show the date of arrival, port of entry, and date the authorized
period of admission expires. Whereas passengers arriving on commercial air
or sea liners are to fill out portions of an I-94 or I-94W arrival and
departure form on the carrier in advance of arriving, visitors subject to
US-VISIT at land POEs are to provide information for I-94s and I-94Ws
during the inspection process, and the forms are issued after the process
is completed.
The United States shares over 7,500 miles of land border with Canada and
Mexico and currently, CBP operates 170 land POEs on the northern border
with Canada and the southwest border with Mexico. These POEs are diverse
in nature, with some operating in urban areas, such as Detroit, Michigan,
and others operating in remote areas, such as the northern plains in
Montana or along the southwest border. Taken together, land POEs process
the largest number of visitors to the United States each year among all
POEs (about 79 percent of about 425 million total border crossings during
fiscal year 2004) and process fewer US-VISIT eligible visitors as compared
to other POEs (about 11 percent of about 42 million border crossings
processed via US-VISIT during fiscal year 2004).
As US-VISIT was being installed at land POEs, questions arose about the
impact the program was having on the existing POE facilities where
legitimate land-border crossings take place, particularly in light of a
goal, stated by a former DHS Undersecretary, to develop a "smart
border--one that speeds through legitimate trade and travel, but stops
terrorists in their tracks." We were asked to review implementation of
US-VISIT at land POE facilities. Specifically, we analyzed the following
issues: (1) What has the US-VISIT Program Office done to implement
US-VISIT entry capabilities at land POEs and what impact has US-VISIT had
on these facilities? (2) What is the status of US-VISIT Program Office
efforts to implement a US-VISIT exit capability at land POE facilities?
(3) What has DHS done to define a strategic context to show how US-VISIT
entry and exit capabilities at land POE facilities fit with other current
and emerging border security initiatives?
To meet our objectives, we met with officials at CBP and the US-VISIT
Program Office within DHS in Washington, D.C. We reviewed applicable laws
and regulations and studies on the US-VISIT program and examined available
DHS documents on US-VISIT entry and exit capability and deployment at land
POEs. We also visited 21 selected land POEs on the northern and southern
borders where US-VISIT entry capability had been installed. Along the
northern border, we visited land POEs at the Windsor Tunnel and Ambassador
Bridge in Detroit, Michigan; the Thousand Islands Bridge at Alexandria
Bay, Champlain, Overton Corners, and Rouses Point in northern New York
State; Highgate Springs and Alburg Springs in northern Vermont; and
Blaine-Pacific Highway and Blaine-Peace Arch in Blaine, Washington. Along
the southern border, we visited the DeConcini, Morley Gate, and Mariposa
POEs in Nogales, Arizona; the POE in San Ysidro in California; and POEs in
Brownsville-Matamoros Bridge, Brownsville-Gateway, and Brownsville-Los
Tomates/Veterans International Bridge, Hidalgo, Progreso, Pharr, and Los
Ebanos in Texas. We selected these locations to ensure coverage on both
borders and to obtain a mix of sites with varied types of environments and
levels of traffic volume. Where feasible, we also chose to visit some
geographically proximate POEs to minimize travel costs. In addition, five
of these POEs (Thousand Islands Bridge, Blaine-Peace Arch, Blaine-Pacific
Highway, DeConcini, and Mariposa) had been designated by DHS as locations
to test exit technology. At all the locations we visited, we observed how
US-VISIT equipment was installed and operated and interviewed CBP
officials about US-VISIT installation and operations following deployment.
We also observed the impacts of US-VISIT equipment and operations on POE
facilities and infrastructures. In addition, we examined whether internal
control mechanisms were in place and being used to ensure that program
objectives were being achieved, consistent with GAO's Standards for
Internal Controls in the Federal Government.^7 The information from our
site visits is limited to the 21 land ports we visited and is not
generalizable to all land ports of entry. Appendix I discusses our scope
and methodology in greater detail.
We conducted our work from September 2005 through October 2006 in
accordance with generally accepted government auditing standards.
Results in Brief
DHS has installed the entry portion of US-VISIT at 154 of the nation's 170
land POEs,^8 usually with minimal new construction or changes to existing
facilities. As required by law, the US-VISIT entry capability includes
biometric features--such as digital scans of 2 fingerprints--to help
verify the identity of visitors. CBP officials at all 21 land POEs we
visited told us that US-VISIT's entry capability has generally enhanced
their ability to process visitors subject to US-VISIT by providing
assurance that visitors' identities can be confirmed through biometric
identifiers and by automating the paperwork associated with processing
I-94 arrival/departure forms. Going forward, DHS plans to introduce
changes and enhancements to US-VISIT at land POEs intended to further
bolster CBP's ability to verify the identity of individuals entering the
country, including a transition from digitally scanning 2 fingerprints to
10. While such changes are intended to further enhance border security,
deploying them may have an impact on aging and space-constrained land POE
facilities because they could increase inspection times and adversely
affect POE operations. Moreover, our previous and current work showed that
the US-VISIT program office had not taken necessary steps to help ensure
that US-VISIT entry capability operates as intended. For example, in
February 2006 we reported that the approach taken by the US-VISIT program
office to evaluate the impact of US-VISIT on land POE facilities focused
on changes in I-94 processing time at 5 POEs and did not examine other
operational factors, such as US-VISIT's impact on physical facilities or
work force requirements.^9 As a result, program officials did not always
have the information they needed to anticipate problems that occurred,
such as problems processing high volumes of visitors in space constrained
facilities. Turning to another aspect of our evaluation, our standards for
internal controls in the federal government state that it is important for
agencies to have controls in place to help ensure that policies and
procedures are applied and that managers be made aware of problems so that
that they can be addressed and resolved in a timely fashion.^10 CBP
officials at 12 of 21 land POE sites we visited told us about
US-VISIT-related computer slowdowns and freezes which adversely affected
visitor processing and inspection times and at 9 of the 12 sites, computer
processing problems were not always reported to CBP's computer help desk,
as required by CBP guidelines. Although various controls are in place to
alert US-VISIT and CBP officials to problems as they occur, these controls
did not alert officials to all problems, given they had been unaware of
the problems we identified before we brought them to their attention.
These computer processing problems have the potential to not only
inconvenience travelers because of the increased time needed to complete
the inspection process, but to compromise security, particularly if CBP
officers are unable to perform biometric checks--one of the critical
reasons US-VISIT was installed at POEs. Our internal control standards
also call for agencies to establish performance measures throughout the
organization so that actual performance can be compared to expected
results. While the US-VISIT program office established performance
measures for fiscal years 2005 and 2006 intended to gauge performance of
various aspects of US-VISIT at air, sea and land POEs in the aggregate,
performance measures specifically for land POEs have not been developed.
It is important to do so, given that there are significant operational and
facility differences among these different types of POEs. Additional
performance measures that consider operational and facility differences at
land POEs would put US-VISIT program officials in a better position to
identify problems, trends, and areas needing improvements.
^7GAO, Internal Control: Standards for Internal Control in the Federal
Government, [44]GAO/AIMD-00-21 .3.1 (Washington, D.C.: November 1999), and
GAO, Internal Control Standards: Internal Control Management and
Evaluation Tool, [45]GAO-01-1008G (Washington, D.C.: August 2001).
^8US-VISIT was not installed at 14 of the 16 other POEs because visitors
subject to US-VISIT are not permitted to enter the country at those
locations; at the other 2 POEs, DHS lacked the infrastructure needed to
install the equipment.
^9GAO, Homeland Security: Recommendations to Improve Key Border Security
Programs Need to Be Implemented, [46]GAO-06-296 (Washington, D.C.:
February 2006).
^10 [47]GAO/AIMD-00-21 .3.1 and [48]GAO-01-1008G .
US-VISIT has concluded that, for various reasons, it cannot currently
implement a biometric US-VISIT exit capability without incurring a major
impact on land POE facilities. According to officials, implementing a
biometrically based exit recording system like that used to record those
entering or re-entering the country is potentially costly (an estimated $3
billion), would require new infrastructure, and would produce major
traffic congestion because travelers would have to stop their vehicles
upon exit to be processed--an option officials consider unacceptable.
US-VISIT officials stated that they believe technological advances over
the next 5 to 10 years will enable the biometric verification of persons
exiting the country without a major impact on facilities. In the interim,
the US-VISIT program office is testing radio frequency identification
(RFID) technology as a nonbiometric means of recording visitors as they
exit. RFID technology can be used to electronically identify and gather
information contained on a tag--in this case, a unique identifying number
embedded in a tag on a visitor's arrival/departure form--which an
electronic reader at the POE is intended to detect. While RFID technology
has thus far required few facility and infrastructure changes, US-VISIT's
initial testing and analysis of this technology has identified numerous
performance and reliability problems, such as the failure of RFID readers
to detect a majority of travelers' tags during testing. Additional testing
is planned to address such problems. Nevertheless, the RFID solution does
not meet the statutory requirement for a biometric exit capability because
the technology as tested cannot meet a key goal of US-VISIT--ensuring that
visitors who enter the country are the same ones who leave. Specifically,
the RFID tag in the visitor's arrival/departure form cannot be physically
tied to an individual, which means that while a document may be detected
as leaving the country, the person to whom it was issued at time of entry
may be somewhere else. By statute, DHS was to have reported to Congress by
June 2005 on how it intended to fully implement an entry/exit program.
This plan is to include, among other things, a description of the manner
in which the US-VISIT program meets the goals of a comprehensive entry and
exit screening system--including both biometric entry and exit--and how it
will fulfill statutory obligations. As of October 2006, this plan was
still under review in the Office of the Secretary, according to US-VISIT
officials. Without such a plan, DHS cannot articulate how entry/exit
concepts fit together--including any interim nonbiometric solutions--and
neither DHS nor Congress is in a good position to prioritize and allocate
resources, including funds for any facility modifications that might be
needed, for a US-VISIT exit capability, to plan for the program's future,
or to consider trade-offs between traveler convenience and security.
DHS has not yet articulated how US-VISIT is to strategically fit with
other land-border security initiatives and mandates, and thus cannot
ensure that these programs work in harmony to meet mission goals and
operate cost effectively. As we reported 3 years ago, agency programs need
to properly fit within a common strategic context governing key aspects of
program operations, such as what functions are to be performed, what
facility or infrastructure changes will be needed to ensure that they
operate in harmony and as intended, and what standards govern the use of
technology. DHS has drafted a strategic plan defining an overall
immigration and border management strategy, but has not yet approved it,
and did not provide it to us for review. Meanwhile, new border security
initiatives or mandates are planned or under way that could potentially
have an impact on US-VISIT operations and facilities at land POEs. For
example, no later than June 2009, U.S. citizens and foreign nationals of
Canada, Bermuda, and Mexico will be required, for the first time, to
present a passport or other documents deemed sufficient to show identity
and citizenship when entering the country from within the western
hemisphere. It is not yet known what types of documents, other than
passports, may be permitted at land POEs, or whether these documents and
the equipment required to read them can be aligned with US-VISIT
technologies. Until decisions for this and other initiatives are made, it
remains unclear how this program will be integrated with US-VISIT, if at
all--raising the possibility that CBP would be faced with managing
differing technology platforms and border inspection processes at each
land POE. Knowing how US-VISIT is to work in concert with other border
security and homeland security initiatives and what facility or facility
modifications might be needed could help Congress, DHS, and others better
understand what resources and tools are needed to ensure success and
ensure that land POE facilities are positioned to accommodate them.
To help DHS optimize its investment in US-VISIT at land POEs, we are
recommending that the Secretary of Homeland Security direct the US-VISIT
Program Director, in collaboration with the Commissioner of CBP, to (1)
improve existing controls for identifying and reporting computer
processing and other operational problems to help ensure that these
controls are consistently administered and (2) develop performance
measures specifically for assessing the impact of US-VISIT operations at
land POEs. Also, in view of the fact that DHS has not met the statutory
requirement that it issue a report describing a comprehensive biometric
entry and exit system for US-VISIT, we are also recommending that as DHS
finalizes the mandated report, the Secretary of Homeland Security take
steps to ensure that the report includes, among other things, information
on the costs, benefits, and feasibility of deploying biometric and
nonbiometric exit capabilities at land POEs; a discussion of how DHS
intends to move from a nonbiometric exit capability, such as the
technology currently being tested, to a reliable biometric exit capability
that meets statutory requirements; and a description of how DHS plans to
align US-VISIT with other emerging land border security initiatives and
what facilities or facility modifications would be needed at land POEs to
ensure that different technologies and processes work in harmony.
DHS generally agreed with our recommendations and stated that it either
had begun to take or is planning to take actions to implement them. It
acknowledged that the exit technology tested by DHS would not satisfy
statutory requirements for a biometric exit system and said that it would
perform research and industry outreach to satisfy the mandate. DHS,
however, disagreed with our finding that the US-VISIT program office did
not fully consider the impact of US-VISIT on the overall operations at
POEs. It said that US-VISIT impacts are limited to changes in Form I-94
processing time, which according to officials improved, and that issues
related to capacity, staffing, and other factors are "arguably" beyond the
scope of US-VISIT. We agree that the approach taken to do operational
assessments of the impact of US-VISIT land POE facilities focused on
changes to I-94 processing time. Our concern is that the assessments did
not examine other operational factors, such as US-VISIT's impact on
physical facilities, to help ensure that US-VISIT operates as intended. We
believe more complete assessments of the impact of US-VISIT on land POE
operations would better position DHS to anticipate potential problems and
develop solutions, especially as additional US-VISIT capabilities, such as
10 fingerprint scanning, are introduced at these facilities.
Background
US-VISIT is a large, complex governmentwide program intended to achieve
the goals of (1) enhancing the security of U.S. citizens and visitors, (2)
facilitating legitimate travel and trade, (3) ensuring the integrity of
the U.S. immigration system, and (4) protecting the privacy of visitors.
The program is intended to carry out these goals by
o collecting, maintaining, and sharing information on certain
foreign nationals who enter and exit the United States;
o identifying foreign nationals who (1) have overstayed or
violated the terms of their visit; (2) can receive, extend, or
adjust their immigration status; or (3) should be apprehended or
detained by law enforcement officials;
o detecting fraudulent travel documents, verifying visitor
identity, and determining visitor admissibility through the use of
biometrics (digital fingerprints and a digital photograph); and
o facilitating information sharing and coordination within the
immigration and border management community.
Currently, US-VISIT's scope includes the pre-entry, entry, status, and
exit of hundreds of millions of foreign national travelers who enter and
leave the United States at over 300 air, sea, and land POEs.
Legislative Overview
The current statutory framework for US-VISIT originates with a requirement
to implement an integrated entry and exit data system for foreign
nationals, enacted in the Immigration and Naturalization Service Data
Management Improvement Act (DMIA) of 2000.^11 The DMIA replaced in its
entirety a provision of the Illegal Immigration Reform and Immigrant
Responsibility Act of 1996 (IIRIRA) that had required an automated system
to record and then match the departure of every foreign national from the
United States to the individual's arrival record.^12 The DMIA instead
required an electronic system that would provide access to and integrate
foreign national arrival and departure data that are authorized or
required to be created or collected under law and are in an electronic
format in certain databases, such as those used at POEs and consular
offices. Unlike the earlier law, the DMIA specifically provided that it
not be interpreted to impose any new documentary or data collection
requirements on any person, but it also provided that it not be construed
to reduce or curtail the authority of DHS or State under any other
provision of law. Thus, the DMIA did not specifically require the
collection of any new data on foreign nationals departing at land POEs.
^118 U.S.C. S 1365a.
^12Pub. L. No. 104-208, div. C, S 110, 110 Stat. 3009-546, 3009-558-59.
The system as described in the DMIA is to compare available arrival
records to available departure records; allow on-line search procedures to
identify foreign nationals who may have overstayed their authorized period
of admission; and use available data to produce a report of arriving and
departing foreign nationals. The DMIA also required the implementation of
the system at airports and seaports by December 31, 2003, at the 50
highest volume land POEs by December 31, 2004; and at all remaining POEs
by December 31, 2005.
Laws passed after the DMIA also provided specific requirements with regard
to the use of biometrics for those entering and leaving the country. For
example, the USA PATRIOT Act required, by October 26, 2003, the
development and certification of a technology standard, including
appropriate biometric identifier standards, that can be used to verify the
identity of persons applying for a U.S. visa, or seeking to enter the
United States pursuant to a visa, for the purposes of conducting
background checks, confirming identity, and ensuring that a person has not
received a visa under a different name.^13 The act also provided that in
developing US-VISIT, DHS and State were to focus particularly on the
utilization of biometric technology and the development of
tamper-resistant documents readable at POEs. The Enhanced Border Security
and Visa Entry Reform Act of 2002 required DHS and State to implement,
fund, and use the technology standard, including biometric identifier
standards, developed under the USA PATRIOT Act at U.S. POEs; it also
required the installation at all POEs of equipment and software to allow
biometric comparison and authentication of all U.S. visas and other travel
and entry documents issued to aliens, and passports issued by Visa Waiver
Program participating countries with biometric identifiers. The
Intelligence Reform and Terrorism Prevention Act of 2004,^14 unlike the
DMIA, specifically required the collection of biometric exit data for all
categories of individuals required to provide biometric entry data under
US-VISIT, regardless of the port of entry where they entered the United
States. The 2004 law did not set a deadline for implementation of this
requirement, however. Appendix III discusses the legislative history of
the US-VISIT program in greater detail.
^138 U.S.C. S 1379. The official title of the USA PATRIOT Act is the
Uniting and Strengthening America by Providing Appropriate Tools Required
to Intercept and Obstruct Terrorism Act of 2001.
^14Pub. L. No. 108-458.
Management and Implementation of US-VISIT
Within DHS, the US-VISIT Program Office is headed by the US-VISIT
Director, who reports directly to the Deputy Secretary for Homeland
Security. The US-VISIT Program Office has responsibility for managing the
acquisition, deployment, operation, and sustainment of US-VISIT and has
been delivering US-VISIT capability incrementally. According to US-VISIT,
increments 1 and 2 include a mix of interim or temporary solutions and
permanent deployments. For example, increment 1B, dealing with exit
capability at airports, is still being piloted, while US-VISIT entry
capability at the 50 busiest land POEs--increment 2B--is considered to be
a permanent deployment. Increment 3--providing entry capability at the
land POEs not covered under Increment 2B--is considered by US-VISIT to be
a permanent deployment and increment 4 is, according to US-VISIT, the
yet-to-be defined US-VISIT strategic capability. Table 1 summarizes the
scope, timeline, and intended functionality of the US-VISIT increment
schedule. This report focuses generally, but not exclusively, on
increments 2B (entry capability at the 50 busiest land POEs), 2C (exit
capability at the 50 busiest land POEs), and 3 (entry capability at the
remaining land POEs)--the increments and information that are shown in
bold in table 1.
Table 1: Summary of the Scope, Schedule for Completion, and Intended
Functionality of the US-VISIT Increment Schedule
Schedule for
Increment Scope completion Intended functionality
1 A Entry at air Jan. 5, 2004^a Deliver the initial
and sea ports operational biometric
of entry entry capability to 115
air and 14 sea ports.
