    Visa Waiver Program: Actions Are Needed to Improve Management of
    the Expansion Process, and to Assess and Mitigate Program Risks
    (15-SEP-08, GAO-08-967).

    The Visa Waiver Program, which enables citizens of participating
    countries to travel to the United States without first obtaining
    a visa, has many benefits, but it also has risks. In 2006, GAO
    found that the Department of Homeland Security (DHS) needed to
    improve efforts to assess and mitigate these risks. In August
    2007, Congress passed the 9/11 Act, which provides DHS with the
    authority to consider expanding the program to countries whose
    short-term business and tourism visa refusal rates were between 3
    and 10 percent in the prior fiscal year. Countries must also meet
    certain conditions, and DHS must complete actions to enhance the
    program's security. GAO has examined DHS's process for expanding
    the Visa Waiver Program and evaluated the extent to which DHS is
    assessing and mitigating program risks. GAO reviewed relevant
    laws and procedures and interviewed agency officials in
    Washington, D.C., and in U.S. embassies in eight aspiring and
    three Visa Waiver Program countries.
    -------------------------Indexing Terms-------------------------
    REPORTNUM:   GAO-08-967
        ACCNO:   A84177
      TITLE:     Visa Waiver Program: Actions Are Needed to Improve
    Management of the Expansion Process, and to Assess and Mitigate
    Program Risks
         DATE:   09/15/2008
      SUBJECT:   Airlines
    	     Data collection
    	     Data storage
    	     Foreign governments
    	     Homeland security
    	     Illegal aliens
    	     Immigration
    	     International cooperation
    	     International travel
    	     Passports
    	     Program evaluation
    	     Reporting requirements
    	     Requirements definition
    	     Risk assessment
    	     Risk factors
    	     Risk management
    	     Standards evaluation
    	     Travel
    	     Visas
    	     Waivers
    	     Program goals or objectives
    	     Program implementation
    	     Visa Waiver Program

    ******************************************************************
    ** This file contains an ASCII representation of the text of a  **
    ** GAO Product.                                                 **
    **                                                              **
    ** No attempt has been made to display graphic images, although **
    ** figure captions are reproduced.  Tables are included, but    **
    ** may not resemble those in the printed version.               **
    **                                                              **
    ** Please see the PDF (Portable Document Format) file, when     **
    ** available, for a complete electronic file of the printed     **
    ** document's contents.                                         **
    **                                                              **
    ******************************************************************
    GAO-08-967

         * [1]Results in Brief
         * [2]Background
         * [3]Executive Branch Is Moving Quickly to Expand the Visa Waiver

              * [4]DHS Has Not Followed a Transparent Process for Visa Waiver P
              * [5]DHS Has Achieved Some Results in Visa Waiver Program Expansi

         * [6]DHS Has Not Fully Developed Tools Aimed at Assessing and Mit

              * [7]DHS Has Not yet Implemented Key Security Provisions of 9/11

                   * [8]Plan to Verify the Air Departure of Foreign Nationals
                     Will N
                   * [9]DHS's Planned Implementation of ESTA by January 2009 Will
                     Fa
                   * [10]Implementation of Biometric Air Exit System before July
                     2009

              * [11]DHS Does Not Fully Consider Overstay Rates to Assess the Ill
              * [12]DHS Has Implemented Many of GAO's Prior Recommendations Aime

         * [13]Conclusions
         * [14]Recommendations for Executive Action
         * [15]Agency Comments and Our Evaluation
         * [16]GAO Comments
         * [17]GAO Contact
         * [18]Staff Acknowledgments
         * [19]GAO's Mission
         * [20]Obtaining Copies of GAO Reports and Testimony

              * [21]Order by Mail or Phone

         * [22]To Report Fraud, Waste, and Abuse in Federal Programs
         * [23]Congressional Relations
         * [24]Public Affairs

    Report to Congressional Requesters

    United States Government Accountability Office

    GAO

    September 2008

    VISA WAIVER PROGRAM

    Actions Are Needed to Improve Management of the Expansion Process, and to
    Assess and Mitigate Program Risks

    Visa Waiver Program Visa Waiver Program Visa Waiver Program iver Program
    Visa Waiver Program Visa Waiver Program Visa Waiver Program Visa Waiver
    Program Visa Waiver Program Visa Waiver Program Visa Waiver Program Visa
    Waiver Program Visa Waiver Program Visa Waiver Program Visa Waiver Program
    Visa Waiver Program Visa Waiver Program Visa Waiver Program Visa Waiver
    Program Visa Waiver Program Visa Waiver Program Visa Waiver Program Visa
    Waiver Program Visa Waiver Program Visa Waiver Program Visa Waiver Program
    Visa Waiver Program Visa Waiver Program Visa Waiver Program Visa Waiver
    Program Visa Waiver Program Visa Waiver Program Visa Waiver Program Visa
    Waiver Program Visa Waiver Program Visa Waiver Program Visa Waiver Program
    Visa Waiver Program Visa Waiver Program Visa Waiver Program Visa Waiver
    Program Visa Waiver Program Visa Waiver Program Visa Waiver Program Visa
    Waiver Program Visa Waiver Program Visa Waiver Program Visa Waiver Program
    Visa Waiver Program Visa Waiver Program Visa Waiver Program Visa Waiver
    Program Visa Waiver Program Visa Waiver Program Visa Waiver Program Visa
    Waiver Program

    GAO-08-967

    Contents

    Letter 1

    Results in Brief 3
    Background 6
    Executive Branch Is Moving Quickly to Expand the Visa Waiver Program
    without a Transparent Process 9
    DHS Has Not Fully Developed Tools Aimed at Assessing and Mitigating Risks
    in the Visa Waiver Program 15
    Conclusions 29
    Recommendations for Executive Action 30
    Agency Comments and Our Evaluation 30
    Appendix I Objectives, Scope, and Methodology 32
    Appendix II Worldwide Refusal Rates for Short-term Business and Tourism
    Visas, Fiscal Year 2007 34
    Appendix III Key Legislative Requirements for Inclusion in the Visa Waiver
    Program 40
    Appendix IV Comments from the Department of Homeland Security 42
    Appendix V Comments from the Department of Justice 51
    Appendix VI GAO Contact and Staff Acknowledgments 53

    Tables

    Table 1: Status of Prior GAO Recommendations 28
    Table 2: Worldwide Refusal Rates for Short-term Business and Tourism
    Visas, Fiscal Year 2007 34

    Figures

    Figure 1: Comparison of DHS's Process to Expand the Visa Waiver Program
    against the Standard Operating Procedures for Expansion 10
    Figure 2: Short-term Business and Tourism Visa Refusal Rates, by Country,
    Fiscal Year 2007 13
    Figure 3: DHS's Current Plan to Meet Air Exit System Provision Omits Those
    Who Remain in the United States 17
    Figure 4: DHS's Anticipated ESTA Implementation Timeline 21

    Abbreviations

    CBP Customs and Border Protection

    DHS Department of Homeland Security

    ESTA Electronic System for Travel Authorization

    ICE Immigration and Customs Enforcement

    Interpol International Criminal Police Organization

    MOU memorandum of understanding

    US-VISIT U.S. Visitor and Immigrant Status and Indicator Technology

    This is a work of the U.S. government and is not subject to copyright
    protection in the United States. The published product may be reproduced
    and distributed in its entirety without further permission from GAO.
    However, because this work may contain copyrighted images or other
    material, permission from the copyright holder may be necessary if you
    wish to reproduce this material separately.

    United States Government Accountability Office

    Washington, DC 20548

    September 15, 2008 September 15, 2008

    The Honorable Joseph I. Lieberman Chairman The Honorable Susan M. Collins
    Ranking Member Committee on Homeland Security and Governmental Affairs
    United States Senate The Honorable Joseph I. Lieberman Chairman The
    Honorable Susan M. Collins Ranking Member Committee on Homeland Security
    and Governmental Affairs United States Senate

    The Honorable Dianne Feinstein Chairman The Honorable Jon Kyl Ranking
    Member Subcommittee on Terrorism, Technology, and Homeland Security
    Committee on the Judiciary United States Senate The Honorable Dianne
    Feinstein Chairman The Honorable Jon Kyl Ranking Member Subcommittee on
    Terrorism, Technology, and Homeland Security Committee on the Judiciary
    United States Senate

    The Visa Waiver Program enables citizens of 27 participating countries to
    travel to the United States for tourism or business for 90 days or less
    without first obtaining a visa from a U.S. embassy or consulate.^1 The
    program has many benefits, including facilitating travel for millions of
    foreign nationals seeking to visit the United States each year. However,
    as we have reported,^2 the program also poses inherent security, law
    enforcement, and illegal immigration risks to the United States. In
    particular, Visa Waiver Program travelers are not subject to the same
    degree of screening as those with visas because they are not interviewed
    by a Department of State (State) consular officer before arriving at a
    U.S. port of entry. During the visa issuance process, State consular
    officers can determine if an individual has a criminal record or has prior
    immigration violations. On the basis of their assessments, consular
    officers decide The Visa Waiver Program enables citizens of 27
    participating countries to travel to the United States for tourism or
    business for 90 days or less without first obtaining a visa from a U.S.
    embassy or consulate.^1 The program has many benefits, including
    facilitating travel for millions of foreign nationals seeking to visit the
    United States each year. However, as we have reported,^2 the program also
    poses inherent security, law enforcement, and illegal immigration risks to
    the United States. In particular, Visa Waiver Program travelers are not
    subject to the same degree of screening as those with visas because they
    are not interviewed by a Department of State (State) consular officer
    before arriving at a U.S. port of entry. During the visa issuance process,
    State consular officers can determine if an individual has a criminal
    record or has prior immigration violations. On the basis of their
    assessments, consular officers decide whether to approve or deny a visa
    and, in doing so, help protect against individuals who pose a risk to the
    United States. Without the added safeguard of the visa issuance process,
    the Visa Waiver Program could be exploited to gain illegal entry into the
    United States. Indeed, in September 2007, the Director of National
    Intelligence testified that al Qaeda is recruiting Europeans because most
    of them do not require a visa to enter the United States. Effective
    oversight of the Visa Waiver Program is essential to finding the right
    balance between facilitating legitimate travel and screening for potential
    terrorists, criminals, and others who may pose law enforcement and illegal
    immigration concerns.

    ^1The participating countries are Andorra, Australia, Austria, Belgium,
    Brunei, Denmark, Finland, France, Germany, Iceland, Ireland, Italy, Japan,
    Liechtenstein, Luxembourg, Monaco, the Netherlands, New Zealand, Norway,
    Portugal, San Marino, Singapore, Slovenia, Spain, Sweden, Switzerland, and
    the United Kingdom.

    ^2GAO, Border Security: Stronger Actions Needed to Assess and Mitigate
    Risks of the Visa Waiver Program, [25]GAO-06-854 (Washington, D.C.: July
    28, 2006).

    The executive branch aims to expand the Visa Waiver Program to countries
    in Central and Eastern Europe, and South Korea. According to the
    Department of Homeland Security (DHS), some of these countries are U.S.
    partners in the war in Iraq and have high expectations that they will join
    the program due to their close economic, political, and military ties to
    the United States. The executive branch has supported more flexible
    criteria for admission to the program. In August 2007, Congress passed
    legislation that allows DHS to consider admitting countries that otherwise
    meet the program's requirements but that have business and tourism visas
    refusal rates^3 between 3 percent and 10 percent, if the countries meet
    certain conditions, such as cooperating with the United States on
    counterterrorism initiatives.^4 Previously, only countries with refusal
    rates below 3 percent in the prior fiscal year qualified to be considered
    for admission. Before DHS can exercise this new authority, the
    legislation--referred to as the "9/11 Act"--requires that the department
    complete certain actions aimed at enhancing the security of the Visa
    Waiver Program.

    At your request, this report (1) examines the process DHS is following to
    admit countries into the Visa Waiver Program and (2) evaluates actions
    taken to assess and mitigate potential risks in the program.

    Throughout the course of our work, we reviewed laws governing the Visa
    Waiver Program and its expansion, and relevant regulations and agency
    operating procedures, as well as our prior reports and testimonies. We met
    with several DHS component agencies and offices, including Customs and
    Border Protection (CBP); Immigration and Customs Enforcement (ICE); the
    U.S. Visitor and Immigrant Status and Indicator Technology (US-VISIT); and
    the Visa Waiver Program Office,^5 which is responsible for oversight of
    Visa Waiver Program requirements. In addition, we interviewed officials
    from State's Consular Affairs, Europe and Eurasia, and East Asia and
    Pacific Bureaus, and met with International Criminal Police Organization
    (Interpol) officials in Lyon, France, as well as officials from the
    Department of Justice's (Justice) Interpol-U.S. National Central Bureau.^6
    We also spoke with officials at U.S. embassies in three current and eight
    aspiring Visa Waiver Program countries. Appendix I contains a more
    detailed discussion of our objectives, scope, and methodology. We
    conducted this performance audit from September 2007 to September 2008, in
    accordance with generally accepted government auditing standards. Those
    standards require that we plan and perform the audit to obtain sufficient,
    appropriate evidence to provide a reasonable basis for our findings and
    conclusions based on our audit objectives. We believe that the evidence
    obtained provides a reasonable basis for our findings and conclusions
    based on our audit objectives.