B Exit at air and sea Nov. 30, 2004 Evaluate exit
ports of entry pilot
alternatives at
13 air and 2
seaports.
2 A Read visas and Oct. 26, 2006 Deliver the initial
other travel operating capability to
documents compare and verify
embedded with biometric data embedded
biometric in machine-readable
information visas and other travel
upon entry at documents at all ports
all ports of of entry.
entry
B Entry at 50 busiest Dec. 31, 2004^b Provide
land ports of entry biometric entry
capability at
the 50 busiest
land ports of
entry,
including an
automated
process for
issuing the
I-94 entry and
exit form.
C Exit and reentry at Jul. 2005-undefined Automate
land ports of entry recording of
exit and
reentry at
busiest 50 land
ports of entry.
3 Remaining land Dec. 31, 2005^b Provide increment 2B
ports of entry entry capability at
remaining land ports.
4 Undefined Undefined Define, design, build,
and implement a
strategic US-VISIT
capability.^c
Source: US-VISIT Program Office.
Note: Bold text reflects increments primarily focused on land POEs.
aThe statutory deadline for implementing US-VISIT at air and sea ports of
entry was December 31, 2003; the Federal Register notice announcing
implementation of increment 1A by that date was published on January 5,
2004.
bDenotes a statutory deadline.
cAccording to US-VISIT program officials, increment 4 will likely consist
of a further series of enhancements.
From fiscal year 2003 through fiscal year 2007, total funding for the
US-VISIT program has been about $1.7 billion. Table 2 summarizes
appropriations for US-VISIT for fiscal years 2003 through 2007, as
enacted.
Table 2: US-VISIT Appropriations Enacted, Fiscal Years 2003 Through 2007
(in millions of dollars)
Budget 2003 2004 2005 2006 2007
activity appropriated appropriated appropriated appropriated appropriated
US-VISIT $362 $328 $340 $337 $362
Source: US-VISIT Program Office.
Note: Starting in Fiscal Year 2004, funding for the US-VISIT program has
been appropriated on a "no-year" basis, meaning that there is no time
limit on the spending of appropriated funds; funds that remain unexpended
at the end of a fiscal year are carried over into the next fiscal year.
In prior reports on US-VISIT, we have identified numerous challenges that
DHS faces in delivering program capabilities and benefits on time and
within budget. In September 2003, we reported that the US-VISIT program is
a risky endeavor, both because of the type of program it is (large,
complex, and potentially costly) and because of the way that it was being
managed.^15 We reported, for example, that the program's acquisition
management process had not been established, and that US-VISIT lacked a
governance structure. In March 2004, we testified that DHS faces a major
challenge maintaining border security while still welcoming visitors.
Preventing the entry of persons who pose a threat to the United States
cannot be guaranteed, and the missed entry of just one can have severe
consequences. Also, US-VISIT is to achieve the important law enforcement
goal of identifying those who overstay or otherwise violate the terms of
their visas. Complicating the achievement of these security and law
enforcement goals are other key US-VISIT goals: facilitating trade and
travel through POEs and providing for enforcement of U.S. privacy laws and
regulations.^16 Subsequently, in May 2004, we reported that DHS had not
employed the kind of rigorous and disciplined management controls
typically associated with successful programs.^17 Moreover, in February
2006, we reported that while DHS had taken steps to implement most of the
recommendations from our 2003 and 2004 reports, progress in critical areas
had been slow.^18 Of 18 recommendations we made since 2003, only 2 had
been fully implemented, 11 had been partially implemented, and 5 were in
the process of being implemented, although the extent to which they would
be fully carried out was not yet known.
US-VISIT Scope, Operations, and Processing at Land POEs
As mentioned earlier, US-VISIT currently applies to a certain group of
foreign nationals--non-immigrants from countries whose residents are
required to obtain nonimmigrant visas before entering the United States
and residents of certain countries who are exempt from U.S. visa
requirements when they apply for admission to the United States for up to
90 days for tourism or business purposes under the Visa Waiver Program.^19
US-VISIT also applies to (1) Mexican nonimmigrants traveling with a Border
Crossing Card (BCC) who wish to remain in the United States longer than 30
days or who declare that they intend to travel more than 25 miles into the
country from the border (or more than 75 miles from the Arizona border in
the Tucson area)^20 and (2) Canadians traveling to the United States for
certain specialized reasons.^21
15GAO, Homeland Security: Risks Facing Key Border and Transportation
Security Program Need to Be Addressed, [49]GAO-03-1083 (Washington, D.C.:
September 2003).
^16GAO, Homeland Security: Risks Facing Key Border and Transportation
Security Program Need to Be Addressed, [50]GAO-04-569T (Washington, D.C.:
March 2004).
^17GAO, Homeland Security: First Phase of Visitor and Immigration Status
Program Operating, but Improvements Needed, [51]GAO-04-586 (Washington,
D.C.: May 2004).
^18 [52]GAO-06-296 .
Most land border crossers--including U.S. citizens, lawful permanent
residents, and most Canadian and Mexican citizens--are, by regulation or
statute, not required to enroll into US-VISIT.^22 In fiscal year 2004, for
example, U.S. citizens and lawful permanent residents comprised about 57
percent of land border crossers; Canadian and Mexican citizens comprised
^19Certain holders of nonimmigrant visas, such as foreign diplomats and
other representatives of foreign governments, and representatives of
certain international organizations, are expressly exempted from US-VISIT
requirements by regulation, as are individuals who are younger than 14 or
older than 79 on the date of admission. 8 C.F.R. S 235.1(d)(1)(iv)(A),
(B).
^20Under 8 C.F.R. S 235.1(d)(1)(iv)(C), DHS and the State Department may
jointly exempt a class of aliens from US-VISIT requirements. On August 31,
2004, DHS announced in the Federal Register that the two agencies had
determined that US-VISIT requirements generally would apply only to
Mexican nationals for whom a Form I-94 is issued under 8 C.F.R. S
235.1(f)(1)(iii) or (v). This means that Mexican nationals using a BCC who
are admitted for no more than 30 days to visit within 25 miles of the
border (or to visit within 75 miles of the Arizona border, if entering
through certain POEs in Arizona) generally are not subject to US-VISIT
requirements. 69 Fed. Reg. 53,318, 53,323 (2004). The CBP officer
determines the intent of an applicant for admission through the inspection
process at a port of entry, in which the applicant must establish that he
or she is entitled to enter the United States under all applicable laws
and regulations. 8 C.F.R. S 235.1(d)(1). If a Mexican BCC holder is
admitted to the United States without an I-94, the terms of that
individual's admission to the country are the 30 day/25 mile or 75 mile
limits, and violation of those terms makes the individual removable from
the country and possibly inadmissible in the future. 8 U.S.C. SS
1227(a)(1), 1182(a)(6), (9).
^21These special cases include Canadians who are engaged to American
citizens, and Canadians who are traveling for the purpose of making major
financial investments in the United States.
^22Since the statute governing US-VISIT applies to foreign national
arrival and departure data only, U.S. citizens do not fall within the
scope of the program and therefore are exempt from US-VISIT screening.
Also, in general, regardless of whether they are to be processed into
US-VISIT, Mexican citizens must present either a passport and visa or a
BCC when seeking admission to the United States, while Canadian citizens
generally do not need such documents. According to US-VISIT, when Mexicans
receive a BCC, the data on the individual entered into U.S. databases at
the time of their visa application are accessible by US-VISIT--if they are
to be processed into it for any reason.
about 41 percent; and less than 2 percent were US-VISIT enrollees. Figure
1 shows the number and percent of persons processed under US-VISIT as a
percentage of all border crossings at land, air, and sea POEs in fiscal
year 2004.
Figure 1: Persons Processed under US-VISIT as a Percentage of all Border
Crossings at Land, Air, and Sea Ports of Entry, Fiscal Year 2004
Note: Persons processed by US-VISIT may include foreign nationals who were
also issued an I-94 valid for multiple entries and who have re-entered
multiple times. Total entering the U.S. includes U.S. citizens who may
have re-entered the country multiple times and foreign nationals,
including those not issued I-94s, such as Canadian citizens and Mexicans
with BCCs, and those issued multiple entry I-94s who also may have
re-entered multiple times. U.S. citizens do not fall within the statutory
scope of US-VISIT and therefore are exempt from US-VISIT screening.
Foreign nationals covered by US-VISIT enter the United States via a
multi-step process. For individuals required to obtain visas before
entering the United States, the US-VISIT process begins overseas at U.S.
consular offices, which in addition to other processes, collect biographic
data (i.e., country of origin and date of birth) and biometric data (i.e.,
digital fingerscans and a digital photograph) from the applicant. These
data are checked against databases or watch lists of known criminals and
suspected terrorists. If the individual's name does not appear on any
watch list and the individual is not disqualified on the basis of other
issues that may be relevant, he or she is to be issued a visa and may seek
admission to the United States at a POE.
When visitors in vehicles first arrive at a land POE, they initially enter
the primary inspection area where CBP officers, often located in booths,
are to visually inspect travel documents and query the visitors about such
matters as their place of birth and proposed destination. Visitors
arriving as pedestrians enter an equivalent primary inspection area,
generally inside a CBP building. If the CBP officer believes a more
detailed inspection is needed or if the visitors are required to be
processed under US-VISIT for the first time,^23 the visitors are to be
referred to the secondary inspection area--an area away from the primary
inspection area--which is generally inside a facility. The secondary
inspection area inside the facility generally contains office space,
waiting areas, and space to process visitors, including US-VISIT
enrollees. Equipment used for US-VISIT processing includes a computer,
printer, digital camera, and a two-fingerprint scanner. Figure 2 shows
US-VISIT equipment installed at one land POE.
^23At land border POEs, the I-94 issued to foreign nationals covered by
US-VISIT who are deemed admissible is considered issued for multiple
entries, unless specifically annotated otherwise. A multiple entry I-94
permits them to reenter the country, generally for up to 6 months, without
additional US-VISIT processing during the period covered by the I-94.
Figure 2: US-VISIT Equipment (computer, camera, and printer) at a Land POE
Secondary Inspection Area
CBP officers use a document reader to scan machine readable travel
documents, such as a passport or visa, and use computers to check
biographic data from the documents against watch list databases. For
US-VISIT processing, biometric verification is performed in part by taking
a digital scan of visitors' fingerprints (the left and right index
fingers) and by taking a digital photograph of the visitor. These data are
stored in the system's databases. The computer system compares the two
index fingerprints to those stored in DHS's Automated Biometric
Identification System (IDENT) that, among other things, collects and
stores biometric data about foreign nationals, including FBI information
on all known and suspected terrorists.
If the fingerprints are already in IDENT, the system performs a match
against the existing digital scans to confirm that the person submitting
the fingerprints at secondary inspection at the POE is the one on file. In
addition, the CBP officer visually compares the person to the photograph
that is in the database, which is brought up onto the computer screen. If
no prints are found in IDENT (for example, if the visitor is from a
visa-waiver country), that person is then processed into US-VISIT, with
biographic data entered into the databases, a digital scan of his or her
two index fingerprints, and a digital photograph. Once the CBP officer
deems the visitor to be admissible, the individual is issued an I-94 or an
I-94W (for persons from visa waiver countries) arrival/departure form.
Figure 3 shows how U.S. citizens and most Mexicans, Canadians, and foreign
nationals subject to US-VISIT are to be processed at land POEs.
Figure 3: Overview of US-VISIT Enrollment at Land POEs for Visitors with
and without Visas Entering the Country for the First Time
Note: Most Mexican entrants with BCCs are not required to obtain an I-94
arrival/departure form if CBP officers determine that the entrants do not
intend to travel more than 25 miles into the country or stay more than 30
days. If it is determined by the CBP officer that a Mexican citizen
intends to exceed either limit, the entrant is referred to secondary
inspection at the POE, where they are to be processed into US-VISIT, and
issued an I-94 form, if no grounds are found on which to deny them entry.
According to federal regulation (8 CFR S 235.1(f)(1)(v)(A)), in the Tucson
sector, Mexican visitors may travel up to 75 miles into the country
without being issued an I-94 form, which means that they generally would
not be processed into US-VISIT upon entry.
In addition to IDENT, US-VISIT relies on a number of information systems
to process visitors. Among the computer software applications utilized as
part of US-VISIT is U.S. Arrival, which provides an integrated process for
issuing I-94 forms and collection of biometric data for visitors covered
by US-VISIT who arrive at land POEs. Another is U.S. Pedestrian, which is
used by CBP officers in conducting inspections of visitors who arrive at
land POEs, entering the United States on foot, mostly along the southern
border.
Overview of Land POE Facilities
As of August 2006, there were 170 land POEs that are geographically
dispersed along the nation's more than 7,500 miles of borders with Canada
and Mexico. Some are located in rural areas (such as Alexandria Bay, New
York and Blaine-Pacific Highway, Washington) and others in cities (such as
Detroit) or in U.S. cities across from Mexican cities, such as Laredo and
El Paso, Texas. The volume of visitor traffic at these POEs varies widely,
with the busiest four POEs characterized by CBP as San Ysidro, Calexico,
and Otay Mesa, California, and Bridge of the Americas in El Paso, Texas.
Appendix IV lists the 20 busiest land POEs, based on the number of
individuals in vehicles and pedestrian traffic recorded entering the
country through POEs in fiscal year 2005.
From a facilities standpoint, land POEs vary substantially in building
type and size (square footage) as shown in Figures 4a, 4b, and 4c.
Figure 4a: Land POE at Blaine-Peace Arch in Blaine, Washington
Figure 4b: Land POE Facility at the Detroit-Windsor Tunnel in Detroit,
Michigan
Figure 4c: Land POE Facility at Rouses Point, New York
DHS Has Installed US-VISIT Biometric Entry Capability at Nearly All Land POEs,
but Faces Challenges Identifying and Monitoring the Operational Impacts on POE
Facilities
DHS has installed US-VISIT biometric entry capability at nearly all land
POEs consistent with statutory deadlines, but faces challenges identifying
and monitoring the operational impacts on POE facilities. CBP officials at
the 21 land POEs we visited told us that US-VISIT has generally enhanced
the officials' ability to process visitors subject to US-VISIT by
providing officials the ability to do biometric checks and automating the
issuance of the visitor I-94 arrival/departure form. DHS plans to
introduce changes and enhancements to US-VISIT at land POEs intended to
bolster border security, but deploying them poses potential operational
challenges to land POE facilities that are known by DHS to be
space-constrained. US-VISIT's efforts to evaluate the impact of US-VISIT
on land POE facilities thus far raises questions about whether sufficient
management controls exist to ensure that additional operational impacts,
such as processing delays or further space constraints, will be
anticipated, identified, and appropriately addressed and resolved.
US-VISIT Biometric Entry Capability Was Installed at Nearly All Land POEs with
Minimal Construction, According to Program Officials
In December 2005, DHS officials announced that US-VISIT biometric entry
capability had been installed at land POEs in conformance with statutory
mandates and Increments 2B and 3 of DHS's US-VISIT schedule. Deployment at
the 50 busiest land POEs was completed by December 31, 2004, and at all
but 2 of the other land POEs where DHS determined the program should
operate by December 31, 2005, as required by law. Our review of US-VISIT
records and discussions with US-VISIT program officials indicated that DHS
installed US-VISIT biometric entry capability at 154 of 170 land POEs.
(App. V lists all land POEs where US-VISIT has been installed.) With
regard to 14 of the 16 POEs where US-VISIT was not installed, CBP and
US-VISIT program office officials told us there was no operational need
for US-VISIT because visitors who are required to be processed into
US-VISIT are, by regulation, not authorized to enter the United States at
these locations.^24 Generally, these POEs are small facilities in remote
areas. At 2 other POEs, US-VISIT needs to be installed in order to achieve
full implementation as required by law, but both of these present
significant challenges to installation of US-VISIT. These POEs do not
currently have access to appropriate communication transmission lines to
operate US-VISIT. CBP officials told us that, given this constraint, they
determined that they could continue to operate as before. Thus, CBP
officers at these locations process foreign visitors manually.
US-VISIT program officials reported and available records showed that
equipment for US-VISIT entry capability was installed with minimal
construction at the 154 land POEs. At the 21 land POEs we visited, we
observed that US-VISIT entry capability equipment had been installed with
little or no change to facilities. For example, at the Detroit-Windsor
tunnel and the Detroit Ambassador Bridge POEs in Detroit, Michigan,
officials confirmed that no additional computer workstations were required
to be installed; at the Blaine-Peace Arch POE at Blaine, Washington,
electrical capacity was upgraded to accommodate US-VISIT computer needs.
In general, our review of reports prepared for each of these POEs
indicated that DHS upgraded existing or added new computer workstations
and printers in the secondary inspections areas of these facilities (the
area where US-VISIT enrollees are processed); installed digital cameras to
photograph those to be processed in US-VISIT; installed two-fingerprint
scanners that digitally record fingerprints; and installed electronic card
readers for detecting data embedded in machine-readable passports and
visas. According to US-VISIT officials, funding for installing US-VISIT
entry equipment nationwide was approximately $16 million--about 9 percent
of the $182 million budgeted for US-VISIT deployment at land ports between
fiscal year 2003 and fiscal year 2005. Officials reported that the
remaining funds were allocated to computer network infrastructure (about
72 percent) and design and development, network engineering, fingerscan
devices, and public awareness and outreach (about 19 percent).^25
24According to CBP, these ports are classified as Class B ports. Under 8
C.F.R. S100.4(c)(2), only citizens of the United States, Canada, and
Bermuda, and Lawful Permanent Residents of the United States and certain
holders of border crossing cards may enter through Class B ports. Other
foreign nationals are allowed to enter the United States only at Class A
ports.
During our site visits, CBP officials at all 21 facilities told us that
having US-VISIT biometric entry capability generally improved their
ability to process visitors required to enroll in US-VISIT because it
provided them additional assurance that visitors are who they say they are
and automated the paperwork associated with processing the I-94
arrival/departure form. For example, with US-VISIT, the ability to scan a
visitor's passport or other travel document enables the computer at the
inspection site to capture basic biographic information and automatically
print it on the I-94 form; prior to US-VISIT deployment, the I-94 was
filled in manually by the CBP officer or the visitor.
Steps Have Been Taken to Address Operational Challenges Identified at Land POEs,
but DHS May Face Additional Challenges Resulting from Planned Enhancements
DHS plans to introduce changes and enhancements to US-VISIT at land POEs
that are designed to further bolster CBP's ability to verify that
individuals attempting to enter the country are who they say they are.
While these changes may further aid border security, deploying them poses
potential challenges to land POE facilities where US-VISIT operates and
where millions of visitors are processed annually. Our site visits,
interviews with US-VISIT and CBP officials, and the work of others suggest
that both before and after US-VISIT entry capability was installed at land
POEs, these facilities faced a number of challenges--operational and
physical--including space constraints complicated by the logistics of
processing high volumes of visitors and associated traffic congestion.