    ^3The refusal rate refers only to the temporary business and tourism visa
    applications that are denied as a percentage of the total temporary
    business and tourism visa applications for nationals of that country.

    ^4See Implementing Recommendations of the 9/11 Commission Act of 2007,
    Pub. L. No. 110-53.

    Results in Brief

    The executive branch is moving aggressively to expand the Visa Waiver
    Program by the end of 2008, but, in doing so, DHS has not followed a
    transparent process. The department did not follow its own November 2007
    standard operating procedures, which set forth the key milestones that DHS
    and aspiring countries must meet before additional countries are admitted
    into the program. As a result, State, Justice, and U.S. embassy officials
    stated that DHS created confusion among its interagency partners and
    aspiring Visa Waiver Program countries. Indeed, absent clear direction
    from DHS, U.S. embassy officials in several aspiring countries told us
    that it had been difficult to explain the expansion process to their
    foreign counterparts and manage their expectations about when those
    countries might be admitted into the Visa Waiver Program. Furthermore,
    State officials said that it was difficult to explain to countries with
    fiscal year 2007 refusal rates below 10 percent that have signaled
    interest in joining the program (such as Croatia, Israel, and Taiwan) why
    DHS is not negotiating with them. DHS, however, is negotiating with
    several countries that had fiscal year 2007 visa refusal rates above the
    10 percent ceiling (Hungary, Latvia, Lithuania, and Slovakia), with the
    expectation that fiscal year 2008 rates will be below this ceiling.
    Nevertheless, DHS achieved some security enhancements to the Visa Waiver
    Program during expansion negotiations, including new agreements with
    several aspiring countries on lost and stolen passport reporting. DHS,
    State, and Justice agreed, however, that a more transparent process is
    needed to guide any future consideration of program expansion. In
    acknowledging weaknesses in the expansion process, DHS's Assistant
    Secretary for Policy Development said that DHS did not have a clear
    process at the outset of negotiations in late 2007, in part because the
    department lacked prior experience in expanding the Visa Waiver Program
    and because the program's legislative requirements had changed in August
    of that year.

    ^5DHS's Visa Waiver Program Office, known prior to September 2007 as the
    Visa Waiver Oversight Unit within the Office of International Enforcement,
    is led by a director, who reports to the DHS Assistant Secretary for
    Policy Development.

    ^6The U.S. National Central Bureau in Washington, D.C., facilitates
    international law enforcement cooperation among the United States and
    Interpol and its other member countries.

    DHS has not fully developed tools to assess and mitigate risks in the Visa
    Waiver Program. Specifically, DHS has not yet met two key certification
    requirements in the 9/11 Act that would allow DHS to consider admitting
    additional countries to the program with refusal rates between 3 percent
    and 10 percent. First, DHS must certify that it can verify the departure
    of not less than 97 percent of foreign nationals who exit from U.S.
    airports. In February 2008, we testified that DHS's plan to meet this
    provision will not demonstrate improvements in the air exit system and
    will not help the department mitigate risks of the Visa Waiver Program,
    because the plan does not account for data on those who remain in the
    country beyond their authorized period of stay (referred to as
    "overstays"). Second, DHS must certify that the Electronic System for
    Travel Authorization (ESTA) for screening visa waiver travelers in advance
    of their travel is "fully operational." DHS has not yet announced when it
    plans to make this certification; however, ESTA became available on a
    voluntary basis on August 1, 2008, and DHS anticipates that ESTA
    authorizations will be required for all visa waiver travelers after
    January 12, 2009.^7 DHS determined that the law permits it to expand the
    program to countries with refusal rates between 3 percent and 10 percent
    after it makes the two 9/11 Act certifications, and after the countries
    have met certain conditions, but before ESTA is mandatory for all Visa
    Waiver Program travelers. DHS may face challenges in implementing ESTA,
    such as adequately informing the public and travel industry about the
    system. In addition, for DHS to maintain its authority to admit certain
    countries into the program, the 9/11 Act requires that the air exit system
    also incorporate biometric indicators (such as fingerprints) by July 1,
    2009. However, DHS is unlikely to meet this timeline due to several
    unresolved issues. In addition, DHS does not fully consider countries'
    overstay rates when assessing illegal immigration risks in the Visa Waiver
    Program because the department's overstay data have weaknesses, according
    to the Visa Waiver Program Office. Finally, DHS has fully implemented many
    recommendations from our 2006 report aimed at improving DHS's ability to
    assess and mitigate program risks, including screening U.S.-bound
    travelers against Interpol's database of lost and stolen passports.
    However, DHS has not yet fully implemented others, such as requiring that
    all Visa Waiver Program countries report the theft or loss of blank and
    issued passports to the United States and Interpol. Fully implementing the
    remaining recommendations is important as DHS moves to expand both the
    Visa Waiver Program and the department's oversight responsibilities.

    ^7According to DHS, ESTA will be implemented as a mandatory program for
    all visa waiver travelers 60 days after publication of a notice in the
    Federal Register. DHS anticipates issuing that notice in November 2008,
    for implementation of the mandatory ESTA requirements on January 12, 2009.

    To improve management of the Visa Waiver Program and better assess and
    mitigate risks associated with the program, we recommend that DHS
    establish a clear process, in coordination with State and Justice, for
    program expansion that would include the criteria used to determine which
    countries will be considered for expansion and timelines for nominating
    countries, security assessments of aspiring countries, and negotiation of
    any bilateral agreements to implement the program's legislative
    requirements. In addition, we recommend that DHS designate an office with
    responsibility for developing overstay rate information for the Visa
    Waiver Program, explore cost-effective actions to further improve these
    data's reliability, and use these validated data to help evaluate whether
    current or aspiring Visa Waiver Program countries pose a potential illegal
    immigration risk to the United States.

    We received written comments on a draft of our report from DHS and
    Justice, which we have reprinted in appendices IV and V, respectively.
    State did not provide comments on the draft. DHS either agreed with, or
    stated that it was taking steps to implement, all of our recommendations.
    Justice did not comment on our recommendations, but provided additional
    information about the importance of monitoring countries' reporting of
    lost and stolen passports to Interpol, and its efforts, in collaboration
    with DHS, to include screening against Interpol's lost and stolen passport
    database in ESTA.

    Background

    In 2007, almost 13 million citizens^8 from 27 countries entered the United
    States under the Visa Waiver Program.^9 The program was created to promote
    the effective use of government resources and facilitate international
    travel without jeopardizing U.S. national security. The United States last
    expanded the Visa Waiver Program's membership in 1999; since then, other
    countries have expressed a desire to become members. In February 2005,
    President Bush announced that DHS and State would develop a strategy, or
    "Road Map Initiative," to clarify the statutory requirements for
    designation as a participating country. According to DHS, some of the
    countries seeking admission to the program are U.S. partners in the war in
    Iraq and have high expectations that they will join the program due to
    their close economic, political, and military ties to the United States.
    As we reported in July 2006, DHS and State are consulting with 13 "Road
    Map" countries seeking admission into the Visa Waiver Program--Bulgaria,
    Cyprus, Czech Republic, Estonia, Greece, Hungary, Latvia, Lithuania,
    Malta, Poland, Romania, Slovakia, and South Korea.

    Following the terrorist attacks of September 11, 2001, Congress passed
    additional laws to strengthen border security policies and procedures, and
    DHS and State instituted other policy changes that have affected a
    country's qualifications for participating in the Visa Waiver Program. In
    August 2007, Congress enacted the 9/11 Act, which provides DHS with the
    authority to consider admitting into the Visa Waiver Program countries
    that otherwise meet the program requirements, but have refusal rates
    between 3 percent and 10 percent, provided the countries meet certain
    conditions (see app. II for worldwide refusal rates for fiscal year 2007).
    Before being admitted to the program, for example, the countries must
    demonstrate a sustained reduction in refusal rates, and must be
    cooperating with the United States on counterterrorism initiatives,
    information sharing, and the prevention of terrorist travel, among other
    things. In addition, DHS must complete two actions aimed at enhancing the
    security of the program (see app. III for the key legislative requirements
    for inclusion in the Visa Waiver Program).^10 In particular, to consider
    admitting countries into the Visa Waiver Program with refusal rates
    between 3 percent and 10 percent, DHS must certify the following to
    Congress:

    ^8This figure does not account for multiple admissions into the United
    States under the Visa Waiver Program by the same individual.

    ^9The Immigration Reform and Control Act of 1986, Pub. L. No. 99-603,
    created the Visa Waiver Program as a pilot program. In 2000, the program
    became permanent under the Visa Waiver Permanent Program Act, Pub. L. No.
    106-396.

               o A system is in place that can verify the departure of not less
               than 97 percent of foreign nationals who depart through U.S.
               airports. Initially, this system will be biographic only. Congress
               required the eventual implementation of a biometric exit system at
               U.S. airports. If the biometric air exit system is not in place by
               July 1, 2009, the flexibility that DHS may obtain to consider
               admitting countries with refusal rates between 3 percent and 10
               percent will be suspended until the system is in place.

               o An electronic travel authorization system is "fully
               operational." This system will require nationals from Visa Waiver
               Program countries to provide the United States with biographical
               information before boarding a U.S.-bound flight to determine the
               eligibility of, and whether there exists a law enforcement or
               security risk in permitting, the foreign national to travel to the
               United States under the program. DHS recommends that applicants
               obtain ESTA authorizations at the time of reservation or ticket
               purchase, or at least 72 hours before their planned date of
               departure for the United States. The ESTA application will
               electronically collect information similar to the information
               collected in paper form by CBP.^11 To the extent possible,
               according to DHS, applicants will find out almost immediately
               whether their travel has been authorized, in which case they are
               free to travel to the United States, or if their application has
               been rejected, in which case they are ineligible to travel to the
               United States under the Visa Waiver Program.^12 Those found
               ineligible to travel under the Visa Waiver Program must apply for
               a visa at a U.S. embassy to travel to the United States.^13

               In addition, the 9/11 Act requires that visa waiver countries

               o enter into an agreement with the United States to report, or
               make available through Interpol or other means as designated by
               the Secretary of Homeland Security, to the U.S. government
               information about the theft or loss of passports within a strict
               time frame;

               o enter into an agreement with the United States to share
               information regarding whether citizens and nationals of that
               country traveling to the United States represent a threat to U.S.
               security; and

               o accept for repatriation any citizen, former citizen, or national
               of the country against whom the United States has issued a final
               order of removal.

               When DHS exercises its authority to waive the 3 percent refusal
               rate requirement, it shall, in consultation with State, take into
               account other discretionary factors, pursuant to the 9/11 Act,
               including a country's airport security standards; whether the
               country assists in the operation of an effective air marshal
               program; the standards of passports and travel documents issued by
               the country; and other security-related factors, including the
               country's cooperation with (1) the United States' initiatives
               toward combating terrorism and (2) the U.S. intelligence community
               in sharing information regarding terrorist threats. DHS works in
               consultation with State and Justice, as well as the intelligence
               community, as part of DHS's assessment of countries seeking to
               join the Visa Waiver Program.

               The executive branch is moving aggressively to expand the Visa
               Waiver Program by the end of 2008, but, in doing so, DHS has not
               followed a transparent process for admitting new countries to the
               program--an approach that has created confusion among other U.S.
               agencies in Washington, D.C.; U.S. embassy officials overseas; and
               those countries that are seeking to join the Visa Waiver Program.
               During the expansion negotiations, DHS has achieved some security
               enhancements, such as new agreements that, among other things,
               require the reporting of lost and stolen blank and issued
               passports.

               We found that the Visa Waiver Program Office has not followed its
               own standard operating procedures, completed in November 2007,
               which set forth the key milestones that DHS and aspiring countries
               must meet before additional countries are admitted into the
               program.^14 According to the standard procedures, State should
               submit to DHS a formal, written nomination for a particular
               country, after which DHS is to lead an interagency team to conduct
               an in-country, comprehensive review of the impact of the country's
               admission into the Visa Waiver Program on U.S. security, law
               enforcement, and immigration interests. Figure 1 depicts the
               standard procedures that the program office established to guide
               expansion of the Visa Waiver Program compared with DHS's actions
               since August 2007. Although State has only nominated one
               country--Greece--DHS has nonetheless conducted security reviews
               for countries that State has not yet nominated--Czech Republic,
               Estonia, Hungary, Latvia, Lithuania, Slovakia, and South Korea.
               According to State officials, until DHS has implemented the
               required provisions of the 9/11 Act, and aspiring countries have
               met all of the Visa Waiver Program's statutory requirements, State
               does not plan to nominate any other countries. DHS's Assistant
               Secretary for Policy Development told us that the department had
               determined that it would not follow the standard operating
               procedures during these expansion negotiations and, thus, had to
               "make up the process as it went along," in part because DHS had
               never expanded the program before and because Congress
               significantly changed the program's legislative requirements in
               August 2007.