With respect to operational challenges at land POE facilities, we reported
in November 2002--more than 2 years before US-VISIT entry capability was
installed at the 50 busiest land POEs--that busy land POEs were
experiencing 2- to 3-hour delays in processing visitors and that any
lengthening of the entry process could affect visitors significantly,
through additional wait times.^26 While we cannot generalize about the
impact US-VISIT has had on processing time at all land POEs, at one of the
busiest land POEs we visited--San Ysidro, California, where more than 41
million visitors entering the country in 2005 were processed--CBP
officials told us that, although they had not measured differences in
processing times before and after US-VISIT was installed, the steps
required to process US-VISIT visitors had added to the total time needed
to process all visitors entering through the port. As a result, CBP
officials told us that they must occasionally direct visitors arriving at
peak times, such as holidays, to leave and return later in the day because
there was no room for them to wait. In this case, US-VISIT had an effect
on both visitor processing times and on the capacity of the facility to
physically accommodate pedestrian and vehicular traffic.^27
25According to US-VISIT officials, as of March 2006 about $179.5 million
of the total $182 million budget had been obligated.
A similar type of operational problem that reflects how complex visitor
processing activities occur at facilities was reported by a contractor
retained by DHS to study wait times associated with the I-94 issuance
process at another busy POE, Nogales-DeConcini in Arizona.^28 The study,
which examined wait times for 3 separate time periods over a 3-month
period in the summer of 2005, found that wait times varied by day (ranging
from about 3 1/2 minutes to almost 7 minutes across the time periods
studied) and was more a function of the number of people waiting for an
I-94 rather than the time needed to process each individual under
US-VISIT.^29 The contractor noted that the group size, wait time, and
processing all affected the dynamics of the secondary-processing area or
room, which measured approximately 40 feet by 50 feet. During one day of
the study, the contractor noted that the secondary processing room became
crowded, straining processing capacity. The contractor stated that this
occurred because some of the individuals waiting to obtain I-94s were
students or seasonal workers that required checks that included phone
calls to verify their visa status.^30 The contractor concluded that
US-VISIT provided an advantage over manual I-94 processing because the
processing was ultimately more efficient. Nevertheless, the extent to
which these problems occur is unknown because US-VISIT has not performed
comparable studies at other locations.
^26GAO, Technology Assessment: Using Biometrics for Border Security,
[53]GAO-03-174 (Washington, D.C.: Nov. 15, 2002).
^27According to US-VISIT Program Office officials, prior to deployment of
US-VISIT entry capability, San Ysidro had its own system that was
specifically designed for the POE to minimize manual I-94 processing and
help officers speed up the I-94 issuance process. However, according to
these officials, although San Ysidro's system was "probably" faster than
US-VISIT, it did not meet current US-VISIT standards for data protection,
integration, and privacy and did not require officers to do the same
database checks that are part of US-VISIT. The officials noted that
US-VISIT enhances security because it is designed to access multiple
databases nationwide and brings uniformity to the I-94 issuance process
across POEs.
^28Center for Transportation Research, the University of Texas at Austin,
Assessing the Effects of US-VISIT RFID Technology Implementation on
Vehicle and Pedestrian Crossing Times at DeConcini, Nogales, Ariz. Report
No. 2 Pilot Data Collection and Analysis to Baseline Data (Austin, Tex.,
November 2005). The project was performed under contract for the DHS
Private Sector Office. The report examines processing times at primary
inspection for privately owned vehicles (POV) and pedestrians and also
processing times for visitors who require enrollment in US-VISIT with a
focus on the introduction of Radio Frequency Identification (RFID)
technology at the POE, which is discussed later in this report.
DHS has long been aware of space constraints and other capacity issues at
land POE facilities. A task force report developed in response to the
Immigration and Naturalization Service Data Management Improvement Act of
2000 found that 117 of 166 land POEs operating at that time (about 70
percent) had three-fourths or less of the required space.^31 The US-VISIT
Program Office subsequently confirmed that land POEs had traffic flow
problems (i.e., lack of space, insufficient roadways, and poor access to
facilities) and that many were aging and undersized; the majority of land
POEs were constructed before 1970 when the volume of border crossings was
not as great as it is now. Our work for this report indicates that such
problems persist, though we cannot generalize to all facilities. For
example, at the Nogales-Morley Gate POE in Arizona, where up to 6,000
visitors are processed daily (and up to 10,000 on holidays), US-VISIT
equipment was installed, but the system is not used there because CBP
determined that it could not accommodate US-VISIT visitors because of
concerns about CBP's ability to carry out the process in a constrained
space while thousands of other people not subject to US-VISIT processing
already transit through the facility daily.^32 Thus, if a visitor is to be
processed into US-VISIT from Morley Gate, that person is directed to
return to Mexico (a few feet away) and to walk the approximately 100 yards
to the Nogales-DeConcini POE facility, which has the capability to handle
secondary inspections of this kind. Figure 5 shows the Nogales-Morley Gate
POE building--the small windowed structure on the right is the processing
site.
^29The average wait times were reported by the US-VISIT contractor for the
periods of June 20 through 25, 2005, and August 15 through 20, 2005. No
results were reported for the third period from July 7 through 8, 2005.
^30 According to CBP, CBP officers determine what checks are needed to
determine admissibility depending on the purpose of travel.
^31DMIA Task Force, DMIA Task Force First Annual Report to Congress, Dec.
2002.
Figure 5: Nogales-Morley Gate POE, Arizona
CBP officials at three other land POEs on the southwest border also told
us that space constraints were a factor in their ability to efficiently
process those subject to US-VISIT. Specifically, at the POEs at Los
Tomates, Gateway, and Brownsville/Matamoros, Texas, CBP officials told us
that US-VISIT had made I-94 processing more efficient, but travelers
continued to experience delays of up to 2 hours on peak holiday weekends
as they had before US-VISIT was installed. Officials at these facilities
told us that they believe they could alleviate this problem if the
facility had the space to install more workstations capable of operating
US-VISIT entry capability.
^32CBP based this decision on the high volume of pedestrians entering the
United States through the Morley Gate POE; the fact that, before
deployment, I-94s had not been previously issued at the Morley Gate POE;
and the close proximity of the Morley Gate POE facility to the nearby
DeConcini POE facility, about 100 yards away.
According to CBP officials, CBP has begun to examine the condition of each
facility with the intent of developing a list of border station
construction and modification needs and plans to prioritize construction
projects based on need. In the meantime, CBP and US-VISIT officials told
us that they have taken steps to address problems operating US-VISIT when
space constraints are an issue. For example, at the POE in Highgate
Springs, Vermont, CBP officials told us that US-VISIT computers and those
needed to process commercial truck drivers and their cargoes were
competing for space at the interior counter area of the building.
Following our visit, we were told that the POE had adjusted its space
allocation inside the POE building so that there are now five workstations
for US-VISIT and other noncommercial visitor processing, one of which can
do both. According to the POE assistant area port director, the POE also
extended the hours during which truck drivers can be processed in a
separate building designed entirely for processing them and their cargoes,
in order to relieve the space pressures in the main building that occur
during the high-volume tourist summer season.
US-VISIT and CBP officials reported that they have taken other steps to
try to minimize any problems that may arise integrating US-VISIT entry
capability operations with other CBP operations. For example, to help
ensure that US-VISIT does not have an adverse impact on CBP's operations
at ports of entry, US-VISIT and CBP established a liaison office in June
2005, involving supervisory managers detailed from various CBP offices.
The liaison officers worked with US-VISIT staff to overcome operational
issues at POEs; review plans; develop and deliver training; set up call
sites during busy holiday periods to provide support to POEs needing
assistance; and work through technology problems. A CBP official told us
that he believes both US-VISIT and CBP have been successful in helping
land POEs overcome problems as they arise (such as those that might occur
operating new technology at space constrained facilities). The CBP
officers detailed to the liaison office have since returned to their
original duty stations. According to CBP officials, CBP has an open
invitation to re-initiate the liaison office at any time.
While past challenges with facilities are well known to US-VISIT and CBP
officials and efforts have been made to address them, it is not clear
whether US-VISIT or CBP is prepared to anticipate additional facilities
challenges--challenges already acknowledged by senior US-VISIT
officials--that may arise as new US-VISIT capabilities are added. The
following two key initiatives, in particular, could affect operations at
land POEs:
o 10-fingerprint scanning of US-VISIT enrollees. DHS plans to
require that individuals subject to US-VISIT undergo a
10-fingerprint scan, in place of the current 2, to ensure the
highest levels of accuracy in identifying people entering and
exiting the country. Under this plan, US-VISIT visitors would be
required to have all fingerprints scanned the first time they
enroll in US-VISIT and to submit a 2-fingerprint scan during
subsequent visits. A cost/benefit analysis of this capability is
under way by DHS, selected components, and other agencies, with an
anticipated transition period (from the 2- to 10-fingerprint scan
requirement) taking place later this year and next. In January
2006, the former Director of US-VISIT testified before the Senate
Appropriations Subcommittee on Homeland Security that in order to
introduce a 10-fingerprint scan capability at land POEs and other
locations, DHS would need a 6-to-8-month period to develop the
capability and additional time to introduce initial operating
capability. The former Director testified that unresolved
technical challenges create the potential for a significant
increase in the length of time needed to process individuals
subject to US-VISIT at POEs once the 10-fingerprint requirement is
in place.^33 In commenting on this report, DHS noted that US-VISIT
has been working with industry to speed up processing time and
reduce the size of 10-print capture devices to "eliminate or
significantly reduce the impact of deploying 10-print scanning."
As noted earlier, our past work has shown that any lengthening in
the process of entering the United States at the busiest POEs
could inconvenience travelers and result in fewer visits to the
United States or lost business to the nation.^34
o Electronic passport readers for Visa Waiver Program travelers.
All Visa Waiver Program travelers with passports issued after
October 26, 2005 must have passports that contain a digital
photograph printed in the document; passports issued to visa
waiver travelers after October 26, 2006 must have integrated
circuit chips, known as electronic passports, which are also
called "e-passports." (The Visa Waiver Program allows travelers
from certain countries to gain entry to the United States without
a visa.) These e-passports are to contain biographic and biometric
information that can be read by an e-passport reader or scanner, a
device which electronically reads or scans the information
embedded in the e-passport at close proximity, about 4 inches to
the reader. According to DHS, all POEs must have the ability to
compare and authenticate e-passports as well as visas and other
travel and entry documents issued to foreign nationals by DHS and
the Department of State. Earlier this year, DHS announced it had
successfully tested e-passports and e-passport scanners. A
US-VISIT Program Office official told us that deployment of these
scanners is moving toward implementation at POEs located at 34
selected international airports where about 97 percent of the Visa
Waiver Program travelers enter the country. The official said that
e-passport readers will not initially be installed at land
POEs--which process a small percentage of visa waiver
travelers--and there is no timeline for deploying the scanners at
land POEs, although there are plans to do so at some point. CBP's
Director of Automated Programs in the Office of Field Operations
told us that e-passport readers and the database used to process
e-passport information do not operate as fast as current processes
at land POEs and thus could cause additional delays, especially at
POEs experiencing processing backlogs and wait times, such as San
Ysidro, California, and Nogales-Mariposa, Arizona.
^33According to this official, there are at least four major unsolved
technological challenges to 10-fingerprint scanning, including: no current
fingerprinting device on the market that can take and process 10 prints as
quickly as 2; no current device to capture 10 prints from the visitor as
physically easy as with 2; no current devices meet operational processing
requirements for ports of entry, embassies, or consulates; and the need to
manufacture sufficient quantities of scanners to respond to the
initiative.
^34See [54]GAO-03-171 .
Given the potential impact that enhancements to US-VISIT could have both
on visitor processing overall and on land POE facilities, it is important
for US-VISIT and CBP to be able to gauge how new changes associated with
US-VISIT may affect operations. However, our past work showed that
US-VISIT had not taken all needed steps to help ensure that US-VISIT entry
capability operates as intended because the approaches used to gauge or
anticipate the impact of US-VISIT operations on land POE facilities was
limited. Specifically, in 2005, in an effort to evaluate the impact of
US-VISIT on the busiest land POEs, DHS completed evaluations of the time
needed to process and issue the I-94 arrival/departure form at 5 POEs. To
conduct its study, DHS studied the I-94 process before and after US-VISIT
was installed at five land POEs at three locations (Port Huron, Michigan;
Douglas, Arizona; and Laredo, Texas). Based on data collected from these 5
POEs, US-VISIT officials concluded that no additional staff or facility
modifications were needed at other POEs in order to accommodate US-VISIT.
We reported in February 2006 that the scope of this evaluation was too
limited to determine potential operational impacts on POEs. ^35 We
reported three limitations, in particular: (1) that the evaluations did
not take into account the impact of US-VISIT on workforce requirements or
facility needs because the evaluations focused solely on I-94 processing
time; (2) that the locations selected were chosen in part because they
already had sufficient staff to support a US-VISIT pilot-test; and (3)
that US-VISIT officials did not base their evaluation of I-94 processing
times on a constant basis before and after deployment of US-VISIT--that
is, pre-deployment sites used fewer computer workstations to process
travelers than did sites studied after deployment. We recommended that DHS
explore alternative means to obtaining a full understanding of the impact
of US-VISIT on land POEs, including its impact on workforce levels and
facilities and that POE sites be surveyed that had not been included in
their original assessment. US-VISIT responded that wait times at land POEs
were already known and that it would conduct operational assessments at
POEs as new projects came online. However, apart from a study conducted at
one POE facility by a DHS contractor in August 2005 (cited above),
US-VISIT has not provided documentation on any additional evaluations
conducted that would provide additional insights about the effect of
US-VISIT on land POE operations, including wait times.
We recognize that it may not be cost-effective for US-VISIT or CBP to
conduct a formal assessment of the impact US-VISIT has on each land POE
now that the entry capability has been installed or of all facilities once
new enhancements are introduced. Nevertheless, the assessment methodology
US-VISIT has used in the past--which focused on measuring changes in I-94
processing times--raises questions about how the agency will assess the
impact that the transition from 2- to 10-fingerprint scanning may have on
land POE operations. That is, if US-VISIT uses the same methodology and
focuses on the changes in processing time, rather than on the overall
impact on operations, including facilities, staffing, and support
logistics, the results will have the same limitations we highlighted in
our earlier study. Our February 2006 recommendation would also be
applicable to enhancements that have the potential to negatively affect
operations.
^35 [55]GAO-06-296 .
Management Controls Did Not Always Alert US-VISIT and CBP to Operational
Problems
US-VISIT and CBP have management controls in place to alert them to
operational problems as they occur, but these controls did not always work
to ensure that US-VISIT operates as intended. Specifically, US-VISIT and
CBP officials had not been made aware of computer processing problems that
affected operations, in particular, until we brought them to their
attention, partly because these problems were not always reported. These
computer processing problems have the potential to not only inconvenience
travelers because of the increased time needed to complete the inspection
process, but to compromise security, particularly if CBP officers are
unable to perform biometric checks--one of the critical reasons US-VISIT
was installed at POEs.
Our standards for internal control in the federal government state that it
is important for agencies to provide reasonable assurance that they can
achieve effective and efficient operations.^36 This includes establishing
and maintaining a control environment that sets a positive and supportive
attitude toward control activities that are designed to help ensure that
management's directives are carried out. Control activities include
reviewing and monitoring agency operations at the functional level (i.e.,
at land POEs) to compare operational performance with planned or expected
results and to ensure that controls described in policies and procedures
are actually applied and applied properly, and having relevant, reliable,
and timely communications to ensure that information flows down, across,
and up the organization thereby helping program managers carry out their
responsibilities and providing assurance that timely action is taken on
implementation problems or information that requires follow-up.
Our site visit interviews suggest that current monitoring and control
activities were not sufficient to ensure that US-VISIT performs in
accordance with its security mission and objectives. For example, at 12 of
the 21 land POEs we visited, computer-processing problems arose that,
according to CBP officials at those locations, had an impact on processing
times and traveler delays. Generally, officials at these 12 sites said
that computer problems occurred with varying frequency and duration; some
said that computers were at times slow or froze up during certain times of
the day, while others said that problems were sporadic and they could not
ascribe them to a particular time of the day.^37 None of the officials we
interviewed had formally assessed the impact of computer slowdowns or
freezes on visitors and visitor wait times, but nonetheless cited computer
problems as a cause of visitor delays. In November 2005, we notified a
US-VISIT program official in headquarters that we had heard about computer
processing problems at some of the POEs we had visited. The official told
us that US-VISIT had not been aware of these problems and said that, as a
result of our work, CBP had been contacted to investigate the problem. In
June 2006, a CBP official responsible for information technology at CBP's
data center told us that POEs had experienced slowdowns associated with
certain US-VISIT data queries.^38 The CBP official told us that since the
computer processing problems were identified and resolved, performance had
greatly improved. We did not verify whether the actions taken fully
resolved these problems.
^36 [56]GAO/AIMD-00-21 .3.1 and [57]GAO-01-1008G .
Others have also reported computer processing problems associated with
US-VISIT. Our review of the report prepared by the contractor hired by DHS
to study wait times at the POE in Nogales-DeConcini, Arizona (discussed
earlier) confirmed that slowdowns had occurred at the facility during two
of the periods covered by its study (June 2005 to August 2005).^39
According to the contractor, these slowdowns resulted in CBP
^37Our review of CBP's information technology "help desk" tickets from
July 2005 through January 2006 suggested that similar types of problems
occurred at other locations where US-VISIT was installed. CBP officers
that operate US-VISIT in the field are instructed to call the CBP help
desk at the Newington Data Center in Virginia if they encounter problems
operating US-VISIT related software or equipment.
^38CBP officials also dealt with sporadic network outages. In one case, on
December 2, 2005, the entire network went down for 3 hours because of an
accident. According to port officials, visitors seeking entry into the
country at the San Ysidro, California, POE were initially asked to wait
until the systems came back up or return at another time. About an hour
after the outage began, CBP officers began to manually process I-94s for
US-VISIT, in accordance with CBP standard operating procedures, but
without the benefit of a biometric verification of their identity under
US-VISIT.
^39Center for Transportation Research, the University of Texas at Austin.
Assessing the Effects of US-VISIT RFID Technology Implementation on
Vehicle and Pedestrian Crossing Times at DeConcini, Nogales, Ariz. Report
No. 2 Pilot Data Collection and Analysis to Baseline Data (Austin, Texas:
November 2005).
officers having to revert to manual I-94 processing without the benefit of
US-VISIT biometric checks. Specifically, in its reports, the contractor
noted that:
"...on the morning of Thursday, June 23, the computer systems used to
perform secondary inspections became very slow, impacting the issuance of
I-94 and enrollment in US-VISIT. The staff had to revert to using the
paper I-94s, which visitors had to fill out by hand..."
"As happened during the [prior] study, the computer systems were
unavailable for a period of time. This occurred on Tuesday from 1:00 to
2:00 p.m. Port officials decided to revert to the manual process because
the network had become very slow and the queue was growing. CBP officers
told ... researchers that it was taking up to twenty minutes to receive
responses to queries...."
In an undated memorandum commenting on the contractor's report, US-VISIT's
Director of Mission Operations expressed concern about the contractor's
discussion of computer "downtime" as a factor impacting US-VISIT
processing times. He stated that these problems can be caused by a variety
of factors, including factors related to I-94 processing and that
capturing biometric information "is only rarely responsible for the
inability to complete the process." Based on our work, it is unclear what
analysis US-VISIT had done to make this determination.