    ^10Section 711 of the 9/11 Act specifically grants DHS the authority to
    waive the 3 percent refusal rate requirement for countries--currently up
    to a maximum of 10 percent--provided those countries meet other security
    requirements.

    ^11This form is CBP's I-94W Nonimmigrant Visa Waiver Arrival/Departure
    Form. According to DHS, the department is coordinating with commercial
    aircraft and vessel carriers on the development and implementation of
    messaging capabilities that will enable CBP to provide the carriers with
    messages pertaining to a passenger's boarding status. Once ESTA is
    mandatory and all carriers are capable of receiving and validating
    messages from CBP pertaining to the traveler's ESTA status as part of
    their boarding status, DHS plans to eliminate the I-94W requirement.

    ^12ESTA authorizations will be valid for up to 2 years and will allow the
    individual to travel to the United States repeatedly within that period.
    In some circumstances, such as when a passport has expired or a traveler
    has changed his or her name, the traveler must apply for a new ESTA
    authorization.

    ^13In addition to receiving an authorization or rejection notice upon
    submitting an ESTA application, the applicant may also receive a response
    noting that the application is pending.

    Executive Branch Is Moving Quickly to Expand the Visa Waiver Program without a
    Transparent Process

    DHS Has Not Followed a Transparent Process for Visa Waiver Program Expansion

    ^14In 2006, we reported on the executive branch's process for admitting
    additional countries into the Visa Waiver Program. See GAO, Process for
    Admitting Additional Countries into the Visa Waiver Program,
    [26]GAO-06-835R (Washington, D.C.: July 26, 2006).

    Figure 1: Comparison of DHS's Process to Expand the Visa Waiver Program
    against the Standard Operating Procedures for Expansion

    State and Justice officials told us that the lack of a transparent
    timeline and requirements for Visa Waiver Program expansion has led to
    confusion among U.S. agencies in headquarters' offices and at U.S.
    embassies overseas, as well as foreign governments seeking to join the
    program. For example, DHS's standard procedures were not updated to
    account for the department's plans to sign with each of the aspiring Visa
    Waiver Program countries separate memorandums of understanding (MOU) that
    lay out the new legislative requirements from the 9/11 Act. According to
    DHS, while not required by the act, the U.S. government is seeking to
    negotiate MOUs with current and aspiring Visa Waiver Program countries to
    help put the legislative provisions in place. Although DHS has not yet
    signed MOUs with any current program countries, the department intends to
    complete negotiations with existing program countries by October 2009. As
    indicated in figure 1, DHS signed MOUs with aspiring countries before
    conducting in-country security reviews. The MOUs are to be accompanied by
    more specific "implementing arrangements" for sharing biographic,
    biometric, and other data, as required by the 9/11 Act, within general
    parameters of what the United States is willing and able to
    reciprocate--this includes sharing information on known or suspected
    terrorists. According to DHS, the type and scope of these arrangements
    will vary by country and will take into account existing bilateral
    information-sharing arrangements. As of June 2008, DHS had signed MOUs
    with eight Road Map countries and had begun negotiations on the
    implementing arrangements. However, State and Justice officials told us
    that DHS had not been clear in communicating these steps to aspiring and
    current program countries. DHS officials acknowledged that the department
    was still exploring how to best complete the implementing arrangements.
    U.S. embassy officials in several Road Map countries told us that it had
    been difficult to explain the expansion process to their foreign
    counterparts and manage their expectations about when those countries
    might be admitted into the Visa Waiver Program. Justice officials and U.S.
    officials in several embassies told us that the implementing arrangements
    may be more difficult to negotiate than the nonbinding MOUs because some
    countries have expressed concerns about sharing private information on
    their citizens due to strict national privacy laws--concerns that the
    United States also has about its citizens' information. In response to our
    request, in late April 2008, DHS provided us with an outline of the
    department's completed and remaining actions for expanding the Visa Waiver
    Program by the end of this year. DHS officials stated that this outline
    could be a first step in providing guidance for all stakeholders, should
    the program be expanded again in the future. However, the outline does not
    include criteria for selecting countries under consideration for admission
    into the program, other than the 13 Road Map countries.

    The U.S. government is only considering the Road Map countries for
    potential admission into the program in 2008 because the United States
    began formal discussions with these 13 countries several years ago, not
    due to the application of clearly defined requirements. DHS is negotiating
    with 4 Road Map countries with fiscal year 2007 refusal rates over 10
    percent (Hungary, Latvia, Lithuania, and Slovakia), with the expectation
    that fiscal year 2008 refusal rates for these countries will fall below 10
    percent. State officials told us that they lacked a clear rationale to
    explain to other aspiring, non-Road Map countries with refusal rates under
    10 percent (Croatia, Israel, and Taiwan) that they will not be considered
    in 2008 due to the executive branch's plans to expand the program first to
    South Korea and countries in Central and Eastern Europe. In addition, on
    May 1 of each year, State must report to Congress those countries that are
    under consideration for inclusion in the Visa Waiver Program; the
    department has never submitted this report because, according to consular
    officials, no country has been under consideration for admission into the
    program since the reporting requirement was established in 2000.^15 As of
    late June 2008, State had not yet submitted its report for 2008. A State
    official told us that, despite the actions that DHS, State, and other U.S.
    agencies have taken to expand the Visa Waiver Program to as many as 9
    countries in 2008, State was initially unclear about which countries it
    should include in this report. While only Greece has been nominated, DHS
    has made clear its goal to admit many of the Road Map countries in 2008.
    (Fig. 2 shows the fiscal year 2007 refusal rates for the 13 Road Map
    countries.)

    ^15State must report to the appropriate congressional committees on the
    total number of nationals of that country who applied for U.S. visas in
    that country during the previous calendar year; the total number of such
    nationals who received U.S. visas during the previous calendar year; the
    total number of such nationals who were refused U.S. visas during the
    previous calendar year, and, specifically, under which provision of the
    Immigration and Nationality Act they were refused; and the number of such
    nationals who were refused visas under section 214(b)of the Immigration
    and Nationality Act as a percentage of the visas that were issued to such
    nationals. In addition, not later than May 1 of each year, the U.S. chief
    of mission (acting or permanent) to each country under consideration for
    inclusion in the Visa Waiver Program, must certify to the appropriate
    congressional committees that the information described in the report is
    accurate, and must provide a copy of the certification to the
    congressional committees.

    Figure 2: Short-term Business and Tourism Visa Refusal Rates, by Country,
    Fiscal Year 2007

    Note: DHS may consider adding to the Visa Waiver Program aspiring
    countries with refusal rates below 3 percent in the prior fiscal year,
    without meeting the two certification requirements in the 9/11 Act.

    According to DHS, it could not wait until all statutory requirements were
    officially met before beginning bilateral negotiations with Road Map
    countries, because doing so would not allow sufficient time to add the
    countries by the end of 2008. DHS plans to complete the security reviews
    and sign MOUs and implementing arrangements with Road Map countries by the
    fall of 2008. If these and all other statutory provisions are
    completed--including countries' achievement of refusal rates below 10
    percent--State indicated that it will then formally nominate the
    countries. However, DHS has acknowledged that if it and the aspiring
    countries cannot meet all of the program's statutory requirements, the
    United States will not admit additional countries into the program. In
    such an event, the U.S. government could face political and diplomatic
    repercussions, given the expectations raised that many of the Road Map
    countries will be admitted in 2008. DHS, State, and Justice officials
    acknowledged that following a more transparent process would be useful in
    the future as additional countries seek to join the program.

    DHS Has Achieved Some Results in Visa Waiver Program Expansion Negotiations

    DHS's expansion negotiations with current and aspiring Visa Waiver Program
    countries have led to commitments from countries to improve information
    sharing processes with the United States. For example, by signing MOUs,
    eight aspiring countries have signaled their intent to comply with the
    program's statutory provision to report to the United States or Interpol
    in a timely manner the loss or theft of passports--a key vulnerability in
    the Visa Waiver Program, as we have previously reported.^16 In addition,
    as a result of ongoing visa waiver negotiations with the South Korean
    government, in January 2008, DHS initiated the Immigration Advisory
    Program at Incheon International Airport in South Korea to help prevent
    terrorists and other high-risk travelers from boarding commercial aircraft
    bound for the United States.^17 Furthermore, a senior consular official
    testified that the executive branch's dialogue on Visa Waiver Program
    expansion is helping to stimulate U.S. negotiations on other terrorist
    watch-list- sharing arrangements with Road Map countries.^18

    16 [27]GAO-06-854 .

    ^17According to CBP, the Immigration Advisory Program aims to enhance the
    safety of air travel by, among other things, reducing the number of
    improperly documented passengers traveling from or through a country to
    the United States. As of August 2008, the program operates in airports in
    Amsterdam, the Netherlands; Frankfurt, Germany; London, England (Heathrow
    Airport and Gatwick Airport); Manchester, England; Madrid, Spain; Seoul,
    South Korea; Tokyo, Japan; and Warsaw, Poland.

    DHS Has Not Fully Developed Tools Aimed at Assessing and Mitigating Risks in the
    Visa Waiver Program

    As of early September 2008, DHS had not yet met two key certification
    requirements in the 9/11 Act that are necessary to allow the department to
    consider expanding the Visa Waiver Program to countries with refusal rates
    between 3 percent and 10 percent. In addition, the Visa Waiver Program
    Office does not fully consider data on overstay rates for current and
    aspiring Visa Waiver Program countries, even though doing so is integral
    to meeting a statutory requirement for continued eligibility in the Visa
    Waiver Program. Finally, in reviewing recommendations from our 2006 report
    aimed at improving efforts to assess and mitigate program risks, we found
    that DHS has implemented many of our prior recommendations, but some are
    only partially implemented.

    DHS Has Not yet Implemented Key Security Provisions of 9/11 Act That Are
    Necessary to Admit Certain Countries into the Visa Waiver Program

    On February 28, 2008, we testified that DHS's plan for certifying that it
    can verify the departure of 97 percent of foreign nationals from U.S.
    airports will not help the department mitigate risks of the Visa Waiver
    Program.^19 Furthermore, DHS will face a number of challenges in
    implementing ESTA by January 2009. Finally, it is unlikely that DHS will
    implement a biometric air exit system before July 2009, due to opposition
    from the airline industry.

      Plan to Verify the Air Departure of Foreign Nationals Will Not Help DHS
      Mitigate Program Risks

    As we have previously mentioned, the 9/11 Act requires that DHS certify
    that a system is in place that can verify the departure of not less than
    97 percent of foreign nationals who depart through U.S. airports. In
    December 2007, DHS reported to us that it will match records, reported by
    airlines,^20 of visitors departing the country to the department's
    existing records of any prior arrivals, immigration status changes,^21 or
    prior departures from the United States. At the time of our February 2008
    testimony, DHS had confirmed that it planned to employ a methodology that
    begins with departure records. During the hearing, we also testified that
    this methodology will not demonstrate improvements in the air exit system
    and will not help the department mitigate risks of the Visa Waiver
    Program. We identified a number of weaknesses with this approach, as
    follows:

    ^18Homeland Security Presidential Directive-6 required the Secretary of
    State to develop a proposal for the President's approval for enhancing
    cooperation with certain foreign governments--beginning with those
    countries for which the United States has waived visa requirements--to
    establish appropriate access to the participating governments' terrorism
    screening information. State determined that the most effective way to
    obtain this information was to seek bilateral agreements to share
    information on a reciprocal basis. In May 2008, the Deputy Assistant
    Secretary of State for Visa Services testified that State anticipates
    completing these agreements with all of the Road Map countries by the end
    of September 2008. See, The White House, Homeland Security Presidential
    Directive/HSPD-6, Subject: Integration and Use of Screening Information
    (Washington, D.C.: Sept. 16, 2003).

    ^19GAO, Visa Waiver Program: Limitations with Department of Homeland
    Security's Plan to Verify Departure of Foreign Nationals, [28]GAO-08-458T
    (Washington, D.C.: Feb. 28, 2008).

               o First, DHS's methodology will not inform overall or
               country-specific overstay rates, which are key factors in
               determining illegal immigration risks in the Visa Waiver Program.
               In particular, DHS's methodology does not begin with arrival
               records to determine if those foreign nationals departed or
               remained in the United States beyond their authorized periods of
               admission--useful data for oversight of the Visa Waiver Program
               and its expansion. As we previously testified, an alternate
               approach would be to track air arrivals from a given point in time
               and determine whether those foreign nationals have potentially
               overstayed.^22 Figure 3 compares DHS's plan to match visitor
               records using departure data as a starting point with a
               methodology that would use arrival data as a starting point.