US-VISIT officials told us that various controls are in place to alert
them to problems as they occur, but the lack of awareness about
computer-processing problems raises questions about whether these controls
are working as intended. US-VISIT officials told us that it is their
position that once US-VISIT entry capability equipment was installed and
operating, CBP became responsible for identifying problems and notifying
US-VISIT when US-VISIT-related problems occurred so that US-VISIT can work
with CBP to resolve them. The officials stated that computer problems can
be attributable to other processes and systems not related to US-VISIT
which are not the US-VISIT Program Office's responsibility. In addition,
the Acting Director of US-VISIT noted that there are mechanisms in place
to help CBP and US-VISIT identify problems. For example, US-VISIT
officials told us that US-VISIT and CBP headquarters officials meet
regularly to discuss issues associated with US-VISIT implementation and
CBP maintains a help desk at its Virginia data center to resolve
technology problems raised by CBP field officials. Regarding the latter,
the Acting Director noted that if POE officials do not report problems,
there is nothing CBP and US-VISIT can do to resolve them. During our
review, we noted that CBP officers are required--in training and as part
of standard operating procedures--to report problems with US-VISIT
technology to the CBP help desk. Nevertheless, CBP officials at 9 of the
12 sites we visited where computer processing problems were identified
said they did not always use the help desk to report or resolve computer
problems (and thereby generating a record of the problems). Officials at 5
of the 9 sites told us they temporarily resolved the problem by turning
off and restarting the computers.
Although US-VISIT and CBP have some controls in place to help them
identify and address problems like those discussed above, these controls
may not have been implemented consistently or may not be sufficient to
ensure that US-VISIT operates as intended because officials did not always
alert CBP and US-VISIT program managers to the fact that problems were
occurring that adversely affected operations. It is important that
US-VISIT and CBP managers are alerted to problems as they occur to ensure
continuity of operations consistent with US-VISIT's goal of providing
security to U.S. citizens and travelers. Moreover, in light of the fact
that US-VISIT plans to enhance security through additional technology
investments and that it may be challenging to deploy and operate at
facilities that are already known to be aging and undersized, it is
incumbent upon the US-VISIT program office to play a continuing and
proactive role in the management control structure.
Our internal control standards also call for agencies to establish
performance measures and indicators throughout the organization so that
actual performance can be compared to expected results. The US-VISIT
program office has established and implemented performance measures for
fiscal years 2005 and 2006 that are designed to gauge performance of
various aspects of US-VISIT covering a variety of areas, but these
measures do not gauge the performance of US-VISIT entry capabilities at
land POEs. For example, according to a July 2006 draft report prepared by
the US-VISIT program office, US-VISIT has begun to measure the ratio of
adverse actions (defined as decisions to deny entry into the country) to
total-biometric-watch-list "hits" when visitors are processed at ports of
entry.^40 According to US-VISIT, this measure seeks to help CBP focus its
inspection activities on preventing potential known or suspected criminals
or terrorists from entering the country. US-VISIT reported that it had not
established a baseline or target for this measure in fiscal year 2005.
However, according to US-VISIT, CBP officers at all POEs combined denied
entrance to 30 percent of persons whose biometric information appeared on
a watch list during fiscal year 2005 (about 617 of the 2,059 watch list
"hits"). US-VISIT established a target for this measure during fiscal year
2006 of 33 percent.
^40US-VISIT, Draft Performance Measures Report (Rosslyn, Va.: July 2006).
Another measure is designed to gauge the wait time incurred by a specific
US-VISIT activity at all air, land, and sea POEs, namely the average
response time to deliver results on biometric watch list queries for
finger scans. (This measure does not gauge other US-VISIT related
activities such as scanning the visa or passport, taking and processing a
digital photograph, or printing an I-94.) To ensure that wait times are
not increased substantially due to additional US-VISIT capabilities at
POEs, US-VISIT has established a goal of 10 seconds and reported that,
since October 2004, US-VISIT has been able to maintain, on average, less
than an 8-second response time at POEs at which US-VISIT had been
installed.
These and other existing measures of certain key aspects of program
performance with respect to both security and efficiency can be useful in
analyzing trends and measuring results against planned or expected
results. However, because there are operational and facility differences
among air, sea, and land POEs, it is important to be able to measure and
distinguish differences--one would not expect baseline or target measures
to be the same across these environments. At air and sea ports, visitors
are processed in primary inspection in a controlled environment and CBP
officers are able to prescreen visitors using passenger manifests, which
are transmitted to CBP while passengers are enroute to the POE. By
contrast, at land POEs, visitors arrive on foot or in a vehicle and CBP
officers refer them to secondary inspection for US-VISIT processing
without the benefit of a manifest and based on the information available
to officers at the point of initial contact--a process substantially
different than that used at air and sea ports. The measures used in August
2006 aggregated baselines and targets for all POEs and did not distinguish
among them with regard to air, land, and sea POEs.
Without additional performance measures to more fully gauge operational
impacts of US-VISIT on land POEs, CBP and US-VISIT may not be well
equipped to identify problems, trends, and areas needing improvements now
and as additional US-VISIT entry capabilities, such as 10-finger scans,
are introduced. Consistent with our past work, we believe such measures
could help DHS identify and quantify problems, evaluate alternatives,
allocate resources, track progress, and learn from any mistakes that may
have been made while deploying and operating US-VISIT at land POEs.^41
DHS Cannot Currently Implement a Biometric US-VISIT Exit Capability at Land POEs
and Faces Uncertainties as Testing of an Alternative Exit Strategy Continues
While federal laws require the creation of a US-VISIT exit capability
using biometric verification, the US-VISIT Program Office concluded that
implementing a biometrically-based exit-recording system like that used to
record visitors entering the country would require additional staff and
new infrastructure (such as buildings and roadways) that would be
prohibitively costly, would likely produce major traffic congestion in
exit lanes at the busier land POEs and could have adverse impacts on trade
and commerce. Although current technology does not exist to enable
biometric verification of those leaving the country without major
infrastructural changes, US-VISIT officials believe technological advances
over the next 5- to 10- years will enable them to record who is leaving
the country using biometrics without requiring travelers to stop at a
facility, thereby minimizing the need for major infrastructure changes. In
the interim, US-VISIT is testing an alternative nonbiometric technology
for recording visitors as they exit the country, in which electronic tags
containing a numeric identifier associated with each visitor are embedded
in I-94 forms. US-VISIT's own analysis of this technology and our analysis
and that of others has identified numerous performance and reliability
problems with this solution, including the inability of the nonbiometric
solution to ensure that the person exiting the country is the same who
entered. US-VISIT has taken corrective actions and testing is still
ongoing, but uncertainties remain about how US-VISIT will use technology
in the future to meet biometric exit requirements. These uncertainties
reflect the fact that DHS has not met a June 2005 statutory requirement to
submit a report to the Congress that describes (1) the status of biometric
exit data systems already in use at POEs and (2) the manner in which
US-VISIT is to meet the goal of a comprehensive screening system, with
both entry and exit biometric capability.
^41GAO, Executive Guide: Measuring Performance and Demonstrating Results
of Information Technology Investments, AIMD-98-89 (Washington, D.C.: March
1998).
Various Factors Have Prevented US-VISIT from Implementing a Biometric Exit
Capability
Federal laws require the creation of a US-VISIT exit capability using
biometric verification methods to ensure that the identity of visitors
leaving the country can be matched biometrically against their entry
records.^42 However, according to officials at the US-VISIT program office
and CBP and US-VISIT program documentation, there are interrelated
logistical, technological, and infrastructure constraints that have
precluded DHS from achieving this mandate, and there are cost factors
related to the feasibility of implementation of such a solution. The major
constraint to performing biometric verification upon exit at this time, in
the US-VISIT Program Office's view, is that the only proven technology
available would necessitate mirroring the processes currently in use for
US-VISIT at entry. A mirror-image system for exit would, like entry,
require CBP officers at land POEs to examine the travel documents of those
leaving the country, take fingerprints, compare visitors' facial features
to photographs, and, if questions about identity arise, direct the
departing visitor to secondary inspection for additional questioning.
These steps would be carried out for exiting pedestrians as well as for
persons exiting in vehicles. The US-VISIT Program Office concluded in an
internal January 2005 report assessing alternatives to biometric exit that
the mirror-imaging solution was "an infeasible alternative for numerous
reasons, including but not limited to, the additional staffing demands,
new infrastructure requirements, and potential trade and commerce
impacts."^43
US-VISIT officials told us that they anticipated that a biometric exit
process mirroring that used for entry could result in delays at land POEs
with heavy daily volumes of visitors. And they stated that in order to
implement a mirror-image biometric exit capability, additional lanes for
exiting vehicles and additional inspection booths and staff would be
needed, though they have not determined precisely how many. According to
these officials, it is unclear how new traffic lanes and new facilities
could be built at land POEs where space constraints already exist, such as
those in congested urban areas. (For example, San Ysidro, California,
currently has 24 entry lanes, each with its own staffed booth and 6
unstaffed exit lanes. Thus, if full biometric exit capability were
implemented using a mirror image approach, San Ysidro's current capacity
of 6 exit lanes would have to be expanded to 24 exit lanes.) As shown in
figure 6, based on observations during our site visit to the San Ysidro
POE, the facility is surrounded by dense urban infrastructure, leaving
little, if any, room to expand in place. Some of the 24 entry lanes for
vehicle traffic heading northwards from Mexico into the United States
appear in the bottom left portion of the photograph, where vehicles are
shown waiting to approach primary inspection at the facility; the six exit
lanes (traffic towards Mexico), which do not have fixed inspection
facilities, are at the upper left.
^42Intelligence Reform and Terrorism Prevention Act of 2004, S 7208, 8
U.S.C. S 1365b. See also USA PATRIOT Act, Pub. L. No. 107-56, S 414(b)(1),
115 Stat. 272, 353 (2001); 8 U.S.C. S 1365a(b)(2)-(4).
^43US-VISIT, Increment 2C Operational Alternatives Assessment--FINAL
(Rosslyn, Va.: Jan. 31, 2005).
Figure 6: Aerial View of San Ysidro, California, POE
Other POE facilities are similarly space-constrained. At the POEs at
Nogales-DeConcini, Arizona, for example, we observed that the facility is
bordered by railroad tracks, a parking lot, and industrial or commercial
buildings. In addition, CBP has identified space constraints at some rural
POEs. For example, the Thousand Islands Bridge POE at Alexandria Bay, New
York, is situated in what POE officials described as a "geological bowl,"
with tall rock outcroppings potentially hindering the ability to expand
facilities at the current location. Officials told us that in order to
accommodate existing and anticipated traffic volume upon entry, they are
in the early stages of planning to build an entirely new POE on a hill
about a half-mile south of the present facility. CBP officials at the
Blaine-Peace Arch POE in Washington state said that CBP also is
considering whether to relocate and expand the POE facility, within the
next 5-to-10 years, to better handle existing and projected traffic
volume. According to the US-VISIT program officials, none of the plans for
any expanded, renovated, or relocated POE include a mirror-image addition
of exit lanes or facilities comparable to those existing for entry.
In 2003, the US-VISIT Program Office estimated that it would cost
approximately $3 billion to implement US-VISIT entry and exit capability
at land POEs where US-VISIT was likely to be installed and that such an
effort would have a major impact on facility infrastructure at land POEs.
We did not assess the reliability of the 2003 estimate. The cost estimate
did not separately break out costs for entry and exit construction, but
did factor in the cost for building additional exit vehicle lanes and
booths as well as buildings and other infrastructure that would be
required to accommodate a mirror imaging at exit of the capabilities
required for entry processing. US-VISIT program officials told us that
they provided this estimate to congressional staff during a briefing, but
that the reaction to this projected cost was negative and that they
therefore did not move ahead with this option. No subsequent cost estimate
updates have been prepared, and DHS's annual budget requests have not
included funds to build the infrastructure that would be associated with
the required facilities.
US-VISIT officials stated that they believe that technological advances
over the next 5-to-10 years will make it possible to utilize alternative
technologies that provide biometric verification of persons exiting the
country without major changes to facility infrastructure and without
requiring those exiting to stop and/or exit their vehicles, thereby
precluding traffic backup, congestion, and resulting delays. US-VISIT's
report assessing biometric alternatives noted that although limitations in
technology currently preclude the use of biometric identification because
visitors would have to be stopped, the use of the as-yet undeveloped
biometric verification technology supports the long-term vision of the
US-VISIT program.^44 However, no such technology or device currently
exists that would not have a major impact on facilities. The prospects for
its development, manufacture, deployment and reliable utilization are
currently uncertain or unknown, although a prototype device that would
permit a fingerprint to be read remotely without requiring the visitor to
come to a full stop is under development.
^44US-VISIT, Increment 2C Operational Alternatives Assessment--FINAL
(Rosslyn, Va: Jan. 31, 2005).
While logistical, technical, and cost constraints may prevent
implementation of a biometrically based exit technology for US-VISIT at
this time, it is important to note that there currently is not a
legislatively mandated date for implementation of such a solution. The
Intelligence Reform and Terrorism Prevention Act of 2004 requires US-VISIT
to collect biometric-exit-data from all individuals who are required to
provide biometric entry data.^45 The act did not set a deadline, however,
for requiring collection of biometric exit data from all individuals who
are required to provide biometric entry data. Although US-VISIT had set a
December 2007 deadline for implementing exit capability at the 50 busiest
land POEs, US-VISIT has since determined that implementing exit capability
by this date is no longer feasible, and a new date for doing so has not
been set.
The US-VISIT Program Office Is Testing Nonbiometric Technology to Record
Travelers' Departure
Because there is at present no biometric technology that can be used to
verify a traveler's exit from the country at land POEs without also making
major and costly changes to POE infrastructure and facilities, the
US-VISIT Program Office sought an alternative means of recording a
visitor's exit from the country, using nonbiometric technology, that could
be tested at land POEs. US-VISIT determined that the chosen nonbiometric
technology would have to meet certain criteria. According to the US-VISIT
Program Office, the technology would have to: (1) permit recording of an
exiting visitor in order that stopping or slowing down would not be
required and privacy issues were addressed; (2) result in no increase in
wait times for visitors; (3) create no degradation in the level of service
at exit lanes; (4) create no significant degradation in traffic patterns
(that is, no additional traffic congestion); (5) be convenient to the
visitor, and (6) be commercially available. None of these criteria
directly addressed or reflected the legislative mandate to deploy a system
to record entry and exit by foreign travelers using biometric identifiers
in order to ensure that persons leaving the country were those who had
entered. Rather, the criteria focused on choosing a technology that would
not require a major investment in facilities, would protect privacy, and
would not generate large traffic backups that would inconvenience or delay
both travelers and commercial carriers.
^458 U.S.C. S 1365b(d).
^47US-VISIT evaluated 12 different exit-recording technologies against the
six criteria listed above, including some that incorporated biometric
features--scanning the retina or iris, and a facial recognition system.
Because the biometric solutions considered would have required an exiting
visitor to slow down, stop, or possibly enter a POE facility, they were
rejected. Other alternatives, such as the use of a global positioning
system, were rejected because they transmit signals that could facilitate
surveillance of individuals, raising concerns about privacy.
Among the technologies considered for testing by the US-VISIT Program
Office, the only one that met all the US-VISIT evaluation criteria was
passive, automated, radio frequency identification (RFID).^47 This
technology, according to US-VISIT, "best satisfied all the assessment
criteria." RFID is an automated data-capture technology that can be used
to electronically store information contained on a very small tag that can
be embedded in a document (or some other physical item). This information
can then be identified, and recorded as having been identified, by RFID
readers that are connected to computer databases.
For purposes of US-VISIT's testing of the nonbiometric technology, the
RFID tag is embedded in a modified I-94 arrival/departure form, called an
I-94A. Each RFID tag has only a single number stored in it; privacy is
protected because no information is stored on these tags other than a
unique ID number that is linked to the visitor's biographic information.
To facilitate the transmission of the number from the RFID tag, a new DHS
system of records--the Automated Identification Management System (AIDMS)
^48--was created to link the unique RFID tag ID number to existing
information stored in the Treasury Enforcement Communications System
(TECS) database, which is used by CBP to verify travel information and
update traveler data.^49 According to US-VISIT, limiting the data on the
tag to a single number helps preserve the privacy of travelers;
acquisition of the number would provide no meaningful information to
non-authorized persons, since they would then have to access TECS to link
the number to biographic data. However, access to computers and their
databases at land POEs is restricted to authorized personnel and involves
additional protections such as passwords as well as entrance into
physically restricted areas inside POE buildings. (A more detailed
discussion of RFID technology and privacy issues is contained in appendix
VI.)
^48AIDMS is a system separate from TECS, IDENT and other databases used in
the US-VISIT process.
^49The Treasury Enforcement Communications System (TECS) is a system that
maintains lookout (i.e., watch list) data, interfaces with other agencies'
databases, and is currently used by inspectors at ports of entry to verify
traveler information and update traveler data. Although still labeled as a
Treasury system, TECS has been transferred to CBP.
The RFID technology used in this way is considered passive because the tag
cannot initiate communications. Rather, the tag responds to radio
frequency emissions from an RFID reader--an electronic device that can be
installed on a pole, or on a steel gantry of the kind that holds highway
signs over the entire width of a roadway (see figure 11)--and transmits
the numeric information stored on the tag back to the reader, from up to
30 feet away, according to the US-VISIT Program Office. Figure 7a shows
RFID readers mounted on a metal gantry at the Thousand Islands Bridge land
POE, Alexandria Bay, New York. The readers are attached to metal
extensions that project out from the right side of the gantry, to record
an I-94A embedded with tags that are inside the vehicles that pass
underneath. RFID readers can also be installed in portals or on poles at
pedestrian traffic areas to read the I-94A embedded with tags of persons
leaving the country on foot. Figure 7b shows RFID readers in portals
positioned on either side of pedestrian exit doors at the Blaine-Peace
Arch POE in Washington State.
Figure 7a: Metal Gantry with RFID Readers and Antennas at the Thousand
Islands Bridge POE, Alexandria Bay, New York
Figure 7b: RFID Portals Positioned Next to Exit Doors at the Blaine-Peace
Arch POE in Washington State
Initial Results of Testing Using RFID Technology Indicate Problems Meeting a Key
Program Goal--Verifying the Identity of Persons Leaving the Country
In December 2004 and January 2005, a team of US-VISIT contractors
conducted the first part of a feasibility study to test passive RFID
equipment in a simulated environment-at a mock POE in Virginia. At this
site, different types of vehicles- including cars, buses, and trucks--were
run at different speeds to test RFID read rates. Pedestrians carrying
documents with RFID tags embedded or attached were not tested. The
feasibility study raised numerous issues about the reliability and
performance of the RFID technology. For example, RFID readers held on a
gantry over a roadway had difficulty detecting RFID-detectable tags that
were inside vehicles with metallic tinted windows (whether the windows
were open or closed). The read rate was improved from about 56 percent to
about 70 percent if the readers were moved to both sides of the road,
rather than overhead, and if the occupants held their documents with the
RFID-detectable tags up to the vehicle's side windows. The study concluded
that the physical actions of the visitor had to be taken into account when
obtaining a read of the I-94A and made specific recommendations to improve
read rates, such as suggesting that vehicle occupants hold the I-94A up to
a side window and keep multiple forms apart.
After the feasibility study, US-VISIT proceeded, as planned, with phase 1
of proof-of-concept testing for RFID at five land POEs at the northern and
southern borders to determine what corrective actions, if any, should be
taken to improve RFID read rates for exiting vehicles and pedestrians.
This effort comprised testing for both exit and for re-entry by persons
who have been issued a tag-embedded I-94A that is valid for multiple
entries over several months. ^50 The RFID performance tests were conducted
for one-week periods at land POEs, as follows:^51 vehicular traffic was
tested at Nogales-Mariposa and Nogales-DeConcini POEs in Nogales, Arizona;
the Blaine-Pacific Highway and Blaine-Peace Arch POEs in Blaine,
Washington; and Thousand Islands Bridge POE in Alexandria Bay, New York;
pedestrian traffic was tested at the Nogales-Mariposa and
Nogales-DeConcini POEs.
For these exit tests, the US-VISIT Program Office developed critical
success factor target read rates to compare them to the actual read rates
obtained during the test for both pedestrians carrying an I-94A with
RFID-detectable tags and for travelers in vehicles who also had an
RFID-detectable I-94A with them inside the vehicles. The target exit read
rates ranged from an expected success rate of 70 percent to 95 percent,
based on anticipated performance under different conditions, partly as
demonstrated in the earlier feasibility study, on business requirements,
and on a concept of operation plan prepared for Increment 2C.^52
50According to the US-VISIT Program Office, approximately $104 million was
budgeted in fiscal years 2004 and 2005 to conduct proof-of-concept testing
of RFID for exit and re-entry. No separate break-out of testing
expenditures related to exit alone was available.
^51Site selection factors included potential physical constraints, such as
protected historic structures that could hamper installation of gantries,
potential environmental impact, daily traffic and I-94 processing volume,
speed limits, and weather conditions.
^52A concept of operations defines how day-to-day operations are (or will
be) carried out to meet mission needs. The concept of operations includes
high-level descriptions of information systems, their interrelationships,
and information flows. It also describes the operations that must be
performed, who must perform them, and where and how the operations will be
carried out.
In a January 2006 assessment^53 of the test results, the US-VISIT Program
Office reported that the exit read rates that occurred during the test
generally fell short of the expected target rates for both pedestrians and
for travelers in vehicles. For example, according to US-VISIT, at the
Blaine-Pacific Highway test site, of 166 vehicles tested, RFID readers
correctly identified 14 percent; the target read rate was 70 percent.^54
Another problem that arose was that of cross-reads, in which multiple RFID
readers installed on gantries or poles picked up information from the same
visitor, regardless of whether the individual was entering or exiting in a
vehicle or on foot. Thus, cross-reads resulted in inaccurate
record-keeping. According to a January 2006 US-VISIT corrective-action
report, signal-filtering equipment is to be installed to correct the
problem and additional testing is to be conducted to confirm and
understand the extent of the problem. The report also noted that remedying
cross-reads would require changes to equipment and infrastructure on a
case-by-case basis at each land POE, because each has a different physical
configuration of buildings, roadways, roofs, gantries, poles, and other
surfaces against which the signals can bounce and cause cross-reads. Each
would therefore require a different physical solution to avoid the signal
interference that triggers cross-reads. Although cost estimates or time
lines have not been developed for such alterations to facilities and
equipment, it is possible that having to alter the physical configuration
at each land POE in some regard and then test each separately to ensure
that cross-reads had been eliminated would be both time consuming and
potentially costly, in terms of changes to infrastructure and equipment.
We observed potential problems with the RFID exit system relating to
facilities and infrastructure at some of the POEs we visited. At the
Nogales-Mariposa POE, in Nogales, Arizona, for example, we observed that
RFID portals for pedestrians had been placed on the right side of the CBP
POE building, on a rocky, sloping hillside, and that there was no signage
directing pedestrians to walk between them, nor was a walkway installed,
as shown in figure 8a. Although travelers were expected to walk between
the portals, this configuration enabled pedestrians to avoid the portals
altogether--to walk around them or cross the road to avoid them, as shown
in figure 8b.
^53US-VISIT Program Office, Increment 2C Proof of Concept--Phase 1
Performance Evaluation Report, Post Implementation (Rosslyn, VA: Jan. 20,
2006).
^54A US-VISIT program official explained that for vehicles exiting during
RFID testing, one could "reasonably expect" a read rate of 70 percent
because vehicles are not required to stop upon exit. The official also
cited vehicle speed, safety, and awareness (of optimal I-94A positioning;
for example, holding the I-94A up to the window of the vehicle) as factors
that affected RFID read rates.
Figure 8a: RFID Installation at the Nogales-Mariposa POE in Arizona,
Facing Toward Mexico
Figure 8b. Two Pedestrians Exiting the Country at the Nogales-Mariposa
POE, Arizona, Walking Toward Mexico
According to the US-VISIT corrective actions report, 15 percent of exiting
pedestrian (including those participating in the test and those who did
not) used the pathway between the two portals at the Nogales facility
during a September 2005 observation period.^55 In this same report,
US-VISIT acknowledged that there was no defined pathway or infrastructure
for pedestrian exit at Nogales-Mariposa, Arizona, and that only one of the
three pedestrian paths were covered by the portals that had been placed
there. US-VISIT reported that while the placement of the portal readers
will not be changed, it is taking steps to improve the likelihood of
detection with additional antennae, readers, and signage. However, there
are no plans at present to modify the existing POE infrastructure on the
west side of the building where the portals were installed, such as by
installing a paved walkway or by constructing fencing to divert those
exiting to go through the readers in order to increase the chances that
exiting pedestrians are detected. In commenting on this report, DHS stated
that it had constructed a new primary pedestrian exit walkway parallel to
the existing pedestrian entry and had installed signage, sidewalks, and a
new secure gate. However, according to a CBP official at the
Nogales-Mariposa POE, the newly constructed pedestrian exit walkway is on
the other (east) side of the building from the pathway where the portal
readers were placed and tested.
^55US-VISIT, Final Increment 2C Phase 1 Proof of Concept Corrective
Actions (Rosslyn, Va: January 2006).
During the period that US-VISIT carried out RFID exit tests at land POEs,
US-VISIT also tested read rates for RFID-detectable documents carried by
pedestrians or persons in vehicles who had been issued an I-94A during a
prior visit to the United States, had subsequently left the country, and
were intending to re-enter.^56 (I-94s can be issued that are valid for up
to 6 months for multiple re-entries into the country.) US-VISIT performed
the re-entry test for documents held by persons in vehicles at the
Mariposa and DeConcini POEs in Nogales, Arizona; the Blaine-Pacific
Highway and Blaine-Peace Arch, POEs in Washington state; and Thousand
Islands Bridge POE at Alexandria Bay, New York. For pedestrians, the
re-entry test was performed at the Mariposa and DeConcini POEs in Nogales,
Arizona (see tables 6a and 6b, appendix VII). US-VISIT set higher expected
target read rates for the re-entry test than for exit because all persons
and vehicles entering or re-entering the country must stop for questioning
by CBP officers and must take travel documents out of their pockets or
from inside a vehicle, and show them to the officer, enhancing the
likelihood that RFID-detectable documents would be detected. As expected
by US-VISIT, read rates for the re-entry test for vehicles were generally
higher than for exit, although the results did not meet the critical
success factors initially projected by US-VISIT. Appendix VII discusses
the results of RFID performance for exit and re-entry in greater detail.
Beyond RFID operations issues that affect facilities, our work and that of
the DHS Privacy Office have identified other performance and reliability
problems related to passive RFID. In June 2005, we testified before the
Subcommittee on Economic Security, Infrastructure Protection, and
Cybersecurity of the House Committee on Homeland Security on similar
reliability problems with RFID.^57 We noted, for example, that when an
object close to the reader or tag interferes with the radio waves,
read-rate accuracy decreases, and that environmental conditions, such as
temperature and humidity, can make tags unreadable. We further noted that
tags read at high speeds have a significant decrease in read rates.
^56Although all the tests were carried out at five land POEs, the number
of POEs tested at which pedestrians exit and enter, and vehicles exit and
entry differed, due to varying test conditions, according to the US-VISIT
Program Office.
According to US-VISIT officials, phase 2 of the RFID proof-of-concept
testing, which is to expand the capabilities identified at the five phase
1 locations will, among other things, link visitor data to vehicle exit
data (or re-entry, if the visitor already has an RFID- embedded I-94
form), address deficiencies noted in phase 1, and further evaluate RFID
performance. At the time of our review, many uncertainties about the
future of a US-VISIT exit capability remained because US-VISIT had not
developed a plan to show when phase 2 of proof-of-concept testing of RFID
would conclude, when an evaluation of the technology would be completed,
and how US-VISIT would define success.
However, even if RFID deficiencies were to be fully addressed and
deadlines set, questions remain about DHS's intentions going forward. For
example, the RFID solution does not meet the congressional requirement for
a biometric exit capability because the technology that has been tested
cannot meet a key goal of US-VISIT--ensuring that visitors who enter the
country are the same ones who leave. By design, an RFID tag embedded in an
I-94 arrival/departure form cannot provide the biometric identity-matching
capability that is envisioned as part of a comprehensive entry/exit border
security system using biometric identifiers for tracking overstays and
others entering, exiting, and re-entering the country. Specifically, the
RFID tag in the I-94 form cannot be physically tied to an individual. This
situation means that while a document may be detected as leaving the
country, the person to whom it was issued at time of entry may be
somewhere else.
DHS was to have reported to Congress by June 2005 on how the agency
intended to fully implement a biometric entry/exit program. As of October
2006, this plan was still under review in the Office of the Secretary,
according to US-VISIT officials. According to statute, this plan is to
include, among other things, a description of the manner in which the
US-VISIT program meets the goals of a comprehensive entry and exit
screening system--including both biometric entry and exit--and fulfills
statutory obligations imposed on the program by several laws enacted
between 1996 and 2002.^58 Until such a plan is finalized and issued, DHS
is not able to articulate how entry/exit concepts will fit
together--including any interim nonbiometric solutions--and neither DHS
nor Congress is positioned to prioritize and allocate resources for a
US-VISIT exit capability or plan for the program's future.
^57GAO, Information Security: Key Considerations Related to Federal
Implementation of Radio Frequency Identification Technology,
[58]GAO-05-849T (Washington, D.C.: June 22, 2005).
In commenting on this report, DHS acknowledged that the interim
non-biometric exit technology using RFID tags embedded in the I-94 does
not meet the statutory requirement for a biometric exit capability. DHS
stated that it used the non-biometric technology because industry was not
to the point of developing a device that could satisfy US-VISIT
requirements, such as not impacting traffic flows or not having safety
impacts. DHS said that US-VISIT officials would perform subsequent
research and industry outreach activities in an attempt to satisfy
statutory requirements for a biometric exit capability.
DHS Has Not Articulated How US-VISIT Strategically Fits with Other Land-Border
Security Initiatives
In recent years, DHS has planned or implemented a number of initiatives
aimed at securing the nation's borders. However, DHS has not defined a
strategic context that shows how US-VISIT fits with other land border
initiatives. As we reported in September 2003, agency programs need to
properly fit within a common strategic context governing key aspects of
program operations--e.g., what functions are to be performed by whom; when
and where they are to be performed; what information is to be used to
perform them; what rules and standards will govern the application of
technology to support them; and what facility or infrastructure changes
will be needed to ensure that they operate in harmony and as intended.^59
Without a clear strategic context for US-VISIT, the risk is increased that
the program will not operate with related programs and thus not
cost-effectively meet mission needs.
In our September 2003 report, we stated that DHS had not defined key
aspects of the larger homeland security environment in which US-VISIT
would need to operate. For example, certain policy and standards decisions
had not been made, such as whether official travel documents would be
required for all persons who enter and exit the country, including U.S.
and Canadian citizens, and how many fingerprints would be
collected--factors that could potentially increase inspection times and
ultimately increase traveler wait times at some of the higher volume land
POE facilities. To minimize the impact of these changes, we recommended
that DHS clarify the context in which US-VISIT is to operate. Three years
later, defining this strategic context remains a work in progress. Thus,
the program's relationships and dependencies with other closely allied
initiatives and programs are still unclear.
^588 U.S.C. S1365b(c)(2)(E).
^59GAO, Homeland Security: Risks Facing Key Border and Transportation
Security Program Need to Be Addressed, [59]GAO-03-1083 (Washington, D.C.:
Sept. 19, 2006).
According to the US-VISIT Chief Strategist, the Program Office drafted in
March 2005 a strategic plan that showed how US-VISIT would be
strategically aligned with DHS's organizational mission and also defined
an overall vision for immigration and border management.^60 According to
this official, the draft plan provided for an immigration and border
management enterprise that unified multiple internal departmental and
other external stakeholders with common objectives, strategies, processes,
and infrastructures. As of October 2006, we were told that DHS had not
approved this strategic plan. This draft plan was not available to us, and
it is unclear how it would provide an overarching vision and road map of
how all these component elements can at this time be addressed given that
critical elements of other emerging border security initiatives have yet
to be finalized. For example, under the Intelligence Reform and Terrorism
Prevention Act of 2004, DHS and State are to develop and implement a plan,
no later than June 2009, which requires U.S. citizens and foreign
nationals of Canada, Bermuda, and Mexico to present a passport or other
document or combination of documents deemed sufficient to show identity
and citizenship to enter the United States (this is currently not a
requirement for these individuals entering the United States via land POEs
from within the western hemisphere). This effort, known as the Western
Hemisphere Travel Initiative (WHTI), was first announced in 2005, and some
members of Congress and others have raised questions about agencies'
progress carrying out WHTI. In May 2006, we issued a report that provided
our observations on efforts to implement WHTI along the U.S. border with
Canada.^61 We stated that DHS and State had taken some steps to carry out
the Travel Initiative, but they had a long way to go to implement their
proposed plans, and time was slipping by. Among other things, we found
that:
^60In commenting on this report, DHS stated that this plan includes
US-VISIT's draft response to the legislative requirement that DHS produce
a report to the Congress by June 2005 that describes a comprehensive
US-VISIT entry/exit screening system, as discussed earlier in this report.
o key decisions had yet to be made about what documents other than
a passport would be acceptable when U.S. citizens and citizens of
Canada enter or return to the United States--a decision critical
to making decisions about how DHS is to inspect individuals
entering the country, including what common facilities or
infrastructure might be needed to perform these inspections at
land POEs;
o a DHS and Department of State proposal to develop an alternative
form of passport, called a PASS card, would rely on RFID
technology to help DHS process U.S. citizens re-entering the
country, but DHS had not made decisions involving a broad set of
considerations that include (1) utilizing security features to
protect personal information, (2) ensuring that proper equipment
and facilities are in place to facilitate crossings at land
borders, and (3) enhancing compatibility with other border
crossing technology already in use.
As of September 2006, DHS had still not finalized plans for changing the
inspection process and using technology to process U.S. citizens and
foreign nationals of Canada, Bermuda, and Mexico reentering or entering
the country at land POEs. In the absence of decisions about the strategic
direction of both programs, it is still unclear (1) how the technology
used to facilitate border crossings under the Travel Initiative will be
integrated with US-VISIT technology, if at all, and (2) how land POE
facilities would have to be modified to accommodate both programs to
ensure efficient inspections that do not seriously affect wait times. This
raises the possibility that CBP would be faced with managing differing
technology platforms and border inspection processes at high-volume land
POEs facilities that, according to DHS, already face space constraints and
congestion.
Similarly, it is not clear how US-VISIT is to operate in relation to
another emerging border security effort, the Secure Border Initiative
(SBI)--a new comprehensive DHS initiative, announced last year, to secure
the country's borders and reduce illegal migration. According to DHS, as
of June 2006, SBI is to focus broadly on two major themes:
^61GAO, Observations on Efforts to Implement the Western Hemisphere Travel
Initiative on the U.S. Canadian Border, [60]GAO-06-741R (Washington, D.C.:
May 25, 2006).
o border control--gaining full control of the borders to prevent
illegal immigration, as well as security breaches, and
o interior enforcement--disrupting and dismantling cross border
crime into the interior of the United States while locating and
removing aliens who are present in the United States in violation
of law.
Under SBI and its CBP component, called SBInet, DHS plans to use a systems
approach to integrate personnel, infrastructures, technologies, and rapid
response capability into a comprehensive border protection system. DHS
reports that, among other things, SBInet is to encompass both the northern
and southern land borders, including the Great Lakes, under a unified
border control strategy whereby CBP is to focus on the interdiction of
cross-border violations between the ports and at the official land POEs
and funnel traffic to the land POEs.
DHS has recently awarded a contract to help DHS design, build, and execute
SBInet. Although DHS has published some information on various aspects of
SBI and SBInet, it remains unclear how SBInet will be linked, if at all,
to US-VISIT so that the two systems can share technology, infrastructure,
and data across programs. For example, from a border control perspective,
questions arise on whether CBP needs additional resources, facilities or
facility modifications, and procedural changes at land POEs if all those
who attempt to enter the country on the northern and southern border are
successfully funneled to land POEs.
Also, given the absence of a comprehensive entry and exit system,
questions remain about what meaningful data US-VISIT may be able to
provide other DHS components, such as Immigration and Customs Enforcement
(ICE), to ensure that DHS can, from an interior enforcement perspective,
identify and remove foreign nationals covered by US-VISIT who may have
overstayed their visas. In a May 2004 report, we stated that although no
firm estimates were available, the extent of overstaying is
significant.^62 We stated that most long-term overstays appeared to be
motivated by economic opportunities, but a few had been identified as
terrorists or involved in terrorist-related activities. Notably, some of
the September 11 hijackers had overstayed their visas. We further reported
that US-VISIT held promise for identifying and tracking overstays as long
as it could overcome weaknesses matching visitors' entry and exit.
^62GAO, [61]Overstay Tracking: A Key Component of Homeland Security and a
Layered Defense , [62]GAO-04-82 (Washington, D.C.: May 2004).
Conclusions
Developing and deploying complex technology that records the entry and
exit of millions of visitors to the United States, verifies their
identities to mitigate the likelihood that terrorists or criminals can
enter or exit at will, and tracks persons who remain in the country longer
than authorized is a worthy goal in our nation's effort to enhance border
security in a post-9/11 era. But doing so also poses significant
challenges; foremost among them is striking a reasonable balance between
US-VISIT's goals of providing security to U.S. citizens and visitors while
facilitating legitimate trade and travel. DHS has made considerable
progress making the entry portion of the US-VISIT program at land ports of
entry (POEs) operational, and border officials have clearly expressed the
benefits that US-VISIT technology and biometric identification tools have
afforded them. Nevertheless, US-VISIT is one in a series of ambitious
border security initiatives that could take a toll on the current
facilities and infrastructure in place to support the activities at land
POEs, which already process a large majority (more than 75 percent) of all
visitors entering the United States via legal checkpoints. Many land POEs
operate out of small, aging structures that are constrained by space and
that were constructed before technology and associated equipment played a
prominent role in processing activities.