               Figure 3: DHS's Current Plan to Meet Air Exit System Provision
               Omits Those Who Remain in the United States

               o Second, for purposes of this provision and Visa Waiver Program
               expansion, we do not see the value in verifying that a foreign
               national leaving the United States had also departed at a prior
               point in time^23--in other words, matching a new departure record
               back to a previous departure record from the country.^24 DHS's
               Assistant Secretary for Policy Development told us in January 2008
               that the department chose to include previous departures and
               changes of immigration status records because this method allowed
               the department to achieve a match rate of 97 percent or greater.

               o Third, DHS's methodology does not address the accuracy of
               airlines' transmissions of departure records, and DHS acknowledges
               that there are weaknesses in the departure data. Foreign nationals
               who enter the United States by air are inspected by DHS
               officers--a process that provides information that can be used to
               verify arrival manifest data--and, since 2004, DHS has implemented
               the US-VISIT program to collect biometric information on foreign
               nationals arriving in the United States.^25 However, the
               department has not completed the exit portion of this tracking
               system; thus, there is no corresponding check on the accuracy and
               completeness of the departure manifest information supplied by the
               airlines.^26 According to DHS, it works with air carriers to try
               to improve both the timeliness and comprehensiveness of manifest
               records, and fines carriers that provide incomplete or inaccurate
               information. If DHS could evaluate these data, and validate the
               extent to which they are accurate and complete, the department
               would be able to identify problems and work with the airlines to
               further improve the data.

               An air exit system that facilitates the development of overstay
               rate data is important to managing potential risks in expanding
               the Visa Waiver Program. We found that DHS's planned methodology
               for meeting the "97 percent provision" so it can move forward with
               program expansion will not demonstrate improvements in the air
               exit system or help the department identify overstays or develop
               overstay rates. As of early September 2008, DHS had not yet
               certified this provision, nor had it finalized a methodology to
               meet the provision.

               In June 2008, DHS announced in the Federal Register that it
               anticipates that all visa waiver travelers will be required to
               obtain ESTA authorization for visa waiver travel to the United
               States after January 12, 2009. However, we identified four
               potential challenges that DHS may face in implementing ESTA,
               including a limited time frame to adequately inform U.S. embassies
               and the public and the significant impact that ESTA will have on
               the airline and travel industry.

               We have previously reported that visa waiver travelers pose
               inherent security and illegal immigration risks to the United
               States, since they (1) are not subject to the same degree of
               screening as travelers with visas and (2) are not interviewed by a
               consular officer before arriving at a U.S. port of entry.^27 In
               the 9/11 Act conference report,^28 Congress agreed on the need for
               significant security enhancements to the Visa Waiver Program and
               to the implementation of ESTA prior to permitting DHS to admit new
               countries into the program with refusal rates between 3 percent
               and 10 percent. According to DHS, ESTA will allow DHS to identify
               potential ineligible visa waiver travelers before they embark on a
               U.S.-bound carrier. DHS also stated that by recommending that
               travelers submit ESTA applications 72 hours in advance of their
               departure, CBP will have additional time to screen visa waiver
               travelers destined for the United States.

               DHS must follow several steps in implementing ESTA (see fig. 4).
               First, the 9/11 Act requires that DHS must certify both the 97
               percent air exit system and ESTA as fully operational before the
               department can consider expanding the Visa Waiver Program to
               countries with refusal rates between 3 percent and 10 percent. DHS
               has not announced when it plans to make this certification. DHS
               attorneys told us that the department could admit additional
               countries to the program once it provides this certification. In
               addition, according to DHS, the act provides that 60 days after
               the Secretary of Homeland Security publishes a final notice in the
               Federal Register of the ESTA requirement, each alien traveling
               under the Visa Waiver Program must use ESTA to electronically
               provide DHS with biographic and other such information as DHS
               deems necessary to determine, in advance of travel, the
               eligibility of, and whether there exists a law enforcement or
               security risk in permitting, the alien to travel to the United
               States.^29 DHS stated that it expects to issue this final notice
               in early November 2008, and, as of January 12, 2009, all visa
               waiver travelers would be required to obtain authorization through
               ESTA prior to boarding a U.S.-bound flight or cruise vessel. DHS
               stated that if, after certifying ESTA as fully operational, it
               admits an additional country prior to January 12, 2009, it will
               require that visa waiver travelers from that country obtain ESTA
               authorizations immediately. For example, if Estonia were admitted
               into the Visa Waiver Program on October 10, 2008, citizens of that
               country traveling to the United States under the program would be
               required to begin using ESTA on that date; however, visa waiver
               travelers from existing program countries would not be required to
               obtain approval through ESTA until January 12, 2009, more than 3
               months later.

    ^20Air carriers transmit visitor manifest information, which is obtained
    directly from government-issued passports, to CBP through the Advanced
    Passenger Information System. This system includes arrival and departure
    manifest information, such as name, date of birth, travel document issuing
    country, gender, U.S. destination address, entry date, and departure date.
    As of February 19, 2008, commercial carriers are required to transmit
    manifest information to be vetted by DHS prior to departure of the
    aircraft.

    ^21This includes changes and extensions of the visits of lawfully
    admitted, nonimmigrant foreign nationals.

    ^22This could include foreign nationals who departed after their
    authorized period of admission expired, as well as those foreign nationals
    who may have remained in the country as overstays.

    ^23According to ICE officials at DHS, this type of information provides a
    more complete history of an alien and is useful for law enforcement
    purposes, such as criminal prosecution and documenting activities.

    ^24A DHS official told us that the system functions by matching the
    departure record with an alien's "account," which may contain numerous
    prior arrivals, departures, and immigration benefit transaction records.
    The official also stated that a specific departure record match may not
    fall chronologically in the alien's account after an arrival; it may fall,
    for example, after a record that an immigrant benefit was granted to
    extend the alien's stay for an additional 6 months.

    ^25DHS's US-VISIT program collects, maintains, and shares data, including
    biometric identifiers like digital fingerprints, on selected foreign
    nationals entering the United States to verify their identities as they
    arrive at U.S. air, sea, and land ports of entry. DHS currently operates
    the entry portion of the US-VISIT program at more than 300 U.S. air, sea,
    and land ports of entry. When fully implemented, US-VISIT is also intended
    to capture the same information from foreign nationals as they depart the
    country. The program aims to, among other things, identify foreign
    nationals who have overstayed or violated the terms of their visit.

    ^26DHS has not implemented long-standing GAO recommendations to collect
    departure information and make new estimates of overstays by air. See GAO,
    Illegal Immigration: INS Overstay Estimation Methods Need Improvement,
    [29]GAO/PEMD-95-20 (Washington, D.C.: Sept. 26, 1995); and Illegal Aliens:
    Despite Data Limitations, Current Methods Provide Better Population
    Estimates, [30]GAO/PEMD-93-25 (Washington, D.C.: Aug. 3, 1993).

      DHS's Planned Implementation of ESTA by January 2009 Will Face Challenges

    ^27 [31]GAO-06-854 .

    ^28Conference Report on H.R. 1, Implementing Recommendations of the 9/11
    Commission Act of 2007 (July 25, 2007).

    ^29DHS attorneys stated that the department also hopes to certify ESTA as
    fully operational in early November. In addition, as we have previously
    mentioned, to consider admitting countries into the program with refusal
    rates between 3 percent and 10 percent, DHS must also certify that the air
    exit system is in place.

    Figure 4: DHS's Anticipated ESTA Implementation Timeline

    We identified four potential challenges to DHS's planned implementation of
    ESTA by January 12, 2009. It is difficult to predict the extent to which
    DHS will address these challenges due to the short time frame in which the
    department is implementing the system. These challenges include the
    following:

               o DHS has a limited time frame to adequately inform U.S. embassies
               in Visa Waiver Program countries and the public about ESTA. U.S.
               embassy officials in current and aspiring Visa Waiver Program
               countries told us that the United States will need to ensure that
               there is sufficient time to inform travelers, airlines, and the
               travel industry of ESTA requirements and implementation timelines.
               U.S. commercial and consular officials at a U.S. embassy in a
               current Visa Waiver Program country told us that they would
               ideally like 1 year's advance notice before ESTA is implemented to
               allow sufficient time to inform and train the public and the
               travel industry of the new requirement. However, DHS's
               announcement in June 2008 accelerated the timeline for ESTA
               implementation in current visa waiver countries. During our site
               visits in March 2008, U.S. embassy officials in a visa waiver
               country told us that they had been informed by DHS officials that
               the department did not plan to require ESTA authorization for
               travelers from that country until the summer of 2009 or later.
               According to a senior U.S. official at one embassy, DHS had
               confirmed this plan with host country government officials in
               early May 2008. Following the June 2008 announcement, a senior
               U.S. embassy official in another country told us that DHS did not
               give the embassy adequate advance notice--to prepare translated
               materials, brief journalists from the major media, prepare the
               embassy Web site, or set up a meeting with travel and tourism
               professionals to discuss the implications of ESTA
               requirements--before publishing the interim final rule. DHS
               officials told us that the department is currently working on an
               outreach strategy to ensure that travelers are aware of the ESTA
               requirement.

               o Impact on air and sea carriers could be significant. DHS
               estimates that 8 U.S.-based air carriers and 11 sea carriers, as
               well as 35 foreign-based air carriers and 5 sea carriers, will be
               affected by ESTA requirements for visa waiver travelers. In
               addition, DHS stated that it did not know how many passengers
               annually would request that their carrier apply for ESTA
               authorization on their behalf to travel under the Visa Waiver
               Program or how much it will cost carriers to modify their existing
               systems to accommodate such requests. Thus, in the short term, DHS
               expects that the carriers could face a notable burden if most of
               their non-U.S. passengers request that their carriers submit ESTA
               applications. On the basis of DHS's analysis, ESTA could cost the
               carriers about $137 million to $1.1 billion over the next 10
               years, depending on how the carriers decide to assist the
               passengers. DHS has noted that these costs to carriers are not
               compulsory because the carriers are not required to apply for an
               ESTA authorization on behalf of their visa waiver travelers. DHS
               is developing a separate system, independent from ESTA, which will
               enable the travel industry to voluntarily submit an ESTA
               application on behalf of a potential Visa Waiver Program traveler.
               As of early August 2008, DHS had analyzed the role that
               transportation carriers could play in applying for and submitting
               ESTA applications on behalf of their customers when they arrive at
               an air or sea port. However, CBP stated that there had been no
               further development on this issue.

               o ESTA could increase consular workload. In May 2008, we reported
               that State officials and officials at U.S. embassies in current
               Visa Waiver Program countries are concerned with how ESTA
               implementation will affect consular workload.^30 Consular officers
               are concerned that more travelers will apply for visas at consular
               posts if their ESTA applications are rejected or because they may
               choose to apply for a visa that has a longer validity period (10
               years) than an ESTA authorization. We reported that if 1 percent
               to 3 percent of current Visa Waiver Program travelers came to U.S.
               embassies for visas, it could greatly increase visa demand at some
               locations, which could significantly disrupt visa operations and
               possibly overwhelm current staffing and facilities.^31 DHS
               officials told us that the department is aware of concerns
               regarding rejection rates and has been working with State to
               create a system that mitigates these concerns.

               o Developing a user-friendly ESTA could be difficult. According to
               DHS, the ESTA Web site will initially be operational in English;
               additional languages will be available by October 15, 2008. Even
               when the Web site is operational in additional languages, ESTA
               will only allow travelers to fill out the application in English,
               as with CBP's paper-based form. In addition, during our site
               visits, embassy officials expressed concerns that some Visa Waiver
               Program travelers do not have Internet access and, thus, will face
               difficulties in submitting their information to ESTA.^32
               Implementing a user-friendly ESTA is essential, especially for
               those travelers who do not have Internet access or are not
               familiar with submitting forms online.

               A third provision of the 9/11 Act requires that DHS implement a
               biometric air exit system before July 1, 2009, or else the
               department's authority to waive the 3 percent refusal rate
               requirement--and thereby consider admitting countries with refusal
               rates between 3 percent and 10 percent--will be suspended until
               this system is in place. In March 2008, DHS testified that
               US-VISIT will begin deploying biometric exit procedures in fiscal
               year 2009. DHS released a proposed rule for the biometric exit
               system in April 2008, and the department plans to issue a final
               rule before the end of 2008. According to the proposed rule, air
               and sea carriers are to collect, store, and transmit to DHS
               travelers' biometrics. During the public comment period on the
               proposed rule, airlines, Members of Congress, and other
               stakeholders have raised concerns about DHS's proposal, and
               resolving these concerns could take considerable time. For
               example, the airline industry strongly opposes DHS's plans to
               require airline personnel to collect digital fingerprints of
               travelers departing the United States because it believes it is a
               public sector function. We have issued a series of reports on the
               US-VISIT program indicating that there is no clear schedule for
               implementation of the exit portion of the system, and that DHS
               will encounter difficulties in implementing the system by July
               2009.^33 Although DHS program officials stated that DHS is on
               track to implement the biometric exit system by July 2009, it is
               unlikely that DHS will meet this timeline. We are currently
               reviewing DHS's proposed rule and plan to report later this year
               on our findings.