Our current and past work has raised questions on whether DHS has
adequately assessed how US-VISIT has affected operations at land POEs,
given current constraints at facilities that routinely experience high
traffic volumes and which encounter occasional computer-processing
problems. As additional US-VISIT capabilities--such as 10-fingerprint
scanning--are installed at land POEs and as other border security
initiatives unfold, including the Western Hemisphere Travel Initiative, it
is particularly important that DHS be able to anticipate potential
problems and develop solutions to minimize any operational and logistical
impacts on aging and already overcrowded land POE facilities. Our earlier
recommendation on this issue suggested that DHS needed to expand upon
prior efforts to assess the impact of US-VISIT on busy land POEs in order
to obtain a fuller understanding of the system's impact on these
facilities from an operational and human capital perspective. We believe
this remains an important step to take because it would help DHS establish
a baseline or foundation from which to anticipate potential problems while
providing a framework for developing strategies and action plans to
overcome them. Although US-VISIT has said it would conduct operational
assessments at POEs as new projects came online, the assessment
methodology US-VISIT has used in the past--which focused on measuring
changes in I-94 processing times--raised questions about how the agency
will perform future assessments.
In addition, because US-VISIT will likely continue to have an impact on
land POE facilities as it evolves, it is important for US-VISIT and CBP
officials to have sufficient management controls for identifying and
reporting potential computer and other operational problems as they
arise--problems that could affect the ability of US-VIST entry capability
to operate as intended. If additional delays in processing visitors were
to occur, the ability of POE facilities to handle additional vehicular and
pedestrian traffic could be further strained, and incidents requiring
officials to turn visitors away temporarily may increase. Likewise, if
disruptions to US-VISIT computer operations are not consistently and
promptly reported and resolved and if communication between CBP and
US-VISIT officials about computer-related problems and other operational
challenges is not effective, then it is possible that a critical US-VISIT
function--notably, the ability to use biometric information to confirm
visitors' identities through various databases--could be disrupted, as has
occurred in the past. The need to avoid disruptions to biometric
verification is important given that one of the primary goals of US-VISIT
is to enhance the security of U.S. citizens and visitors, and in light of
the substantial investment DHS has made in US-VISIT technology and
equipment.
US-VISIT has taken appropriate steps to develop performance measures that
focus on various aspects of US-VISIT performance across air, land, and sea
POEs. However, these measures do not go far enough to assess the affect of
US-VISIT on POE operations, particularly land POEs, which are
operationally distinctive from air and sea POEs where US-VISIT entry has
also been installed. Such measures are needed to ensure that officials can
identify and address problems at land-based facilities where improvements
may be needed.
With respect to DHS's effort to create an exit verification capability,
developing and deploying this capability for US-VISIT at land POEs has
posed a set of challenges that are distinct from those associated with
entry. US-VISIT has not determined whether it can achieve, in a realistic
time frame, or at an acceptable cost, the legislatively mandated
capability to record the exit of travelers at land POEs using biometric
technology. Apart from acquiring new facilities and infrastructure at an
estimated cost of billions of dollars, US-VISIT officials have
acknowledged that no technology now exists to reliably record travelers'
exit from the country, and to ensure that the person leaving the country
is the same person who entered, without requiring them to stop upon
exit--potentially imposing a substantial burden on travelers and commerce.
US-VISIT officials stated that they believe a biometrically based solution
that does not require those exiting the country to stop for processing,
that minimizes the need for major facility changes, and that can used to
definitively match a visitor's entry and exit will be available in 5 to 10
years. In the interim, it remains unclear how officials plan to
proceed--whether a nonbiometric alternative now being tested can provide
an acceptable interim solution or whether the government ought to wait for
a viable biometric solution to become available. According to statute, DHS
was required to report more than a year ago on its plans for developing a
comprehensive biometric entry and exit system, but DHS has yet to finalize
this road map for Congress. Reporting might provide better assurance that
US-VISIT can balance its goals of providing security, serving the
immigration system, facilitating trade and travel, and protecting privacy
at land POEs. This plan would also give DHS the opportunity to discuss the
costs, benefits, barriers, and opportunities associated with various
strategies for deploying biometric and nonbiometric exit capabilities and
keep Congress informed of its progress overall. Until DHS finalizes such a
plan, neither Congress nor DHS are likely to have sufficient information
as a basis for decisions about various factors relevant to the success of
US-VISIT, ranging from funding needed for any land POE facility
modifications in support of the installation of exit technology to the
trade-offs associated with ensuring traveler convenience while providing
verification of travelers' departure consistent with US-VISIT's national
security and law enforcement goals.
Finally, DHS has not articulated how US-VISIT fits strategically and
operationally with other land-border security initiatives, such as the
Western Hemisphere Travel Initiative and Secure Border Initiative. Without
knowing how US-VISIT is to be integrated within the larger strategic
context governing DHS operations, DHS faces substantial risk that US-VISIT
will not align or operate with other initiatives at land POEs and thus not
cost-effectively meet mission needs. Knowing how US-VISIT is to work in
harmony with these initiatives could help Congress, DHS, and others better
understand what resources, tools, and investments in land POE facilities
and infrastructure are needed to ensure their success, while providing
critical information to help make decisions about other DHS missions. This
could include, for example, information on what funds and staffing
resources ICE would need to enforce immigration laws if US-VISIT were able
to provide reliable and timely information on potentially millions of
persons who have overstayed the terms of their visas, some of whom may
pose a threat to the nation's security.
Recommendations for Executive Action
To help DHS achieve benefits commensurate with its investment in US-VISIT
at land POEs and security goals and objectives, we are recommending that
the Secretary of Homeland Security direct the US-VISIT Program Director,
in collaboration with the Commissioner of CBP, to take the following two
actions:
o improve existing management controls for identifying and
reporting computer processing and other operational problems as
they arise at land POEs and ensure that these controls are
consistently administered; and
o develop performance measures for assessing the impact of
US-VISIT operations specifically at land POEs.
We also recommend that as DHS finalizes the statutorily mandated report
describing a comprehensive biometric entry and exit system for US-VISIT,
the Secretary of Homeland Security take steps to ensure that the report
include, among other things,
o information on the costs, benefits, and feasibility of deploying
biometric and nonbiometric exit capabilities at land POEs;
o a discussion of how DHS intends to move from a nonbiometric exit
capability, such as the technology currently being tested, to a
reliable biometric exit capability that meets statutory
requirements; and
o a description of how DHS expects to align emerging land border
security initiatives with US-VISIT and what facility or facility
modifications would be needed at land POEs to ensure that
technology and processes work in harmony.
Agency Comments and Our Evaluation
We requested comments on a draft of this report from the Secretary of
Homeland Security. In an October 31, 2006, letter, DHS provided written
comments, which are summarized below and included in their entirety in
appendix VIII.
DHS generally agreed with our recommendations and stated that it needed to
improve existing management controls associated with US-VISIT, develop
performance measures to assess the impact of US-VISIT operations at land
POEs, and ensure that the statutorily mandated report describes how DHS
will move to a biometric entry and exit capability and align US-VISIT with
emerging land border initiatives. DHS did not provide timelines for when
it plans to take these steps, including finalizing the statutorily
mandated report, which was to have been issued to the Congress in June
2005.
DHS disagreed with certain aspects of or sought clarification on some of
our findings. DHS disagreed with our finding that the US-VISIT program
office did not fully consider the impact of US-VISIT on the overall
operations at POEs. It said that US-VISIT impacts are limited to changes
in Form I-94 processing time, which it says are positive, as supported by
US-VISIT evaluations. According to DHS other factors related to capacity,
staffing, and the volume of travelers are "arguably" beyond the scope of
US-VISIT.
We agree that the approach taken to do operational assessments of the
impact of US-VISIT land POE facilities focused on changes to I-94
processing time and that a variety of factors and processes can affect
traveler inspections and associated wait times at land POEs. However, as
discussed in this and our February 2006 report, the assessment methodology
US-VISIT has used thus far had limitations--including focusing solely on
I-94 processing time.^63 Unanticipated problems at facilities that
routinely experience high traffic volumes and occasionally encounter
computer processing shortfalls raise questions about whether DHS has
adequately assessed how US-VISIT has affected operations at land POEs.
Although it may not be cost-effective for US-VISIT or CBP to conduct a
formal assessment of the impact of US-VISIT at each land POE, it is
important that DHS be positioned to anticipate potential problems and
develop solutions to minimize any operational and logistical impacts on
aging and already overcrowded land POE facilities. This is especially true
given that DHS recognizes that the transition from 2- to 10-print digital
scanning has a high likelihood of impacting port facilities.
Regarding the latter, we have amended our report to clarify, consistent
with DHS's comments, that US-VISIT is currently working with industry to
speed up processing time and reduce the size of the 10-print capture
devices to "eliminate or significantly reduce the impact of deploying
10-print scanning." DHS efforts to work with industry highlights the need
to more fully assess how US-VISIT affects land POEs so that potential
problems can be identified and addressed before the readers, or any other
new programs, are introduced at land POEs. As noted in our report, based
on our past work, any lengthening in the process of entering the United
States at the busiest land POEs could inconvenience travelers and result
in fewer visits to the United States or lost business to the nation.^64
^63 [63]GAO-06-296 .
DHS also suggested that we clarify its acknowledgement that the
non-biometric technology tested did not meet the statutory requirement for
biometric exit capability. DHS stated that the non-biometric technology
was used because industry has yet to develop a biometric exit device that
could satisfy mission requirements such as not impacting traffic flow and
not having safety impacts. We have amended our report to clarify that DHS
acknowledged that the non-biometric technology would not satisfy statutory
requirements and to reflect that it would perform research and industry
outreach to satisfy the mandate. Nonetheless, the fact that the
non-biometric exit technology used does not satisfy the congressionally
mandated biometric exit capability underscores the importance of our
recommendation for DHS to clearly articulate how it plans to move from a
non-biometric exit technology to a biometric exit solution.
In addition, DHS suggested that we clarify that, with regard to the RFID
pedestrian exit portals at the Nogales-Mariposa, Arizona, POE, it had
constructed a new primary pedestrian exit walkway parallel to the existing
pedestrian entry and had installed signage, sidewalks, and a new secure
gate. We have amended the report to include information about the new
pedestrian exit walkway. However, as we noted in our report, portals were
installed only on one of the three pedestrian pathways used to exit the
United States. According to a CBP official at the Nogales-Mariposa POE,
the newly constructed pedestrian exit walkway is on the other side of the
building from the pathway where the portal readers were placed and tested
and thus would not mitigate the vulnerabilities we identified.
Finally, DHS provided other comments that we considered technical in
nature. We have amended our report to incorporate these clarifications,
where appropriate.
As agreed with your offices, unless you publicly announce its contents
earlier, we plan no further distribution of this report until 30 days
after the issuance date of our original report, which, as discussed
earlier, was classified For Official Use Only. At that time, we will
provide copies of this report to appropriate departments and interested
congressional committees. We will also make copies available to others
upon request. In addition, this report will be available on GAO's Web site
at http://www.gao.gov .
^64 [65]GAO-03-171 .
If you or your staff have any questions about this report or wish to
discuss the matter further, please contact me at (202) 512-8777 or
[email protected] . Contact points for our Offices of Congressional
Relations and Public Affairs may be found on the last page of this report.
Major contributors to this report are listed in appendix IX.
Richard M. Stana
Director, Homeland Security and Justice Issues
List of Requesters
The Honorable Peter T. King
Chairman
The Honorable Bennie G. Thompson
Ranking Minority Member
Committee on Homeland Security
House of Representatives
The Honorable Robert Filner
House of Representatives
The Honorable Raul M. Grijalva
House of Representatives
The Honorable Ruben E. Hinojosa
House of Representatives
The Honorable Solomon P. Ortiz
House of Representatives
The Honorable Silvestre Reyes
House of Representatives
Appendix I: Objective, Scope, and Methodology
This report addresses the progress the Department of Homeland Security and
U.S. Customs and Border Protection (CBP) have made in implementing the
United States Visitor Status Indicator Technology (US-VISIT) program at
existing land Ports of Entry (POE). Specifically, we analyzed the
following issues: (1) What has the US-VISIT Program Office done to
implement US-VISIT entry capabilities at land POEs and what impact has
US-VISIT had on these facilities? (2) What is the status of US-VISIT
Program Office efforts to implement a US-VISIT exit capability at land POE
facilities? (3) What has DHS done to define a strategic context to show
how US-VISIT entry and exit capabilities at land POE facilities fit with
other current and emerging border security initiatives?
We performed our work at the Department of Homeland Security's US-VISIT
Program Office and CBP. We also carried out work at 21 of 154 land POEs
where US-VISIT entry capability had been installed. At 3 of these 21 land
POEs, DHS was also testing exit capability. Table 3 shows the 21 land POEs
we visited, by location and state, between August 2005 and February 2006.
Table 3: Land POEs visited by GAO, August 2005 to February 2006
POE Name Location State
Northern border
Ambassador Bridge Detroit Mich.
Detroit-Windsor Tunnel
Overton Corners Rouses Point N.Y.
St. John's Hwy. Alexandria Bay
Thousands Island Bridge Champlain
Champlain
Highgate Springs Highgate Springs Vt.
Alburg Alburg
Peace Arch Blaine Wash.
Pacific Highway
Southern border
DeConcini Nogales Ariz.
Morley Gate
Mariposa
San Ysidro San Diego Calif.
Los Tomates Brownsville Tex.
Gateway Hidalgo
Brownsville Matamoros Bridge Progreso
Hidalgo Los Ebanos
Progreso Pharr
Los Ebanos
Pharr
Source: GAO.
In selecting land POEs to visit, we originally selected 10 land POEs on
the northern border and 10 POEs on the southern border based on geographic
dispersion along the border and taking into consideration POEs that were
located near each other to minimize travel costs. We added the Morley Gate
POE after we initially selected sites because it is physically located
about 100 yards from the DeConcini POE in downtown Nogales (Ariz.) and
after learning that US-VISIT was treating Morley Gate as a stand-alone POE
for US-VISIT deployment purposes.^1 In making our selections, we also
considered US-VISIT deployment schedules, facility size, and the number of
border crossings and I-94 issuances.^2 Fifteen of the 21 selected sites in
our study were among the 50 busiest land POEs for which US-VISIT entry
capability was to be operating by December 31, 2004, as required by law.
The other 6 sites were among those remaining POEs where, according to law,
US-VISIT entry capability was to be operating by December 31, 2005. While
selecting sites, we also included the five POEs at which the US-VISIT
program office was testing radio frequency identification (RFID)
technology as part of a proof of concept for meeting US-VISIT exit
capability requirements. These were: Blaine-Peace Arch; Blaine-Pacific
Highway; Thousand Islands Bridge, Alexandria Bay; Nogales-Mariposa; and
Nogales-DeConcini. The information from our site visits is limited to the
21 POEs we visited and is not generalizable to the remaining POEs.
To examine what the US-VISIT Program Office has done to implement US-VISIT
entry capabilities at land POEs and what impact US-VISIT has had on these
facilities, we interviewed US-VISIT and CBP headquarters officials as well
as CBP officials at the 21 locations we visited. We obtained and analyzed
available DHS reports on US-VISIT entry capability planning, deployment,
and operations across land POEs, including the 21 we visited. At the 21
locations, we (1) discussed US-VISIT entry capability deployment at the
facility, any facility-related barriers or constraints encountered during
installation, and any operational issues encountered since and (2)
obtained any available documentation about US-VISIT deployment and
operations at the facility. We also toured secondary inspection at each
facility to observe what US-VISIT equipment was installed, how it was
installed, and where possible, how it operated when visitors covered by
US-VISIT arrived at the facility for processing into the country. While
doing our site visits, we met with US-VISIT and CBP officials at
headquarters to discuss our field work; discern why problems we identified
in the field may have occurred, and if problems occurred, gather and
analyze available US-VISIT and CBP information about those problems,
including information on any corrective actions. We also examined whether
internal or management controls were in place to alert officials to the
problems we identified, and examined whether these controls were being
applied, consistent with GAO's Standards for Internal Controls in the
Federal Government.^3 In addition, we interviewed CBP and US-VISIT
headquarters officials about plans for installing and operating new
technology and equipment related to US-VISIT, such as 10-finger-scan
readers, at land POEs; reviewed available DHS documents about plans to
implement these devices; and reviewed available DHS documents that
discussed performance measures for US-VISIT overall. We also reviewed
applicable laws, regulations, and DHS federal register notices pertaining
to US-VISIT entry capability deployment at land POEs, as well as reports
prepared by DHS, GAO, the DHS Office of Inspector General, and the
Congressional Research Service.
^1At the time we selected sites for review, we were unaware that the
Morley Gate POE was being treated as a land POE separate from the other
land POEs at Nogales. However, since US-VISIT treated Morley Gate as a
separate POE for deployment, we also counted it as a stand alone POE.
^2During fiscal year 2004, the number of I-94 issuances by the 21 selected
sites ranged from 22 in Alburg Springs to about 398,900 in San Ysidro.
To determine the status of DHS's efforts to implement a US-VISIT exit
capability at land POEs, we interviewed US-VISIT and CBP headquarters
officials and CBP officials at the five locations where US-VISIT exit
capability was being tested (Nogales-Mariposa, Nogales-DeConcini,
Blaine-Pacific Highway, Blaine-Peace Arch, and Alexandria Bay). At each of
the locations, we toured the areas where exit testing equipment and
technology had been installed and discussed with CBP officials how it was
installed and to be tested. We also reviewed applicable laws and
regulations and obtained and analyzed available DHS reports on US-VISIT
exit capability including an operational alternatives assessment;
feasibility studies; and proof of concept performance evaluation and
corrective action reports. Our analysis of these reports focused on DHS
strategies for selecting, testing, acquiring, and evaluating alternative
methods that could meet the requirements; DHS's criteria used to select
and test the potential of RFID technology; and the challenges encountered,
including any privacy issues associated with RFID use. Finally, we
obtained and analyzed DHS reports on the costs of the equipment and
related facility infrastructure, such as the metal gantry erected over
roadways to hold RFID readers, to estimate what it would cost to install
RFID equipment at all land POEs. We developed our overall estimate based
on the average cost to date (about $1 million each) of installing exit
gantries and associated RFID equipment at the four POEs where gantries and
equipment were installed. (Although RFID use was tested at five POEs, at
the DeConcini POE in downtown Nogales, Arizona, the RFID readers were
placed on poles on either side of entry lanes, since all entering vehicles
pass under a large permanent canopy structure that precludes installing a
gantry. At the other four POEs, RFID readers were attached to metal
gantries placed over roadway lanes.)
^3See [67]GAO/AIMD-00-21 .3.1 and [68]GAO-01-1008G .
To examine what DHS has done to define a strategic context to show how
US-VISIT entry and exit capabilities at land POE facilities fit with other
current and emerging border security initiatives, we reviewed past GAO
reports and public DHS announcements about the Western Hemisphere Travel
Initiative and the Secure Border Initiative (SBI). We also interviewed DHS
officials about the status of efforts to implement these initiatives as
well as the status of efforts to develop and promulgate a strategic plan
for US-VISIT and compared available information on DHS plans to implement
initiatives with the results of our discussions with US-VISIT program
officials.
We conducted our work from September 2005 through October 2006 in
accordance with generally accepted government auditing standards.
Appendix II: Visa Waiver Countries
The Department of State's (State) Visa Waiver Program (VWP) enables
nationals of certain countries to travel to the United States for tourism
or business for stays of 90 days or less without obtaining a visa. The
program was established in 1986 with the objective of promoting better
relations with U.S. allies, eliminating unnecessary barriers to travel,
stimulating the tourism industry, and permitting the Department of State
to focus consular resources in other areas. VWP eligible travelers may
apply for a visa, if they prefer to do so. Not all countries participate
in the VWP, and not all travelers from VWP countries are eligible to use
the program. VWP travelers are screened prior to admission into the United
States, and they are enrolled in the Department of Homeland Security's
[69]US-VISIT program. Currently, 27 countries participate in the Visa
Waiver Program as shown in the following table.
Table 4: Countries Participating in the Visa Waiver Program
Andorra Iceland Norway
Australia Ireland Portugal
Austria Italy San Marino
Belgium Japan Singapore
Brunei Liechtenstein Slovenia
Denmark Luxembourg Spain
Finland Monaco Sweden
France The Netherlands Switzerland
Germany New Zealand United Kingdom
Source: Department of State.
Appendix III: Legislative Overview of the US-VISIT Program
The Illegal Immigration Reform and Immigrant Responsibility Act of 1996
originally required the development of an automated entry and exit control
system to collect a record of departure for every alien departing the
United States and match the record of departure with the record of the
alien's arrival in the United States; make it possible to identify
nonimmigrants who remain in the country beyond the authorized period; and
not significantly disrupt trade, tourism, or other legitimate cross-border
traffic at land border ports of entry. It also required the integration of
overstay information into appropriate databases of the INS and the
Department of State, including those used at ports of entry and at
consular offices. The system was originally to be developed by September
30, 1998; this deadline was changed to October 15, 1998, and was changed
again for land border ports of entry and sea ports to March 30, 2001.
The Immigration and Naturalization Service Data Management Improvement Act
(DMIA) of 2000 replaced the 1996 statute in its entirety, requiring
instead an electronic system that would provide access to and integrate
alien arrival and departure data that are authorized or required to be
created or collected under law, are in an electronic format, and are in a
data base of the Department of Justice or the Department of State,
including those created or used at ports of entry and at consular offices.
The Act specifically provided that it not be construed to permit the
imposition of any new documentary or data collection requirements on any
person for the purpose of satisfying its provisions, but it further
provided that it also not be construed to reduce or curtail any authority
of the Attorney General (now Secretary of Homeland Security) or Secretary
of State under any other provision of law. The integrated entry and exit
data system was to be implemented at airports and seaports by December 31,
2003, at the 50 busiest land ports of entry by December 31, 2004, and at
all remaining ports of entry by December 31, 2005.
The DMIA also required that the system use available data to produce a
report of arriving and departing aliens by country of nationality,
classification as an immigrant or nonimmigrant, and date of arrival in and
departure from the United States. The system was to match an alien's
available arrival data with the alien's available departure data, assist
in the identification of possible overstays, and use available alien
arrival and departure data for annual reports to Congress. These reports
were to include the number of aliens for whom departure data were
collected during the reporting period, with an accounting by country of
nationality; the number of departing aliens whose departure data was
successfully matched to the alien's arrival data, with an accounting by
country of nationality and classification as an immigrant or nonimmigrant;
the number of aliens who arrived pursuant to a nonimmigrant visa, or as a
visitor under the visa waiver program, for whom no matching departure data
have been obtained as of the end of the alien's authorized period of stay,
with an accounting by country of nationality and date of arrival in the
United States; and the number of identified overstays, with an accounting
by country of nationality.
In 2001, the USA PATRIOT Act provided that, in developing the integrated
entry and exit data system under the DMIA, the Attorney General (now
Secretary of Homeland Security) and Secretary of State were to focus
particularly on the utilization of biometric technology and the
development of tamper-resistant documents readable at ports of entry. It
also required that the system be able to interface with law enforcement
databases for use by federal law enforcement to identify and detain
individuals who pose a threat to the national security of the United
States. The PATRIOT Act also required by January 26, 2003, the development
and certification of a technology standard, including appropriate
biometric identifier standards, that can be used to verify the identity of
persons applying for a U.S. visa or persons seeking to enter the United
States pursuant to a visa for the purposes of conducting background
checks, confirming identity, and ensuring that a person has not received a
visa under a different name. This technology standard was to be the
technological basis for a cross-agency, cross-platform electronic system
that is a cost-effective, efficient, fully interoperable means to share
law enforcement and intelligence information necessary to confirm the
identity of persons applying for a U.S. visa or persons seeking to enter
the United States pursuant to a visa. This electronic system was to be
readily and easily accessible to consular officers, border inspection
agents, and law enforcement and intelligence officers responsible for
investigation or identification of aliens admitted to the United States
pursuant to a visa. Every 2 years beginning on October 26, 2002, the
Attorney General (now Secretary of Homeland Security) and the Secretary of
State were to jointly report to Congress on the development,
implementation, efficacy, and privacy implications of the technology
standard and electronic database system.
The Enhanced Border Security and Visa Entry Reform Act of 2002 required
that, in developing the integrated entry and exit data system for the
ports of entry under the DMIA, the Attorney General (now Secretary of
Homeland Security) and Secretary of State implement, fund, and use the
technology standard required by the USA PATRIOT Act at U.S. ports of entry
and at consular posts abroad. The act also required the establishment of a
database containing the arrival and departure data from machine-readable
visas, passports, and other travel and entry documents possessed by aliens
and the interoperability of all security databases relevant to making
determinations of admissibility under section 212 of the Immigration and
Nationality Act. In implementing these requirements, the INS (now DHS) and
the Department of State were to utilize technologies that facilitate the
lawful and efficient cross-border movement of commerce and persons without
compromising the safety and security of the United States and were to
consider implementing a North American National Security Program, for
which other provisions in the act called for a feasibility study.
The act, as amended, also established a number of requirements regarding
biometric travel and entry documents. It required that not later than
October 26, 2004, the Attorney General (now Secretary of Homeland
Security) and the Secretary of State issue to aliens only
machine-readable, tamper-resistant visas and other travel and entry
documents that use biometric identifiers and that they jointly establish
document authentication standards and biometric identifiers standards to
be employed on such visas and other travel and entry documents from among
those biometric identifiers recognized by domestic and international
standards organizations. It also required by October 26, 2005, the
installation at all ports of entry of the United States equipment and
software to allow biometric comparison and authentication of all U.S.
visas and other travel and entry documents issued to aliens and passports
issued by visa waiver participants. Such biometric data readers and
scanners were to be those that domestic and international standards
organizations determine to be highly accurate when used to verify
identity, that can read the biometric identifiers used under the act, and
that can authenticate the document presented to verify identity. These
systems also were to utilize the technology standard established pursuant
to the PATRIOT Act.
The Intelligence Reform and Terrorism Prevention Act of 2004 did not amend
the existing statutory provisions governing US-VISIT, but it did establish
additional statutory requirements concerning the program. It described the
program as an "automated biometric entry and exit data system" and
required DHS to develop a plan to accelerate the full implementation of
the program and to report to Congress on this plan by June 15, 2005. The
report was to provide several types of information about the
implementation of US-VISIT, including a "listing of ports of entry and
other DHS and Department of State locations with biometric exit data
systems in use." The report also was to provide a description of the
manner in which the US-VISIT program meets the goals of a comprehensive
entry and exit screening system, "including both entry and exit
biometric;" and fulfills the statutory obligations imposed on the program
by several laws enacted between 1996 and 2002. The act provided that
US-VISIT "shall include a requirement for the collection of biometric exit
data for all categories of individuals who are required to provide
biometric entry data, regardless of the port of entry where such
categories of individuals entered the United States."
The new provisions in the 2004 act also addressed integration and
interoperability of databases and data systems that process or contain
information on aliens and federal law enforcement and intelligence
information relevant to visa issuance and admissibility of aliens;
maintaining the accuracy and integrity of the US-VISIT data system; using
the system to track and facilitate the processing of immigration benefits
using biometric identifiers; the goals of the program (e.g., serving as a
vital counterterrorism tool, screening visitors efficiently and in a
welcoming manner, integrating relevant databases and plans for database
modifications to address volume increase and database usage, and providing
inspectors and related personnel with adequate real time information);
training, education, and outreach on US-VISIT, low risk visitor programs,
and immigration law; annual compliance reports by DHS, State, the
Department of Justice, and any other department or agency subject to the
requirements of the new provisions; and development and implementation of
a registered traveler program.
Appendix IV: The 20 Busiest Land Ports of Entry (POE) by Volume of
Individuals Entering the United States in Fiscal Year 2005
Total Number of US and
Foreign Entrants
Rank (Pedestrians and Vehicle
Order Name of Land POE Location State Occupants)
1 San Ysidro San Diego Calif. 41,430,304
2 Calexico Calexico Calif. 16,418,744
3 Otay Mesa Otay Mesa Calif. 14,531,794
4 Bridge of Americas El Paso Tex. 14,229,629
5 Paso del Norte El Paso Tex. 13,443,901
6 Hidalgo Hidalgo Tex. 12,788,679
7 Nogales DeConcini Nogales Ariz. 12,425,006
8 Lincoln-Juarez Bridge Laredo Tex. 12,328,941
9 Niagara Falls^a Niagara Falls N.Y. 9,656,444
10 San Luis San Luis Ariz. 9,017,655
11 Laredo Convent Bridge Laredo Tex. 8,376,604
12 Detroit-Ambassador Detroit Mich. 7,438,654
Bridge
13 Douglas Douglas Ariz. 6,795,354
14 Peace Bridge Buffalo N.Y. 6,725,942
15 Brownsville-Gateway Brownsville Tex. 6,712,108
16 Ysleta El Paso Tex. 6,492,695
17 Calexico East Calexico Calif. 6,122,111
18 Detroit Tunnel Detroit Mich. 5,719,476
19 Port Huron Port Huron Mich. 5,080,176
20 Eagle Pass Intern Eagle Pass Tex. 4,945,237
Bridge II
Source: CBP.
aThis site comprises multiple POEs at this location.
Appendix V: Land Ports of Entry (POE) at Which US-VISIT Has Been Installed
According to the US-VISIT program office, US-VISIT entry capability was
installed at the following land POE by December 31, 2005. The list is
arranged in state alphabetical order.
Alaska (3)
Alcan, Alcan Dalton's Cache, Dalton's Cache Skagway, Skagway
Arizona (8)
Douglas, Douglas Lukeville, Lukeville Nogales DeConcini Nogales Mariposa
Morley Gate, Nogales San Luis, San Luis Sasabe, Sasabe Naco, Naco
California (6)
Andrade, Andrade Calexico East-Imperial Valley, Calexico Calexico West,
Calexico Otay Mesa, Otay Mesa San Ysidro, San Ysidro Tecate, Tecate
Idaho (2)
Eastport, Eastport Porthill, Porthill
Maine (15)
Bar Harbor Ferry, Bar Harbor Bridgewater, Bridgewater Calais-Ferry Point
Bridge, Calais Coburn Gore, Coburn Gore Eastport, Eastport Fort Fairfield,
Fort Fairfield Fort Kent, Fort Kent Hamlin, Hamlin Houlton, Houlton
Jackman, Jackman Limestone, Limestone Lubec, Lubec Madawaska, Madawaska
Van Buren, Van Buren Vanceboro, Vanceboro
Michigan (6)
Detroit Ambassador Bridge, Detroit Detroit-Windsor Tunnel, Detroit Port
Huron-Blue Water Bridge, Port Huron Sault Ste. Marie, Sault Ste. Marie
Algonac Ferry, Algonac Marine City Ferry, Marine City
Minnesota (8)
Baudette, Baudette Ely, Ely Grand Portage, Grand Portage International
Falls, International Falls Lancaster, Lancaster Pine Creek, Roseau Roseau,
Roseau Warroad, Warroad
Montana (13)
Chief Mountain, Chief Mountain Del Bonita, Del Bonita Morgan, Loring
Opheim, Opheim Piegan, Babb Raymond, Raymond Roosville, Roosville Scobey,
Scobey Sweetgrass, Sweetgrass Turner, Turner Willow Creek, Turner Wild
Horse, Havre Whitetail, Whitetail
New Hampshire (1)
Pittsburg, Pittsburg
New Mexico (3)
Antelope Wells, Antelope Wells Columbus, Columbus Santa Teresa, Santa
Teresa
New York (16)
Cape Vincent Ferry, Cape Vincent Champlain, Champlain Chateaugay,
Chateaugay Fort Covington, Fort Covington Heart Island Ferry, Alexandria
Bay Massena, Rooseveltown Mooers, Mooers Niagara (Lewiston-Queenston,
Whirlpool, and Rainbow Bridges), Niagara Falls Niagara Falls Amtrak
Station, Niagara Falls Ogdensburg, Ogdensburg Overton Corners, Champlain
Peace Bridge, Buffalo Rochester Ferry, Rochester Rouses Point, Rouses
Point Thousand Islands Bridge, Alexandria Bay Trout River, Trout River
North Dakota (18)
Ambrose, Ambrose Antler, Antler Carbury, Carbury Dunseith, Dunseith
Fortuna, Fortuna Hannah, Hannah Hansboro, Hansboro Maida, Maida Neche,
Neche Noonon, Noonan Northgate, Northgate Pembina, Pembina Portal, Portal
Sarles, Sarles Sherwood, Sherwood St. John, St. John Walhalla, Walhalla
Westhope, Westhope
Ohio (1)
Jackson Street Pier Ferry, Akron
Texas (25)
Amistad Dam, Amistad Village Bridge of the Americas/Cordova Bridge, El
Paso Brownsville-Gateway Brownsville-Los Tomates/Veterans International
Bridge Brownsville-Matamoros Bridge Columbia Solidarity Bridge, Laredo
Convent Street (or Gateway to the Americas International Bridge), Laredo
Del Rio International Bridge, Del Rio Eagle Pass Bridge I, Eagle Pass
Eagle Pass Bridge II, Eagle Pass Fabens, Fabens Falcon Heights, Falcon
Heights Fort Hancock, Fort Hancock Gateway International Bridge,
Brownsville Hidalgo, McAllen Lincoln-Juarez Bridge, Laredo Los Ebanos
Ferry, Los Ebanos Los Indios, Los Indios Paso del Norte Bridge, El Paso
Pharr, Pharr Presidio, Presidio Progreso, Progreso Rio Grande City, Rio
Grande City Roma, Roma World Trade Bridge, Laredo Ysleta-Zaragoza Bridge,
El Paso
Vermont (14)
Alburg Springs, Alburg Springs Alburg, Alburg Beebe Plain, Beebe Plain
Beecher Falls, Beecher Falls Canaan, Canaan Derby Line, Derby Line, I-91
Derby Line, Derby Line, Rte 5 East Richford, East Richford Highgate
Springs, Highgate Springs Morses Line, Morses Line North Troy, North Troy
Norton, Norton Richford, Richford Richford/Pinnacle, Richford West
Berkshire, West Berkshire
Washington (13)
Blaine-Pacific Highway, Blaine Blaine-Peace Arch, Blaine Boundary,
Boundary Danville, Danville Ferry, Ferry Frontier, Frontier Laurier,
Laurier Lynden, Lynden Metaline Falls, Metaline Falls Nighthawk, Nighthawk
Oroville, Oroville Point Roberts, Point Roberts Sumas, Sumas
Canada (1)
Vancouver Amtrak Station
Appendix VI: Actions Taken by US-VISIT Program Office to Mitigate Privacy
Risks Associated with RFID at Land POEs
Protecting the privacy of visitors to the United States is one of the four
stated primary mission goals of the US-VISIT program. We and others have
raised questions in recent years about the potential privacy risks
surrounding the use of RFID technology to track the movement of persons,
as opposed to goods; the potential for the technology to be subverted for
surveillance purposes, rather than identification; and the potential for
"function creep," whereby information collected for one purpose gradually
develops other secondary uses, such as has occurred with Social Security
numbers.^1 In congressional testimony, we have noted that the use of RFID
tags and associated databases raises important security considerations
related to the confidentiality, integrity, and availability of the data on
the tags and in the databases, and in how this information is being
protected.^2 We have noted, as well, that while the federal government had
begun using RFID technology for a variety of applications--to track and
identify assets, weapons, and baggage on flights, for example--using this
technology for generic inventory control did not raise the same privacy
issues as using it to track the movement of persons.^3
The US-VISIT Program Office has taken steps to meet statutory and
congressional requirements protecting the privacy of individuals who would
be affected if RFID technology were to be implemented as part of the
US-VISIT exit and re-entry process, and to address the privacy concerns
raised by us and others. According to OMB guidance,^4 a privacy impact
assessment should be conducted before an agency develops or procures an
information technology system, such as the proposed RFID system, which
collects, maintains, or disseminates information about an individual--in
this case, numeric information that may be linked to biographic
information contained within databases. In January 2004, DHS published a
Privacy Impact Assessment in the Federal Register, as required by law, for
the initial deployment of US-VISIT, and published the latest in a series
of updated Privacy Impact Assessments in July 2005, addressing privacy
issues related to the proof-of-concept testing of RFID for Increment 2C.^5
1GAO, Privacy: Key Challenges Facing Federal Agencies, [70]GAO-06-777T
(Washington, D.C.: May 17, 2006). See also, Electronic Frontier
Foundation, letter of 4 April, 2005, to U.S. Department of State (
[71]http://www.eff.org/Privacy/Surveillance/RFID/RFID_passport.pdf ); and
Juels, Ari; Molnar, David; and Wagner, David, Security and Privacy Issues
in E-passports, Cryptology ePrint Archive: Report 2005/095 (
[72]http://eprint.iacr.org/2005/095 ).
^2GAO, Information Security: Key Considerations Related to Federal
Implementation of Radio Frequency Identification Technology,
[73]GAO-05-849T (Washington, D.C.: May 22, 2005).
^3GAO, Information Security: Radio Frequency Identification Technology in
the Federal Government, [74]GAO-05-551 (Washington, D.C.: May 27, 2005).
^4OMB M-03-22, Memorandum for Heads of Executive Departments and Agencies,
OMB Guidance for Implementing the Privacy Provisions of the E-Government
Act of 2002.