               Some DHS components have expanded efforts to identify citizens who
               enter the United States under the Visa Waiver Program and then
               overstay their authorized period of admission. In 2004, US-VISIT
               established the Data Integrity Group, which develops data on
               potential overstays by comparing foreign nationals' arrival
               records with departure records from U.S. airports and sea ports.
               US-VISIT provides data on potential overstays to ICE, CBP, and
               U.S. Citizenship and Immigration Services, as well as to State's
               consular officers to aid in visa adjudication. For example,
               US-VISIT sends regular reports to ICE's Compliance Enforcement
               Unit on potential overstays, and ICE officials told us they use
               these data regularly during investigations. In fiscal year 2007,
               ICE's Compliance Enforcement Unit received more than 12,300
               overstay leads from the Data Integrity Group.^34 As an example of
               one of these leads, on November 27, 2007, ICE agents in Ventura,
               California, arrested and processed for removal from the United
               States an Irish citizen whose term of admission expired in
               September 2006. On the basis of concerns that Visa Waiver Program
               travelers could be overstaying, ICE has requested that US-VISIT
               place additional emphasis on identifying potential overstays from
               program countries. In turn, ICE has received funding to establish
               a Visa Waiver Enforcement Program within the Compliance
               Enforcement Unit to investigate the additional leads from
               US-VISIT. As part of this funding, ICE plans to hire 46 additional
               employees to help the unit increase its focus on identifying
               individuals who traveled to the United States under the Visa
               Waiver Program and potentially overstayed.

               However, DHS is not fully monitoring compliance with a legislative
               provision that requires a disqualification rate (this calculation
               includes overstays) of less than 3.5 percent for a country to
               participate in the Visa Waiver Program.^35 Monitoring these data
               is a long-standing statutory requirement for the program. We have
               testified that the inability of the U.S. government to track the
               status of visitors in the country, identify those who overstay
               their authorized period of visit, and use these data to compute
               overstay rates has been a long-standing weakness in the oversight
               of the Visa Waiver Program.^36 DHS's Visa Waiver Program Office
               reported that it does not monitor country overstay rates as part
               of its mandated, biennial assessment process for current visa
               waiver countries because of weaknesses in US-VISIT's data.^37

               Since 2004, however, the Data Integrity Group has worked to
               improve the accuracy of US-VISIT's overstay data and can undertake
               additional analyses to further validate these data. For example,
               using available resources, the group conducts analyses, by hand,
               of computer-generated overstay records to determine whether
               individuals identified as overstays by the computer matches are
               indeed overstays. In addition, US-VISIT analysts can search up to
               12 additional law enforcement and immigration databases to verify
               whether a potential overstay may, in fact, be in the country
               illegally. While it receives periodic reporting on potential
               overstays from US-VISIT, the Visa Waiver Program Office has not
               requested that the Data Integrity Group provide validated overstay
               rate estimates from visa waiver or Road Map countries since 2005.
               Although DHS has not designated an office with the responsibility
               of developing such data for the purposes of the Visa Waiver
               Program, US-VISIT officials told us that, with the appropriate
               resources, they could provide more reliable overstay data and
               estimated rates, by country, to the Visa Waiver Program Office,
               with support from other DHS components, such as the Office of
               Immigration Statistics. For example, the Visa Waiver Program
               Office could request additional analysis for countries where the
               preliminary, computer-generated overstay rates raised concerns
               about illegal immigration risks in the program. These resulting
               estimates would be substantially more accurate than the
               computer-generated overstay rates. However, the resulting
               estimates would not include data on departures at land ports of
               entry. In addition, as we have previously mentioned, airline
               departure data have weaknesses.^38 DHS has asserted that overstay
               data will continue to improve with the implementation of the
               biometric US-VISIT exit program.

               In addition to US-VISIT, State's overseas consular sections
               develop data on overstay rates that might be useful for assessing
               potential illegal immigration risks of the Visa Waiver Program.
               Specifically, some consular sections have conducted validation
               studies to determine what percentage of visa holders travel to the
               United States and potentially overstay. For example, at the U.S.
               embassy in Estonia, consular officials conducted a validation
               study in the summer of 2006 that concluded that 2.0 percent to 2.7
               percent of Estonian visa holders traveling to the United States in
               2005 had potentially overstayed.^39 US-VISIT overstay data, after
               appropriate analysis and in conjunction with other available data,
               such as validation studies, would provide DHS with key information
               to help evaluate the illegal immigration risks of maintaining a
               country's membership or admitting additional countries into the
               Visa Waiver Program.

               In July 2006, we reported that the process for assessing and
               mitigating risks in the Visa Waiver Program had weaknesses, and
               that DHS was not equipped with sufficient resources to effectively
               monitor the program's risks.^40 For example, at the time of our
               report, DHS had only two full-time staff charged with monitoring
               countries' compliance with the program's requirements and working
               with countries seeking to join the program. We identified several
               problems with the process by which DHS was monitoring countries'
               adherence to the program requirements, including a lack of
               consultation with key interagency stakeholders. In addition, we
               reported that DHS needed to improve its communication with
               officials at U.S. embassies so it could communicate directly with
               officials best positioned to monitor compliance with the program's
               requirements, and report on current events and issues of potential
               concern in each of the participating countries. Also, at the time
               of our 2006 report, the law required the timely reporting of
               passport thefts for continued participation in the Visa Waiver
               Program, but DHS had not established or communicated these time
               frames and operating procedures to participating countries. In
               addition, DHS had not yet issued guidance on what information must
               be shared, with whom, and within what time frame.

               To address these weaknesses, we recommended that DHS take a number
               of actions to better assess and mitigate risks in the Visa Waiver
               Program. As we note in table 1, DHS has taken actions to implement
               some of our recommendations, but still needs to fully implement
               others. In particular, DHS has provided the Visa Waiver Program
               Office with additional resources since our 2006 report. As of
               April 2008, the office had five additional full-time employees,
               and two other staff from the Office of Policy that devote at least
               50 percent of their time to Visa Waiver Program tasks. In
               addition, staff from several other DHS components assists the
               office on a regular basis, as well as during the in-country
               security assessments for Road Map and current program countries.
               In response to our recommendation to finalize clear, consistent,
               and transparent protocols for the biennial country assessment, the
               Visa Waiver Program Office drafted standard operating procedures
               in November 2007 for conducting reviews of nominated and
               participating visa waiver countries. In addition, DHS now provides
               relevant stakeholders with copies of the most current mandated,
               biennial country assessments; during our visits in early 2008,
               U.S. embassy officials confirmed that the assessments are now
               accessible. Furthermore, regarding our recommendation to develop
               and communicate clear, standard operating procedures for the
               reporting of lost and stolen blank and issued passports, DHS
               established criteria for the reporting of lost and stolen passport
               data--including a definition of "timely reporting" and an
               explanation of to whom in the U.S. government countries should
               report--as part of the MOUs it is negotiating with participating
               and Road Map countries.

    ^30GAO, Border Security: State Department Should Plan for Potentially
    Significant Staffing and Facilities Shortfalls Caused by Changes in the
    Visa Waiver Program, [32]GAO-08-623 (Washington, D.C.: May 22, 2008).

      Implementation of Biometric Air Exit System before July 2009 Will Be Difficult

    ^31As of May 2008, DHS had provided State with preliminary data that
    suggest how many names might be rejected by ESTA, on the basis of
    rejection rates from CBP's Advance Passenger Information System; however,
    we found that DHS had not developed any estimates of the number of people
    who would choose to proactively apply for visas rather than submit an
    application to ESTA. According to consular officials, the percentage of
    travelers who choose to obtain a visa could exceed potential ESTA
    rejection rates of 1 percent to 3 percent. See [33]GAO-08-623 .

    ^32According to DHS, ESTA is designed to allow third parties to file
    applications on behalf of other persons.

    DHS Does Not Fully Consider Overstay Rates to Assess the Illegal Immigration
    Risks of the Visa Waiver Program

    ^33GAO, Homeland Security: Prospects For Biometric US-VISIT Exit
    Capability Remain Unclear, [34]GAO-07-1044T (Washington, D.C.: June 28,
    2007); Border Security: US-VISIT Program Faces Strategic, Operational, and
    Technological Challenges at Land Ports of Entry, [35]GAO-07-248
    (Washington, D.C.: Dec. 6, 2006).

    ^34In June 2003, ICE's Office of Investigations established the Compliance
    Enforcement Unit, which focuses on preventing criminals and terrorists
    from exploiting the nation's immigration system by developing cases for
    investigation on the basis of information provided from other DHS
    components, including US-VISIT.

    ^35The disqualification rate is the total for a given fiscal year of (1)
    those nationals of the country who were admitted as nonimmigrants and
    violated the terms of their admission--this would include overstays--and
    (2) the number of foreign nationals who were denied admission upon arrival
    in the United States, compared with the total number of nationals of that
    country who applied for admission as nonimmigrant visitors during the same
    period. According to the visa waiver statute, the country must be
    terminated at the beginning of the 2d fiscal year following the fiscal
    year in which the determination of the disqualification rate was made. See
    8 U.S.C. S 1187(f).

    ^36For more than 10 years, we have recommended the collection of departure
    information and the development of estimates of overstays by air. See
    [36]GAO/PEMD-93-25 and [37]GAO/PEMD-95-20 .

    ^37According to DHS officials, the mandated country assessments include a
    placeholder for data on overstay rates, but these data are not included in
    the 2003-2004 or 2005-2006 assessments. The May 2002 Enhanced Border
    Security and Visa Entry Reform Act increased the frequency--from once
    every 5 years to once every 2 years--of mandated assessments of the effect
    of each country's continued participation in the Visa Waiver Program on
    U.S. security, law enforcement, and immigration interests. See Pub. L. No.
    107-173.

    ^38Due to limitations in DHS's data, U.S. VISIT officials also noted that
    some individuals who appear in DHS's systems as being in-country legally
    may actually be overstays, and that country-specific information is not
    available for about 2 percent of records.

    ^39Validation studies are traditionally conducted over the telephone, with
    the embassy contacting nationals who traveled to the United States.
    According to a State consular official, 200 posts have access to DHS's
    Automated Departure Information System database. This database contains
    records of foreign nationals' arrival and departure data received from air
    and sea carrier manifests. DHS's data will assist embassies in conducting
    validation studies and may preclude the need for telephone calls to
    foreign nationals, while also improving the accuracy of departure data
    assessed for these studies. Access to these records will allow consular
    posts to more accurately determine whether a foreign national departed the
    United States.

    DHS Has Implemented Many of GAO's Prior Recommendations Aimed at Improving
    Efforts to Assess and Mitigate Risks in the Visa Waiver Program

    ^40 [38]GAO-06-854 .

    Table 1: Status of Prior GAO Recommendations

                                                           Partially
    Recommendation                     Not implemented implemented Implemented
    Provide additional resources to                                     X
    strengthen the Visa Waiver Program
    Office.
    Finalize clear, consistent, and                                     X
    transparent protocols for the
    biennial country assessments and
    provide these protocols to
    stakeholders at relevant agencies
    at headquarters and overseas.
    These protocols should provide
    timelines for the entire
    assessment process, including the
    role of a site visit, an
    explanation of the clearance
    process, and deadlines for
    completion.
    Create real-time monitoring                             X
    arrangements, including the
    identification of visa-waiver
    points of contact at U.S.
    embassies, for all 27
    participating countries; and
    establish protocols, in
    coordination with the appropriate
    headquarters offices, for direct
    communication between points of
    contact at overseas posts and
    DHS's Visa Waiver Program Office.
    Require periodic updates from                           X
    points of contact at posts in
    countries where there are law
    enforcement or security concerns
    relevant to the Visa Waiver
    Program.
    Provide complete copies of the                                      X
    most recent country assessments to
    relevant stakeholders in
    headquarters and overseas posts.
    Require that all Visa Waiver                            X
    Program countries provide the
    United States and Interpol with
    nonbiographical data from lost or
    stolen blank and issued passports.
    Develop and communicate clear                                       X
    standard operating procedures for
    the reporting of lost and stolen
    blank and issued passports,
    including a definition of "timely
    reporting" and to whom in the U.S.
    government countries should
    report.
    Develop and implement a plan to                                     X
    make Interpol's stolen travel
    document database automatically
    available during primary
    inspection at U.S. ports of entry.