In its July 2005 Privacy Impact Assessment, DHS said that by design, the
information embedded in the RFID-readable I-94 tag does not compromise a
visitor's security, for the following reasons and with the following
strictures:
o Passive RFID minimizes privacy impacts and reduces the chance of
visitors being surreptitiously tracked because it does not
constantly transmit information or "beacon" a signal.
o The numeric identifier read in the I-94 tag does not contain and
is not derived from any personal information, and can only be used
to obtain personal information when combined with data within the
Automated Identification Management System (the system created to
link the unique RFID tag ID number to existing biographic
information received from the TECS database).
o The Automated Identification Management System records the exit
and re-entry data automatically captured for a particular RFID
tag, rather than a specific individual. The individual's complete
travel history is created only when the information captured from
the RFID tag is sent along with the biographic information stored
in the TECS database to a DHS Arrival and Departure Information
System.
o The Automated Identification Management System is undergoing the
DHS certification and accreditation process, which includes having
an approved detailed security plan and a comprehensive technical
assessment of the risks of operating the system. The certification
and accreditation process will be completed before the
proof-of-concept becomes operational.
o The Automated Identification Management System database can only
be accessed by authorized personnel signed into authorized
workstations that communicate with the system via a secure
network. These computer workstations are generally in CBP POE
buildings, inside work areas with physical controls over who can
enter the area, according to the Privacy Impact Assessment, and
each POE is required to be in compliance with DHS regulations with
regard to security. Even if an RFID tag number were secretly
detected by someone, that person would also have to obtain access
to the Automated Identification Management System secure database,
to link the number to an individual's records.
^5An updated Privacy Impact Assessment was also published in September
2004 to reflect inclusion of Visa Waiver Program visitors in US-VISIT,
expansion of US-VISIT to the 50 busiest land POEs, and changes in the
business processes used by DHS to share information with federal law
enforcement agencies.
DHS acknowledged that two potential privacy risks related to the RFID
exit/re-entry solution have been identified, and that US-VISIT creates a
pool of individuals whose personal information is at risk. Nevertheless,
it is stated in the July 2005 Privacy Impact Assessment that the privacy
risks will either be avoided or mitigated through the use of access
controls, education and training, encryption, and minimizing collection
and use of personal information will mitigate privacy risks associate with
data sharing. The first stated risk is that, if the format or some other
characteristic of the RFID tag number renders it recognizable as a
US-VISIT RFID tag, this would allow an unauthorized reader to
surreptitiously determine an individual's status (i.e., within US-VISIT
covered population). DHS stated that the RFID tag number will be
structured so that it cannot be used to identify an individual
specifically as a nonimmigrant. Second, DHS noted there is a low risk that
the RFID tag could be used to conduct surreptitious locational
surveillance of an individual; i.e., to use the presence of the tag to
follow an individual as he or she moves about in the United States.
However, ensuring that RFID tag numbers do not exhibit properties that can
be readily attributed to US-VISIT and using a limited radio frequency
range effectively mitigates this risk, according to DHS.
Appendix VII: US-VISIT Test of Radio Frequency Identification (RFID)
Readers Upon Exit and Re-entry at Selected Land POEs
The US-VISIT Program Office has been testing the use of passive,
automated, radio frequency identification (RFID) technology as a means to
record the exit of visitors from the United States at land POEs. RFID is
an automated data-capture technology that can be used to electronically
store information contained on a very small tag that can be embedded in a
document (or some other physical item); in this case, US-VISIT embedded
the tag in a modified Form I-94, called an I-94A. This information can
then be identified, and recorded as having been identified, by RFID
readers that are connected to computer databases. The RFID tests were
conducted for one-week periods at land POEs, as follows:^1 vehicular
traffic was tested at Nogales-Mariposa and Nogales-DeConcini POEs in
Nogales, Arizona; the Blaine-Pacific Highway and Blaine-Peace Arch POEs in
Blaine, Washington; and Thousand Islands Bridge POE in Alexandria Bay, New
York; pedestrian traffic was tested at the Nogales-Mariposa and
Nogales-DeConcini POEs.
For these exit tests, the US-VISIT Program Office developed critical
success factor target read rates to compare them to the actual read rates
obtained during the test for both pedestrians carrying I-94As with
RFID-detectable tags and for travelers in vehicles who also had
RFID-detectable I-94As with them inside the vehicles. The target exit read
rates ranged from an expected success rate of 70 percent to 95 percent,
based on anticipated performance under different conditions, partly as
demonstrated in the earlier feasibility study, on business requirements,
and on a concept of operation plan prepared for Increment 2C.^2 Table 5
shows the exit test results compared to the target read rates, reflecting
specifically the percentage of persons detected by the readers who were
carrying RFID-detectable documents for (1) pedestrians and (2) persons in
vehicles, as they passed through the POE area, while exiting the country.
^1Site selection factors included potential physical constraints, such as
protected historic structures that could hamper installation of gantries;
potential environmental impact; daily traffic and I-94A processing volume;
speed limits; and weather conditions.
^2A concept of operations defines how day-to-day operations are (or will
be) carried out to meet mission needs. The concept of operations includes
high-level descriptions of information systems, their interrelationships,
and information flows. It also describes the operations that must be
performed, who must perform them, and where and how the operations will be
carried out.
Table 5: RFID Read Rate Test Results for Persons in Vehicles and
Pedestrians Exiting the Country with RFID-Readable Documents
Critical
Success
Factor Actual Sample Size
Target Rate Read (vehicles or
Type of test Location of test (%) Rate (%) pedestrians)
Pedestrian Nogales-Mariposa 95 67 3^a
Exit
Vehicle Exit Blaine-Pacific Highway 70 14 166
Thousand Islands Bridge at 70 4 50
Alexandria Bay
Source: US-VISIT Program Office
aBecause of the small number of pedestrians carrying RFID readable
documents in the test, any findings should be interpreted with caution.
In phase 1 of proof-of-concept testing for RFID, US-VISIT reported that
read rates were higher for both vehicle occupants and pedestrians who held
the I-94A up toward the reader, rather than leaving it inside a pocket.
Through the use of billboards, radio and print advertisements, and other
methods of communication, visitors were encouraged to place their
RFID-detectable I-94A forms on the vehicle dashboard or up to a window.
These locations were believed to increase the chances for a successful
read. Those who took these actions were referred to as "participants," and
those who did not as "nonparticipants." The US-VISIT Program Office
reported that during the week-long proof-of-concept exit testing, one of
the three pedestrians was a participant--that is, the individual was
observed as voluntarily complying with the instructions; for those exiting
in a vehicle, these data were not reported. Moreover, although CBP
officials made substantial pre-test efforts to encourage travelers to
optimize the chances of I-94A tags being read, the report noted that this
effort apparently met with mixed success and that no additional solutions
were planned.
During the time period that US-VISIT tested the performance of RFID
readers for detecting I-94As carried by persons exiting the country in
vehicles at two land POEs (Thousand Islands Bridge, Alexandria Bay, New
York and Blaine-Pacific Highway, Washington), it also tested RFID reader
performance for persons in vehicles with RFID-embedded I-94As who
re-entered the country at both of these locations and three others
(Blaine-Peace Arch, Washington; and, in Arizona, Nogales-Mariposa and
Nogales-DeConcini). In addition, tests of RFID detectability carried by
pedestrians re-entering the country were conducted at Nogales-Mariposa,
and Nogales-DeConcini; pedestrian exit was tested only at Nogales-Mariposa
because of operational constraints at Nogales-DeConcini, according to the
report on the tests. Since persons re-entering the country with a
RFID-enabled I-94 would already have obtained an I-94A on a prior visit to
the United States, in order for it to be detected by an RFID reader, this
process is sometimes referred to by the US-VISIT program office as
"re-entry."
DHS set separate, higher critical success factors (performance targets)
for the RFID proof-of-concept tests for the vehicle re-entry process than
for the vehicle exit process. According to a US-VISIT official, these
higher performance targets were based, in part, on the fact that vehicles
must stop as part of the re-entry process, which makes it more likely that
a tag will be detected than is the case for exiting vehicles, which do not
need to slow down or stop at land POEs.^3 As with the tests conducted for
exit, test observers monitored traveler behavior to see whether, in
compliance with numerous advertisements in print and on local radio, the
vehicle driver placed the RFID-enabled I-94A on the vehicle dashboard or
on an empty passenger seat, or, for vehicle occupants, if they held the
I-94A up to a window or who made it otherwise visible, to better enable
detection it by the reader. Vehicle drivers or occupants who displayed an
I-94A in any of these requested ways were categorized as "participants,"
but read rates for them were, nevertheless, low at four of five test
locations. For example, at Nogales-DeConcini, which had the lowest
vehicle-entry read rates overall, the read rate was 27 percent for the 62
persons re-entering in vehicles with visitors whom US -VISIT reported as
making an effort to have their I-94A tags read. In contrast, at
Nogales-Mariposa, which had the highest overall re-entry read rate for the
vehicle test, US-VISIT reported that 83 out of 96 (86 percent) of
travelers who were categorized as participants were detected. Among those
at this same location who did not make this effort, US-VISIT reported that
I-94s with RFID tags were detected for about half (51 percent) of the
persons in the vehicles. Table 6 shows the results of RFID read-rates upon
re-entry for vehicle participants and nonparticipants.
^3According to a program official involved in setting the target rates,
the read rates expected for vehicles entering the country were also
expected to be lower than for pedestrians because of potential
interference from metal in vehicles.
Table 6: RFID Test Read Rates for Persons Re-Entering the Country in
Vehicles at Locations Where US-VISIT Tested RFID Technology
Thousand
Islands
Target Blaine-Pacific Blaine-Peace Bridge:
read Highway: Arch: Percent
Type of rate Nogales-Mariposa:Percent Nogales-DeConcini:Percent Percent and Percent and and
test (%) and Number and Number Number Number Number
Vehicle 80 P: 86% (83/96) P: 27% P: 45% (13/29) P: 55% P: 33%
entry (18/33) (3/9)
(17/62)
N: 51% (101/199) N: 11% N: 14% N: 19% N: 67%
(15/110) (14/72) (2/3)
(25/236)
C: 62% (184/295) C: 14% C: 20% C: 30% C: 42%
(28/139) (32/105) (5/12)
(425/298)
Source: US-VISIT Program Office
P: Participants: those vehicle drivers who placed the I-94A form either on
the dashboard, or on an empty seat; vehicle occupants who held the I-94A
up to a window or who placed it on the dashboard or who made it otherwise
visible.
N: Non-participants: Vehicle drivers and occupants who did not appear to
comply with any of the specified modes of making the I-94A visible.
C: Combined read rate for participants and nonparticipants.
Table 7 shows the results of RFID read-rate detection upon re-entry for
pedestrian participants and nonparticipants.
Table 7: RFID Test Read Rates for Pedestrians Re-entering the Country at
Locations Where US-VISIT Tested RFID Technology
Thousand
Target Blaine-Pacific Blaine-Peace Islands
Type of read rate Nogales-Mariposa:Percent Nogales-DeConcini:Percent Highway:Percent Arch:Percent Bridge:Percent
test (percent) and Number^a and Number^a and Number and Number and Number
Pedestrian 95 P: 100% P: 84% (32/38) No data No data No data
entry
(1 out of 1)
N: 50% N: 68%
(6/12) (179/264)
C: 54% (7/13) C: 70%
(211/302)
Source: US-VISIT Program Office
aBecause of the small number of pedestrians that participated in the test,
any findings should be interpreted with caution.
Note:
P is participants; defined as those pedestrians who held the I-94A form so
that it was out and visible upon entering the processing area.
N is non-participants; defined as those pedestrians who did not hold the
I-94A form in such as a way that it was visible.
C: Combined read rate for participants and nonparticipants
Appendix VIII: Comments from the U.S. Department of Homeland Security
Appendix IX: GAO Contact and Acknowledgments
GAO Contact
Richard M. Stana (202) 512-8777
Acknowledgments
In addition to the above, John F. Mortin, Assistant Director; Amy
Bernstein, Frances Cook, Odi Cuero, Richard Hung, Amanda Miller, James R.
Russell, and Jonathan Tumin made key contributions to this report.
(440562)
GAO's Mission
The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting its
constitutional responsibilities and to help improve the performance and
accountability of the federal government for the American people. GAO
examines the use of public funds; evaluates federal programs and policies;
and provides analyses, recommendations, and other assistance to help
Congress make informed oversight, policy, and funding decisions. GAO's
commitment to good government is reflected in its core values of
accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony
The fastest and easiest way to obtain copies of GAO documents at no cost
is through GAO's Web site ( www.gao.gov ). Each weekday, GAO posts
newly released reports, testimony, and correspondence on its Web site. To
have GAO e-mail you a list of newly posted products every afternoon, go to
www.gao.gov and select "Subscribe to Updates."
Order by Mail or Phone
The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent of
Documents. GAO also accepts VISA and Mastercard. Orders for 100 or more
copies mailed to a single address are discounted 25 percent. Orders should
be sent to:
U.S. Government Accountability Office 441 G Street NW, Room LM Washington,
D.C. 20548
To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202)
512-6061
To Report Fraud, Waste, and Abuse in Federal Programs
Contact:
Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail:
[email protected] Automated answering system: (800) 424-5454 or (202)
512-7470
Congressional Relations
Gloria Jarmon, Managing Director, [email protected] (202) 512-4400 U.S.
Government Accountability Office, 441 G Street NW, Room 7125 Washington,
D.C. 20548
Public Affairs
Paul Anderson, Managing Director, [email protected] (202) 512-4800
U.S. Government Accountability Office, 441 G Street NW, Room 7149
Washington, D.C. 20548
www.gao.gov/cgi-bin/getrpt?GAO-07-248 .
To view the full product, including the scope
and methodology, click on the link above.
For more information, contact Richard Stana at (202) 512-8777 or
[email protected].
Highlights of [82]GAO-07-248 , a report to congressional requesters
December 2006
BORDER SECURITY
US-VISIT Program Faces Strategic, Operational, and Technological
Challenges at Land Ports of Entry
The Department of Homeland Security (DHS) established the U.S. Visitor and
Immigrant Status Indicator Technology (US-VISIT) program to collect,
maintain, and share data on selected foreign nationals entering and
exiting the United States at air, sea and land ports of entry (POEs).
These data, including biometric identifiers like digital fingerprints, are
to be used to screen persons against watch lists, verify visitors'
identities, and record arrival and departure. GAO was asked to review
implementation at land POE facilities and in doing so GAO analyzed: (1)
efforts to implement US-VISIT entry capability; (2) efforts to implement
US-VISIT exit capability; and (3) DHS's efforts to define how US-VISIT
fits with other emerging border security initiatives. GAO reviewed DHS and
US-VISIT program documents, interviewed program officials, and visited 21
land POEs with varied traffic levels on both borders.
[83]What GAO Recommends
GAO recommends that DHS improve existing management controls for US-VISIT;
develop performance measures to assess the impact of US-VISIT at land
POEs; and ensure that a statutorily mandated report describes how DHS will
move to a biometric entry/exit capability and align US-VISIT with emerging
land border security initiatives. DHS generally agreed and said that it
has begun to or plans to implement GAO's recommendations.
US-VISIT entry capability has been installed at 154 of the 170 land POEs.
Officials at all 21 sites GAO visited reported that US-VISIT had improved
their ability to process visitors and verify identities. DHS plans to
further enhance US-VISIT's capabilities by, among other things, requiring
new technology and equipment for scanning all 10 fingerprints (see photo,
left, below). While this may aid border security, installation could
increase processing times and adversely affect operations at land POEs
where space constraints, traffic congestion, and processing delays already
exist. GAO's work indicated that management controls in place to identify
such problems and evaluate operations were insufficient and inconsistently
administered. For example, GAO identified computer processing problems at
12 sites visited; at 9 of these, the problems were not always reported.
US-VISIT has developed performance measures, but measures to gauge factors
that uniquely affect land POE operations were not developed; these would
put US-VISIT officials in a better position to identify areas for
improvement.
US-VISIT officials concluded that, for various reasons, a biometric
US-VISIT exit capability cannot now be implemented without incurring a
major impact on land POE facilities. An interim nonbiometric exit
technology being tested (see photo, right, below) does not meet the
statutory requirement for a biometric exit capability and cannot ensure
that visitors who enter the country are those who leave. DHS has not yet
reported to Congress on a required plan describing how it intends to fully
implement a biometric entry/exit program, or use nonbiometric solutions.
Until this plan is finalized, neither DHS nor Congress is in a good
position to prioritize and allocate program resources or plan for POE
facilities modifications.
DHS has not yet articulated how US-VISIT is to align with other emerging
land border security initiatives and mandates, and thus cannot ensure that
the program will meet strategic program goals and operate cost effectively
at land POEs. Knowing how US-VISIT is to work with these initiatives, such
as one requiring U.S. citizens, Canadians, and others to present passports
or other documents at the border in 2009, is important for understanding
the broader strategic context for US-VISIT and identifying resources,
tools, and potential facility modifications needed to ensure success.
US-VISIT entry capability set-up with computer and camera (left);
nonbiometric exit identification readers mounted over highway (right)
References
Visible links
44. http://www.gao.gov/cgi-bin/getrpt?GAO/AIMD-00-21
45. http://www.gao.gov/cgi-bin/getrpt?GAO-01-1008G
46. http://www.gao.gov/cgi-bin/getrpt?GAO-06-296
47. http://www.gao.gov/cgi-bin/getrpt?GAO/AIMD-00-21
48. http://www.gao.gov/cgi-bin/getrpt?GAO-01-1008G
49. http://www.gao.gov/cgi-bin/getrpt?GAO-03-1083
50. http://www.gao.gov/cgi-bin/getrpt?GAO-04-569T
51. http://www.gao.gov/cgi-bin/getrpt?GAO-04-586
52. http://www.gao.gov/cgi-bin/getrpt?GAO-06-296
53. http://www.gao.gov/cgi-bin/getrpt?GAO-03-174
54. http://www.gao.gov/cgi-bin/getrpt?GAO-03-171
55. http://www.gao.gov/cgi-bin/getrpt?GAO-06-296
56. http://www.gao.gov/cgi-bin/getrpt?GAO/AIMD-00-21
57. http://www.gao.gov/cgi-bin/getrpt?GAO-01-1008G
58. http://www.gao.gov/cgi-bin/getrpt?GAO-05-849T
59. http://www.gao.gov/cgi-bin/getrpt?GAO-03-1083
60. http://www.gao.gov/cgi-bin/getrpt?GAO-06-741R
61. http://searching.gao.gov/cs.html?charset=iso-8859-1&url=http%3A//www.gao.gov/new.items/d0482.pdf&qt=overstays&col=&n=1&la=en
62. http://www.gao.gov/cgi-bin/getrpt?GAO-04-82
63. http://www.gao.gov/cgi-bin/getrpt?GAO-06-296
65. http://www.gao.gov/cgi-bin/getrpt?GAO-03-171
67. http://www.gao.gov/cgi-bin/getrpt?GAO/AIMD-00-21
68. http://www.gao.gov/cgi-bin/getrpt?GAO-01-1008G
69. http://www.dhs.gov/dhspublic/interapp/editorial/editorial_0435.xml
70. http://www.gao.gov/cgi-bin/getrpt?GAO-06-777T
71. http://www.eff.org/Privacy/Surveillance/RFID/RFID_passport.pdf
72. http://eprint.iacr.org/2005/095
73. http://www.gao.gov/cgi-bin/getrpt?GAO-05-849T
74. http://www.gao.gov/cgi-bin/getrpt?GAO-05-551
82. http://www.gao.gov/cgi-bin/getrpt?GAO-07-248
*** End of document. ***