    Sources: GAO analysis of DHS data and GAO, Border Security: Stronger
    Actions Needed to Assess  and Mitigate Risks of the Visa Waiver Program,
    [39]GAO-06-854 (Washington, D.C.: July 28, 2006).

    Furthermore, DHS, in coordination with the U.S. National Central Bureau,
    has initiated a system that allows DHS to screen foreign nationals
    arriving at all U.S. international airports against Interpol's database of
    lost and stolen travel documents before the foreign nationals arrive in
    the country. Results to date indicate that the system identifies two to
    three instances of fraudulent passports per month. According to the
    National Central Bureau, Interpol's database has intercepted passports
    that were not identified by DHS's other screening systems. For example, on
    February 18, 2008, the Interpol database identified a Nigerian national
    traveling on a counterfeited British passport who attempted to enter the
    United States at Newark International Airport. Upon arrival, the
    individual was referred to secondary inspection and determined to be
    inadmissible to the United States.

    While DHS has taken action on many of our recommendations, it has not
    fully implemented others. We recommended that DHS require that all Visa
    Waiver Program countries provide the United States and Interpol with
    nonbiographical data from lost or stolen blank and issued passports.
    According to DHS, all current and aspiring visa waiver countries report
    lost and stolen passport information to Interpol, and many report such
    information to the United States. The 9/11 Act requires agreements between
    the United States and Visa Waiver Program countries on the reporting of
    lost and stolen passports within strict time limits; however, none of the
    current visa waiver countries have yet to formally establish lost and
    stolen passport reporting agreements by signing MOUs with DHS. DHS also
    still needs to fully implement our recommendations to create real-time
    monitoring arrangements, establish protocols for direct communication with
    contacts at overseas posts, and require periodic updates from these
    contacts. For example, while the Visa Waiver Program Office has recently
    begun communicating and disseminating relevant program information
    regularly with U.S. embassy points of contact at Visa Waiver Program
    posts, officials at some of the posts we visited in early 2008 reported
    that they had little contact with the office and were not regularly
    informed of security concerns or developments surrounding the program.

    Conclusions

    The executive branch is moving aggressively to expand the Visa Waiver
    Program in 2008 to allies in Central and Eastern Europe and South Korea,
    after the countries have met certain requirements and DHS has completed
    and certified key security requirements in the 9/11 Act. However, DHS has
    not followed a transparent process for expanding the program, thereby
    causing confusion among other U.S. agencies and embassies overseas. The
    lack of a clear process could bring about political repercussions if
    countries are not admitted to the program in 2008, as expected. In
    addition, DHS is not fully assessing a critical illegal immigration risk
    of the Visa Waiver Program and its expansion since it does not consider
    overstay data in its security assessments of current and aspiring
    countries. DHS should determine what additional data and refinements of
    that data are necessary to ensure that it can assess and mitigate this
    potential risk to the United States. Finally, DHS still needs to take
    actions to fully implement our prior recommendations in light of plans to
    expand the program.

    Recommendations for Executive Action

    To improve management of the Visa Waiver Program and better assess and
    mitigate risks associated with it, we are recommending that the Secretary
    of Homeland Security take the following four actions:

               o establish a clear process, in coordination with the Departments
               of State and Justice, for program expansion that would include the
               criteria used to determine which countries will be considered for
               expansion and timelines for nominating countries, security
               assessments of aspiring countries, and negotiation of any
               bilateral agreements to implement the program's legislative
               requirements;

               o designate an office with responsibility for developing overstay
               rate information for the purposes of monitoring countries'
               compliance with the statutory requirements of the Visa Waiver
               Program;

               o direct that established office and other appropriate DHS
               components to explore cost-effective actions necessary to further
               improve, validate, and test the reliability of overstay data; and

               o direct the Visa Waiver Program Office to request an updated,
               validated study of estimated overstay rates for current and
               aspiring Visa Waiver Program countries, and determine the extent
               to which additional research and validation of these data are
               required to help evaluate whether particular countries pose a
               potential illegal immigration risk to the United States.

               We provided a draft of this report to DHS, State, and Justice for
               review and comment. DHS provided written comments, which are
               reproduced in appendix IV, and technical comments, which we
               incorporated into the report, as appropriate. Justice also
               provided written comments, which are reprinted in appendix V.
               State did not provide comments on the draft report.

               DHS either agreed with, or stated that it was taking steps to
               implement, all of our recommendations. For example, DHS indicated
               that it is working with State to create procedures so that future
               Visa Waiver Program candidate countries are selected and
               designated in as transparent and uniform a manner as possible. In
               addition, DHS noted that it is taking steps to improve the
               accuracy and reliability of the department's overstay data. DHS
               also provided additional details about its continued outreach
               efforts to the department's interagency partners and foreign
               counterparts on the expansion process for the Visa Waiver Program.
               Justice did not comment on our recommendations, but provided
               additional information about the importance of monitoring
               countries' reporting of lost and stolen passport data to Interpol.
               In addition, Justice discussed its efforts, in collaboration with
               DHS, to include screening against Interpol's lost and stolen
               passport database as part of ESTA. Justice noted that use of
               Interpol's database continues to demonstrate significant results
               in preventing the misuse of passports to fraudulently enter the
               United States.

               We are sending copies of this report to interested congressional
               committees, the Secretaries of Homeland Security and State, and
               the U.S. Attorney General. Copies of this report will be made
               available to others upon request. In addition, this report is
               available at no charge on the GAO Web site at http://www.gao.gov.

               If you or your staffs have any questions about this report, please
               contact Jess T. Ford, Director, International Affairs and Trade,
               at (202) 512-4128 or fordj@gao.gov. Contact points for our Offices
               of Congressional Relations and Public Affairs may be found on the
               last page of this report. Key contributors to this report are
               listed in appendix VI.

               Jess T. Ford Director, International Affairs and Trade

               To describe the process that the Department of Homeland Security
               (DHS) is following to admit countries into the Visa Waiver
               Program, we reviewed laws governing the program and its expansion,
               and relevant regulations and agency operating procedures, as well
               as our prior reports and testimonies. In particular, we reviewed
               DHS's standard operating procedures for oversight and expansion of
               the Visa Waiver Program. We spoke with officials from the Visa
               Waiver Program Office, which is responsible for oversight of Visa
               Waiver Program requirements, as well as representatives from the
               Department of State's (State) Consular Affairs, Europe and
               Eurasia, and East Asia and Pacific Bureaus. In addition, we
               visited U.S. embassies in three current visa waiver
               countries--France, Japan, and the United Kingdom--whose nationals
               comprise a large percentage annually of visa waiver travelers to
               the United States. We also visited U.S. embassies in four
               countries--Czech Republic, Estonia, Greece, and South Korea--with
               which DHS is negotiating visa waiver status. During these visits,
               we interviewed political, economic, consular, commercial, and law
               enforcement officials regarding oversight of the Visa Waiver
               Program and its expansion. We also conducted telephone interviews
               with consular officials in four additional countries--Hungary,
               Latvia, Lithuania, and Slovakia--that DHS also aims to admit into
               the Visa Waiver Program in 2008. We did not interview officials in
               Bulgaria, Poland, or Romania because DHS told us that it does not
               anticipate that these countries will be admitted into the program
               in 2008. We did not interview officials in Malta because of the
               country's relatively small number of annual Visa Waiver Program
               travelers to the United States.

               To assess actions taken to mitigate potential risks in the Visa
               Waiver Program, we focused on DHS's efforts to implement the new
               security enhancements required by the 9/11 Act, as well as the
               recommendations from our July 2006 report.^1 First, to review the
               department's plans for air exit system implementation, we
               collected and analyzed documentation and interviewed officials
               from DHS's Office of Policy, Customs and Border Protection (CBP),
               and the U.S. Visitor and Immigrant Status and Indicator Technology
               (US-VISIT) Program Office. We also reviewed prior GAO reports on
               immigrant and visitor entry and exit tracking systems.

               Second, to analyze plans for the implementation of the Electronic
               System for Travel Authorization (ESTA), we collected and analyzed
               documentation and interviewed officials from DHS's Offices of
               Policy, Screening Coordination, and General Counsel, as well as
               CBP officials who are implementing the Web-based program. In
               addition, to understand DHS's legal position regarding the
               statutory requirements for ESTA implementation, on May 5, 2008, we
               requested, in writing, DHS's legal position on certain ESTA
               statutory requirements, which the department provided to us on
               June 6, 2008.

               Third, regarding DHS's efforts to monitor citizens who enter the
               United States under the Visa Waiver Program and then overstay
               their authorized period of admission (referred to as "overstays"),
               we assessed the reliability of the US-VISIT data on potential
               overstays, which are based on air and sea carriers' arrival and
               departure data. We reviewed documentation and interviewed
               cognizant U.S. VISIT officials about how data on potential
               overstays are generated and validated. As we have previously
               mentioned, we determined that data on potential overstays that are
               generated automatically by US-VISIT's systems have major
               limitations; however, many of these limitations could be overcome
               by a series of manual checks and validations that US-VISIT can
               perform, upon request.

               Fourth, to determine the status of our prior recommendations to
               DHS on oversight of the Visa Waiver Program, we developed a scale
               to classify them as (1) implemented, (2) partially implemented, or
               (3) not implemented. We collected and analyzed documentation and
               interviewed officials from DHS's Visa Waiver Program Office on the
               actions that office has taken since July 2006 to respond to our
               recommendations. In addition, we met with International Criminal
               Police Organization (Interpol) officials in Lyon, France, as well
               as officials from the Department of Justice's Interpol-U.S.
               National Central Bureau to discuss the status of DHS's access to
               Interpol's database of lost and stolen travel documents. We
               concluded that a recommendation was (1) "implemented," if the
               evidence indicated that DHS had taken a series of actions
               addressing the recommendation; (2) "partially implemented," if the
               evidence indicated that DHS had taken some action toward
               implementation; and (3) "not implemented," if the evidence
               indicated that DHS had not taken any action.

               We conducted this performance audit from September 2007 to
               September 2008 in accordance with generally accepted government
               auditing standards. Those standards require that we plan and
               perform the audit to obtain sufficient, appropriate evidence to
               provide a reasonable basis for our findings and conclusions based
               on our audit objectives. We believe that the evidence obtained
               provides a reasonable basis for our findings and conclusions based
               on our audit objectives.

               The Visa Waiver Program nonimmigrant visa refusal rate is based on
               the number of visitor visa applications submitted, worldwide, by
               nationals of that country. Visitor visas are issued for short-term
               business or pleasure travel to the United States. The adjusted
               refusal rate is calculated by first subtracting from the number of
               visas that were initially refused (referred to as "refusals"), the
               number of visas that were subsequently issued after further
               administrative consideration (referred to as "overcomes")--or, in
               short, refusals minus overcomes (see table 2). This resulting
               number is then divided by the number of visa issuances plus
               refusals minus overcomes--that is, refusals minus overcomes
               divided by issuances plus refusals minus overcomes. Adjusted visa
               refusal rates for nationals of Visa Waiver Program countries
               reflect only visa applications submitted at U.S. embassies and
               consulates abroad. These rates do not take into account persons
               who, under the Visa Waiver Program, travel to the United States
               without visas. Visa Waiver Program country refusal rates,
               therefore, tend to be higher than they would be if the Visa Waiver
               Program travelers were included in the calculation, since such
               travelers in all likelihood would have been issued visas had they
               applied, according to State. We are presenting these data to show
               that the countries under consideration for Visa Waiver Program
               admission do not all have refusal rates of less than 10 percent;
               we did not assess the reliability of these data.

               Table 2: Worldwide Refusal Rates for Short-term Business and
               Tourism Visas, Fiscal Year 2007

               Source: Department of State.

               ^aIncludes applications for both B visas and combination
               B-1/B-2/Mexican Border Crossing Cards.

               The Immigration Reform and Control Act of 1986 created the Visa
               Waiver Program as a pilot program.^1 In 2000, the program became
               permanent under the Visa Waiver Permanent Program Act.^2 In 2002,
               we reported on the legislative requirements to which countries
               must adhere before they are eligible for inclusion in the Visa
               Waiver Program.^3 In general, the requirements are as follows:

               o A low nonimmigrant visa refusal rate. To qualify for visa waiver
               status, a country must maintain a refusal rate of less than 3
               percent for its citizens who apply for business and tourism visas.
               If DHS certifies that it has met certain requirements under the
               9/11 Act, it will have the authority to waive the 3 percent
               refusal rate requirement--currently up to a maximum of 10
               percent--provided that the country meets other security
               requirements.

               o A machine-readable passport program. The country must certify
               that it issues machine-readable passports to its citizens. As of
               June 26, 2005, all travelers are required to have a
               machine-readable passport to enter the United States under this
               program.

               o Reciprocity. The country must offer visa-free travel for U.S.
               citizens.

               Persons entering the United States under the Visa Waiver Program
               must

               o have a valid passport issued by the participating country and be
               a national of that country;^4

               o be seeking entry for 90 days or less as a temporary visitor for
               business or tourism;

               o have been determined by CBP at the U.S. port of entry to
               represent no threat to the welfare, health, safety, or security of
               the United States;
               o have complied with conditions of any previous admission under
               the program (e.g., individuals must have stayed in the United
               States for 90 days or less during prior visa waiver visits);

               o if entering by air or sea, possess a round-trip transportation
               ticket issued by a carrier that has signed an agreement with the
               U.S. government to participate in the program, and must have
               arrived in the United States aboard such a carrier; and

               o if entering by land, have proof of financial solvency and a
               domicile abroad to which they intend to return.

               Following are GAO's comments on the Department of Homeland
               Security's letter dated August 27, 2008.

               Jess T. Ford, (202) 512-4128, or fordj@gao.gov

               In addition to the individual named above, John Brummet, Assistant
               Director; Teresa Abruzzo; Kathryn Bernet; Joseph Carney; Martin de
               Alteriis; Etana Finkler; Eric Larson; and Mary Moutsos made key
               contributions to this report.

               The Government Accountability Office, the audit, evaluation, and
               investigative arm of Congress, exists to support Congress in
               meeting its constitutional responsibilities and to help improve
               the performance and accountability of the federal government for
               the American people. GAO examines the use of public funds;
               evaluates federal programs and policies; and provides analyses,
               recommendations, and other assistance to help Congress make
               informed oversight, policy, and funding decisions. GAO's
               commitment to good government is reflected in its core values of
               accountability, integrity, and reliability.

               The fastest and easiest way to obtain copies of GAO documents at
               no cost is through GAO's Web site ( [40]www.gao.gov ). Each
               weekday, GAO posts newly released reports, testimony, and
               correspondence on its Web site. To have GAO e-mail you a list of
               newly posted products every afternoon, go to [41]www.gao.gov and
               select "E-mail Updates."

               The first copy of each printed report is free. Additional copies
               are $2 each. A check or money order should be made out to the
               Superintendent of Documents. GAO also accepts VISA and Mastercard.
               Orders for 100 or more copies mailed to a single address are
               discounted 25 percent. Orders should be sent to:

               U.S. Government Accountability Office 441 G Street NW, Room LM
               Washington, DC 20548

               To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax:
               (202) 512-6061

               Contact:

               Web site: [42]www.gao.gov/fraudnet/fraudnet.htm E-mail:
               [43]fraudnet@gao.gov Automated answering system: (800) 424-5454 or
               (202) 512-7470

               Ralph Dawn, Managing Director, [44]dawnr@gao.gov , (202) 512-4400
               U.S. Government Accountability Office, 441 G Street NW, Room 7125
               Washington, DC 20548

               Chuck Young, Managing Director, [45]youngc1@gao.gov , (202)
               512-4800 U.S. Government Accountability Office, 441 G Street NW,
               Room 7149 Washington, DC 20548

                            1. We disagree that the department followed a
                            transparent process for expansion of the program. As
                            we state in our report, State and Justice officials
                            told us that the lack of a transparent timeline and
                            requirements for Visa Waiver Program expansion has
                            led to confusion among U.S. agencies in headquarters'
                            offices and at U.S. embassies overseas, as well as
                            foreign governments seeking to join the program.
                            Moreover, absent clear direction from DHS, U.S.
                            embassy officials in several aspiring countries told
                            us that it had been difficult to explain the
                            expansion process to their foreign counterparts and
                            manage their expectations about when those countries
                            might be admitted into the Visa Waiver Program.
                            Therefore, we recommend in this report that DHS
                            establish a clear process, in coordination with State
                            and Justice, for program expansion. DHS noted that it
                            is currently working to create procedures so that
                            future candidate countries are selected and
                            designated in as transparent and uniform a manner as
                            possible and expectations are appropriately managed
                            during the process.
                            2. Aside from the 13 Road Map countries identified in
                            2005, State officials told us that they lacked a
                            clear rationale to explain to other aspiring,
                            non-Road Map countries with refusal rates under 10
                            percent (Croatia, Israel, and Taiwan) that they will
                            not be considered in 2008 due to the executive
                            branch's plans to expand the program first to South
                            Korea and countries in Central and Eastern Europe.
                            DHS noted that it is currently working to create
                            procedures so that future candidate countries are
                            selected and designated in as transparent and uniform
                            a manner as possible and expectations are
                            appropriately managed during the process.
                            3. We have updated the report to indicate that ESTA
                            began accepting voluntary applications from visa
                            waiver travelers on August 1, 2008. However, DHS does
                            not anticipate that ESTA authorizations will be
                            mandatory for visa waiver travelers until after
                            January 12, 2009. As we state in our report, and as
                            DHS noted, the department has not yet certified that
                            it can verify the departure of not less than 97
                            percent of foreign nationals exiting U.S. airports,
                            or that an Electronic System for Travel Authorization
                            (ESTA) for screening visa waiver travelers in advance
                            of their travel is "fully operational." Moreover, DHS
                            has not yet implemented a biometric air exit system
                            at U.S. airports. Thus, DHS has not yet fully
                            developed the tools to assess and mitigate risks in
                            the Visa Waiver Program.
                            4. In July 2006, we reported that DHS needed to
                            improve its communication with officials at U.S.
                            embassies so it could communicate directly with
                            officials best positioned to monitor compliance with
                            the program's requirements, and report on current
                            events and issues of potential concern in each of the
                            participating countries. Therefore, we recommended
                            that DHS establish points of contact at U.S.
                            embassies and develop protocols to ensure that the
                            Visa Waiver Program Office receives periodic updates
                            in countries where there are security concerns. As we
                            note in this report, the Visa Waiver Program Office
                            has recently begun communicating and disseminating
                            relevant program information regularly with U.S.
                            embassy officials at Visa Waiver Program posts.
                            However, despite our requests during the course of
                            this review--and again following our receipt of DHS's
                            formal comments on the draft of this report--the
                            department has not provided us with sufficient
                            documentation to demonstrate that it has established
                            points of contact at U.S. embassies for all 27
                            participating countries or established protocols for
                            communications between these contacts and the Visa
                            Waiver Program Office. Furthermore, the department
                            has not provided us with documentation to demonstrate
                            that established points of contact are reporting
                            periodically to the Visa Waiver Program Office.
                            Therefore, we cannot conclude that these 2006
                            recommendations are fully implemented.
                            5. DHS noted that it has not yet signed memorandums
                            of understanding (MOU) with any of the 27 current
                            Visa Waiver Program countries. Because the MOUs will
                            commit all signatories to report to Interpol or
                            otherwise make available to the United States
                            information about lost and stolen blank and issued
                            passports, this recommendation will remain open until
                            all MOUs are finalized.
                            6. To verify the departure of not less than 97
                            percent of foreign nationals exiting U.S. airports,
                            DHS reported to us in December 2007 that it will
                            match records, reported by airlines, of visitors
                            departing the country with the department's existing
                            records of any prior arrivals, immigration status
                            changes, or prior departures from the United States.
                            In January 2008, the Assistant Secretary for Policy
                            Development made this statement, which corroborated
                            data that we received from US-VISIT in late October
                            2007. At the time of our February 2008 testimony,^1
                            DHS confirmed to us that it planned to employ a
                            methodology that begins with departure records;
                            however, as DHS indicated in its written comments on
                            a draft of this report, it has still not decided on a
                            final methodology. DHS has not provided us with
                            information on any other options that it might be
                            considering to meet this provision. Furthermore, the
                            department has not explained how and when it intends
                            to validate these data.

    Agency Comments and Our Evaluation

    Appendix I: Objectives, Scope, and Methodology Appendix I: Objectives,
    Scope, and Methodology

    ^1GAO, Border Security: Stronger Actions Needed to Assess and Mitigate
    Risks of the Visa Waiver Program, [46]GAO-06-854 (Washington, D.C.: July
    28, 2006).

    Appendix II: Worldwide Refusal Rates for Short-term Business and Tourism
    Visas, Fiscal Year 2007 Appendix II: Worldwide Refusal Rates for
    Short-term Business and Tourism Visas, Fiscal Year 2007

    Country                                 Adjusted refusal rate
    Afghanistan                                               38%
    Albania                                                    50
    Algeria                                                    23
    Andorra                                                     9
    Angola                                                     13
    Antigua and Barbuda                                        15
    Argentina                                                   4
    Armenia                                                    61
    Australia                                                  17
    Austria                                                    16
    Azerbaijan                                                 15
    Bahrain                                                     2
    Bangladesh                                                 50
    Barbados                                                    6
    Belarus                                                    26
    Belgium                                                    13
    Belize                                                     27
    Benin                                                      37
    Bhutan                                                     44
    Bolivia                                                    29
    Bosnia-Herzegovina                                         19
    Botswana                                                   16
    Brazil                                                     10
    Brunei                                                      2
    Bulgaria                                                   14
    Burkina Faso                                               43
    Burma                                                      50
    Burundi                                                    56
    Cambodia                                                   53
    Cameroon                                                   43
    Canada                                                     37
    Cape Verde                                                 40
    Central African Republic                                   29
    Chad                                                       29
    Chile                                                       7
    China - Mainland                                           21
    China - Taiwan                                              5
    Colombia                                                   29
    Comoros                                                    25
    Congo (Brazzaville)                                        32
    Congo (Kinshasa)                                           35
    Costa Rica                                                 22
    Cote D`Ivoire                                              46
    Croatia                                                     5
    Cuba                                                       53
    Cyprus                                                      2
    Czech Republic                                              7
    Denmark                                                    11
    Djibouti                                                   22
    Dominica                                                   29
    Dominican Republic                                         41
    Ecuador                                                    28
    Egypt                                                      34
    El Salvador                                                50
    Equatorial Guinea                                          24
    Eritrea                                                    49
    Estonia                                                     4
    Ethiopia                                                   46
    Federated States of Micronesia                              0
    Fiji                                                       33
    Finland                                                    16
    France                                                      8
    Gabon                                                      23
    Georgia                                                    55
    Germany                                                    10
    Ghana                                                      55
    Great Britain and Northern Ireland                         21
    Greece                                                      2
    Grenada                                                    27
    Guatemala                                                  54
    Guinea                                                     58
    Guinea - Bissau                                            55
    Guyana                                                     62
    Haiti                                                      44
    Honduras                                                   38
    Hong Kong (BNO HK passport)                                 2
    Hong Kong S. A. R.                                          3
    Hungary                                                    10
    Iceland                                                     9
    India                                                      22
    Indonesia                                                  40
    Iran                                                       45
    Iraq                                                       45
    Ireland                                                    24
    Israel                                                      3
    Italy                                                       7
    Jamaica                                                    38
    Japan                                                      12
    Jordan                                                     39
    Kazakhstan                                                 12
    Kenya                                                      34
    Kiribati                                                   20
    Kuwait                                                      4
    Kyrgyzstan                                                 30
    Laos                                                       73
    Latvia                                                     12
    Lebanon                                                    25
    Lesotho                                                    40
    Liberia                                                    51
    Libya                                                      25
    Liechtenstein                                               7
    Lithuania                                                  13
    Luxembourg                                                  6
    Macau S.A.R.                                               10
    Macedonia                                                  36
    Madagascar                                                 14
    Malawi                                                     37
    Malaysia                                                    8
    Maldives                                                   22
    Mali                                                       56
    Malta                                                       3
    Mauritania                                                 59
    Mauritius                                                  13
    Mexicoa                                                    33
    Moldova                                                    36
    Monaco                                                     38
    Mongolia                                                   61
    Morocco                                                    24
    Mozambique                                                 18
    Namibia                                                     5
    Nauru                                                       0
    Nepal                                                      55
    Netherlands                                                12
    New Zealand                                                 8
    Nicaragua                                                  46
    Niger                                                      53
    Nigeria                                                    32
    Norway                                                      9
    Oman                                                        4
    Pakistan                                                   40
    Palestinian Authority                                      56
    Panama                                                     26
    Papua New Guinea                                           12
    Paraguay                                                   18
    Peoples Republic of Korea - North Korea                    14
    Peru                                                       44
    Philippines                                                32
    Poland                                                     25
    Portugal                                                    8
    Qatar                                                       2
    Republic of Palau                                           0
    Republic of the Marshall Islands                            3
    Romania                                                    38
    Russia                                                     12
    Rwanda                                                     47
    Samoa                                                      29
    San Marino                                                 40
    Sao Tome and Principe                                      10
    Saudi Arabia                                                6
    Senegal                                                    61
    Serbia                                                     64
    Serbia and Montenegro                                      23
    Seychelles                                                 19
    Sierra Leone                                               43
    Singapore                                                   9
    Slovakia                                                   12
    Slovenia                                                    7
    Solomon Islands                                             5
    Somalia                                                    52
    South Africa                                                6
    South Korea                                                 4
    Spain                                                       7
    Sri Lanka                                                  28
    St. Kitts and Nevis                                        21
    St. Lucia                                                  27
    St. Vincent and The Grenadines                             23
    Sudan                                                      34
    Suriname                                                   11
    Swaziland                                                  19
    Sweden                                                      8
    Switzerland                                                 7
    Syria                                                      36
    Tajikistan                                                 30
    Tanzania                                                   21
    Thailand                                                   17
    The Bahamas                                                 5
    The Gambia                                                 57
    Timor-Leste                                                 0
    Togo                                                       48
    Tonga                                                      45
    Trinidad and Tobago                                        20
    Tunisia                                                    24
    Turkey                                                     15
    Turkmenistan                                               49
    Tuvalu                                                     12
    Uganda                                                     43
    Ukraine                                                    38
    United Arab Emirates                                        5
    Unknown place of birth or stateless                        42
    Uruguay                                                    12
    Uzbekistan                                                 71
    Vanuatu                                                    25
    Vatican City                                                0
    Venezuela                                                  19
    Vietnam                                                    36
    Yemen                                                      64
    Zambia                                                     46
    Zimbabwe                                                   32

    Appendix III: Key Legislative Requirements for Inclusion in the Visa
    Waiver Program Appendix III: Key Legislative Requirements for Inclusion in
    the Visa Waiver Program

    ^1Pub. L. No. 99-603.

    ^2Pub. L. No. 106-396.

    ^3GAO, Border Security: Implications of Eliminating the Visa Waiver
    Program, [47]GAO-03-38 (Washington, D.C.: Nov. 22, 2002).

    ^4All passports issued to visa waiver travelers after October 26, 2006,
    must be electronic. Travelers with passports issued after the deadline
    that do not meet these requirements must obtain a visa from a U.S. embassy
    or consulate overseas before departing for the United States.

    Appendix IV: Comments from the Department of Homeland Security Appendix
    IV: Comments from the Department of Homeland Security

    Note: GAO comments supplementing those in the report text appear at the
    end of this appendix.

    See comment 1.

    See comment 3.

    See comment 2.

    See comment 6.

    See comment 5.

    See comment 4.

    GAO Comments

    ^1GAO, Visa Waiver Program: Limitations with Department of Homeland
    Security's Plan to Verify Departure of Foreign Nationals, [48]GAO-08-458T
    (Washington, D.C.: Feb. 28, 2008).

    Appendix V: Comments from the Department of Justice Appendix V: Comments
    from the Department of Justice

    Appendix VI: A Appendix VI: GAO Contact and Staff Acknowledgments

    GAO Contact

    Staff Acknowledgments

    (320540)

    GAO's Mission

    Obtaining Copies of GAO Reports and Testimony

    Order by Mail or Phone

    To Report Fraud, Waste, and Abuse in Federal Programs

    Congressional Relations

    Public Affairs

    To view the full product, including the scope

    and methodology, click on [49]GAO-08-967 .

    For more information, contact Jess T. Ford at (202) 512-4128 or
    fordj@gao.gov.

    Highlights of [50]GAO-08-967 , a report to congressional requesters

    September 2008

    VISA WAIVER PROGRAM

    Actions Are Needed to Improve Management of the Expansion Process, and to
    Assess and Mitigate Program Risks

    The Visa Waiver Program, which enables citizens of participating countries
    to travel to the United States without first obtaining a visa, has many
    benefits, but it also has risks. In 2006, GAO found that the Department of
    Homeland Security (DHS) needed to improve efforts to assess and mitigate
    these risks. In August 2007, Congress passed the 9/11 Act, which provides
    DHS with the authority to consider expanding the program to countries
    whose short-term business and tourism visa refusal rates were between 3
    and 10 percent in the prior fiscal year. Countries must also meet certain
    conditions, and DHS must complete actions to enhance the program's
    security. GAO has examined DHS's process for expanding the Visa Waiver
    Program and evaluated the extent to which DHS is assessing and mitigating
    program risks. GAO reviewed relevant laws and procedures and interviewed
    agency officials in Washington, D.C., and in U.S. embassies in eight
    aspiring and three Visa Waiver Program countries.

    [51]What GAO Recommends

    GAO recommends that DHS establish a transparent process for Visa Waiver
    Program expansion, and improve and monitor overstay rates for current and
    aspiring program countries. DHS generally agreed with GAO's
    recommendations. The Department of Justice (Justice) noted the importance
    of lost and stolen passport reporting, but did not comment on the
    recommendations.

    The executive branch is moving aggressively to expand the Visa Waiver
    Program by the end of 2008, but, in doing so, DHS has not followed a
    transparent process. DHS did not follow its own November 2007 standard
    operating procedures, which set forth key milestones to be met before
    countries are admitted into the program. As a result, Departments of State
    (State) and Justice and U.S. embassy officials stated that DHS created
    confusion among interagency partners and aspiring program countries. U.S.
    embassy officials in several aspiring countries told us it had been
    difficult to explain the expansion process to foreign counterparts and
    manage their expectations. State officials said it was also difficult to
    explain to countries with fiscal year 2007 refusal rates below 10 percent
    that have signaled interest in joining the program (Croatia, Israel, and
    Taiwan) why DHS is not negotiating with them, given that DHS is
    negotiating with several countries that had refusal rates above 10 percent
    (Hungary, Latvia, Lithuania, and Slovakia). Despite this confusion, DHS
    achieved some security enhancements during the expansion negotiations,
    including agreements with several aspiring countries on lost and stolen
    passport reporting. DHS, State, and Justice agreed that a more transparent
    process is needed to guide future program expansion.

    DHS has not fully developed tools to assess and mitigate risks in the Visa
    Waiver Program. To designate new program countries with refusal rates
    between 3 and 10 percent, DHS must first make two certifications. First,
    DHS must certify that it can verify the departure of not less than 97
    percent of foreign nationals who exit from U.S. airports. In February
    2008, we testified that DHS's plan to meet this provision will not help
    mitigate program risks because it does not account for data on those who
    remain in the country beyond their authorized period of stay (overstays).
    DHS has not yet finalized its methodology for meeting this provision.
    Second, DHS must certify that the Electronic System for Travel
    Authorization (ESTA) for screening visa waiver travelers in advance of
    their travel is "fully operational." While DHS has not announced when it
    plans to make this certification, it anticipates ESTA authorizations will
    be required for all visa waiver travelers after January 12, 2009. DHS
    determined that the law permits it to expand the program to countries with
    refusal rates between 3 and 10 percent after it makes these two
    certifications, and after the countries have met the required conditions,
    but before ESTA is mandatory for all Visa Waiver Program travelers. For
    DHS to maintain its authority to admit certain countries into the program,
    it must incorporate biometric indicators (such as fingerprints) into the
    air exit system by July 1, 2009. However, DHS is unlikely to meet this
    timeline due to several unresolved issues.In addition, DHS does not fully
    consider countries' overstay rates when assessing illegal immigration
    risks in the Visa Waiver Program. Finally, DHS has implemented many
    recommendations from GAO's 2006 report, including screening U.S.-bound
    travelers against Interpol's lost and stolen passport database, but has
    not fully implemented others. Implementing the remaining recommendations
    is important as DHS moves to expand both the program and the department's
    oversight responsibilities.

    References

    Visible links
    1. file:///opt/home/webmaster/infomgt/d08967.htm#None
    2. file:///opt/home/webmaster/infomgt/d08967.htm#None
    3. file:///opt/home/webmaster/infomgt/d08967.htm#None
    4. file:///opt/home/webmaster/infomgt/d08967.htm#None
    5. file:///opt/home/webmaster/infomgt/d08967.htm#None
    6. file:///opt/home/webmaster/infomgt/d08967.htm#None
    7. file:///opt/home/webmaster/infomgt/d08967.htm#None
    8. file:///opt/home/webmaster/infomgt/d08967.htm#None
    9. file:///opt/home/webmaster/infomgt/d08967.htm#None
      10. file:///opt/home/webmaster/infomgt/d08967.htm#None
      11. file:///opt/home/webmaster/infomgt/d08967.htm#None
      12. file:///opt/home/webmaster/infomgt/d08967.htm#None
      13. file:///opt/home/webmaster/infomgt/d08967.htm#None
      14. file:///opt/home/webmaster/infomgt/d08967.htm#None
      15. file:///opt/home/webmaster/infomgt/d08967.htm#None
      16. file:///opt/home/webmaster/infomgt/d08967.htm#None
      17. file:///opt/home/webmaster/infomgt/d08967.htm#None
      18. file:///opt/home/webmaster/infomgt/d08967.htm#None
      19. file:///opt/home/webmaster/infomgt/d08967.htm#None
      20. file:///opt/home/webmaster/infomgt/d08967.htm#None
      21. file:///opt/home/webmaster/infomgt/d08967.htm#None
      22. file:///opt/home/webmaster/infomgt/d08967.htm#None
      23. file:///opt/home/webmaster/infomgt/d08967.htm#None
      24. file:///opt/home/webmaster/infomgt/d08967.htm#None
      25. file:///opt/home/webmaster/infomgt/d08967.htm#http://www.gao.gov/cgi-bin/getrpt?GAO-06-854
      26. file:///opt/home/webmaster/infomgt/d08967.htm#http://www.gao.gov/cgi-bin/getrpt?GAO-06-835R
      27. file:///opt/home/webmaster/infomgt/d08967.htm#http://www.gao.gov/cgi-bin/getrpt?GAO-06-854
      28. file:///opt/home/webmaster/infomgt/d08967.htm#http://www.gao.gov/cgi-bin/getrpt?GAO-08-458T
      29. file:///opt/home/webmaster/infomgt/d08967.htm#http://www.gao.gov/cgi-bin/getrpt?GAO/PEMD-95-20
      30. file:///opt/home/webmaster/infomgt/d08967.htm#http://www.gao.gov/cgi-bin/getrpt?GAO/PEMD-93-25
      31. file:///opt/home/webmaster/infomgt/d08967.htm#http://www.gao.gov/cgi-bin/getrpt?GAO-06-854
      32. file:///opt/home/webmaster/infomgt/d08967.htm#http://www.gao.gov/cgi-bin/getrpt?GAO-08-623
      33. file:///opt/home/webmaster/infomgt/d08967.htm#http://www.gao.gov/cgi-bin/getrpt?GAO-08-623
      34. file:///opt/home/webmaster/infomgt/d08967.htm#http://www.gao.gov/cgi-bin/getrpt?GAO-07-1044T
      35. file:///opt/home/webmaster/infomgt/d08967.htm#http://www.gao.gov/cgi-bin/getrpt?GAO-07-248
      36. file:///opt/home/webmaster/infomgt/d08967.htm#http://www.gao.gov/cgi-bin/getrpt?GAO/PEMD-93-25
      37. file:///opt/home/webmaster/infomgt/d08967.htm#http://www.gao.gov/cgi-bin/getrpt?GAO/PEMD-95-20
      38. file:///opt/home/webmaster/infomgt/d08967.htm#http://www.gao.gov/cgi-bin/getrpt?GAO-06-854
      39. file:///opt/home/webmaster/infomgt/d08967.htm#http://www.gao.gov/cgi-bin/getrpt?GAO-06-854
      40. file:///opt/home/webmaster/infomgt/d08967.htm#http://www.gao.gov/
      41. file:///opt/home/webmaster/infomgt/d08967.htm#http://www.gao.gov/
      42. file:///opt/home/webmaster/infomgt/d08967.htm#http://www.gao.gov/fraudnet/fraudnet.htm
      43. file:///opt/home/webmaster/infomgt/d08967.htm#mailto:fraudnet@gao.gov
      44. file:///opt/home/webmaster/infomgt/d08967.htm#mailto:dawnr@gao.gov
      45. file:///opt/home/webmaster/infomgt/d08967.htm#mailto:youngc1@gao.gov
      46. file:///opt/home/webmaster/infomgt/d08967.htm#http://www.gao.gov/cgi-bin/getrpt?GAO-06-854
      47. file:///opt/home/webmaster/infomgt/d08967.htm#http://www.gao.gov/cgi-bin/getrpt?GAO-03-38
      48. file:///opt/home/webmaster/infomgt/d08967.htm#http://www.gao.gov/cgi-bin/getrpt?GAO-08-458T
      49. file:///opt/home/webmaster/infomgt/d08967.htm#http://www.gao.gov/cgi-bin/getrpt?GAO-08-967
      50. file:///opt/home/webmaster/infomgt/d08967.htm#http://www.gao.gov/cgi-bin/getrpt?GAO-08-967
    *** End of document. ***