Background

Foreign citizens wishing to temporarily enter the United States generally  fill out a visa application; make an appointment; pay a fee; submit  photographs and other documents; provide 2-digit fingerprints; and appear  for a document review, name check against government watch lists, and  interview with a State consular officer at an American Embassy or  Consulate. Consular officers review applications, interview applicants,  execute name checks through the Consular Lookout and Support System,  make notations, and assess whether the applicant may be an intending  immigrant, a potential threat to national security, or otherwise ineligible.  Following these steps, the applicant is granted or refused a visa, or  subjected to additional security checks. (See fig. 1.) Consular officers are  assisted by locally hired staff who are generally not U.S. citizens. These  staff perform support tasks but do not adjudicate visas.
The Bureau of Consular Affairs considers the visa process to be a major  element of national security. In addition to guidance on visa processing,  State provides visa adjudicators, who are typically entry-level officers, with  specific guidance and training on examining applicants’ documentation,  interviewing, and screening out applicants who may pose security  concerns. This guidance is provided in the Foreign Affairs Manual and the  Consular Management Handbook, as well as through periodic policy  updates of standard operating procedures transmitted to overseas posts  and placed on an intranet site.
While the Office of the Inspector General and Diplomatic Security share  authority for investigating visa malfeasance, Diplomatic Security conducts  most of the investigations. In particular, Diplomatic Security’s Visa Fraud  Branch investigates visa malfeasance cases and carries out related  enforcement functions for State. These cases are typically pursued by a  regional security officer and consular management and involve observation  of the suspected employee and collection of evidence to document the  malfeasance. In cases where Justice determines sufficient evidence exits, it  will prosecute employees who are accused of malfeasance.

	Consular Affairs Has Internal Controls over the Visa Process, but Controls Are Not Being Fully Implemented at Posts GAO Reviewed

The Bureau of Consular Affairs has established a number of key internal  controls designed to mitigate the risk of employee malfeasance, some of  which are new or have been reinforced since September 11, 2001. Among  the controls State has emphasized are: limiting employee access to visa  issuing systems and applicants, periodic reconciliations of visa stocks,  specific criteria for post employees to follow when referring foreign  individuals seeking visas for favorable treatment by consular officials, and  mechanisms to provide oversight of key consular activities by post and  Consular Affairs headquarters management. While Consular Affairs’  controls are consistent with accepted control standards, we found that  some of the controls were not always being followed at the posts we  visited.

		Internal Controls Are in Place, and Many Are Either New or Have Been Reinforced

To prevent the issuances of nonimmigrant visas to unqualified applicants,  Consular Affairs has strengthened its efforts to limit employee access to  automated systems that issue visas and has taken steps to ensure that visa  applicants cannot predict which officers will interview them. Additionally,  Consular Affairs has a series of controls over accountable items. It has also  strengthened its criteria for applicants referred by post employees for  favorable consideration in obtaining a visa and expedited processing by  consular officers. Further, Consular Affairs has increased its emphasis on  both headquarters and post supervisory oversight. It also requires posts to  certify in writing annually their compliance with key internal controls.  Consular Affairs has issued guidelines on reporting suspicious behavior  that may involve malfeasance. It has also enhanced its malfeasance  prevention efforts.

			Controlled Access to Visa Issuing Systems

The increased dependence of consular officers on automated systems  requires Consular Affairs to have effective management controls over these  systems. Consular Affairs has strengthened its existing controls over visa  issuing systems by restricting employee access to key systems and  safeguarding passwords, thereby emphasizing consular officers’  accountability for visa issuance and providing an audit trail to document  which officer issued each visa. For example:  The Consular System Administrator controls employees’ access to the  automated consular systems by assigning user identifiers and roles.  Designated consular officers ensure appropriate access to consular  automated functions; an administrator specifically assigns each  consular employee a specific role; and the computer system only allows  consular staff to perform functions associated with that role. For  example, only officers that adjudicate visas are assigned a system role  that permits them to authorize visa issuance.
In February 2004, Consular Affairs strengthened controls over access to  employee computers by requiring that passwords be known only to the  users and that they be changed semi-annually. In the past, employee  passwords were assigned by the system administrator, but are now  chosen by the employee. As an additional safeguard, employees are now  reminded to lock their computers when not at their desks, and the  system is set to automatically lock after an interval of idleness.
Consular Affairs controls access of applicants to visa adjudicators and  consular staff. To prevent applicants targeting a particular consular  officer, Consular Affairs requires that consular officers interview  applicants in a random manner, with no single person controlling the  process. When translators are used, they are to be rotated among the  adjudicators.
Controls over Accountable Items To reduce the risk that blank visas will be stolen or that visas will be issued  without being properly recorded in the consular systems, it is Consular  Affairs’ standard practice to safeguard blank visas and other accountable  items, closely monitor usage, conduct frequent inventories, and reconcile  discrepancies quickly. Each post must designate a primary and backup  accountable consular officer to be responsible for controlled items.  Further, Consular Affairs procedures require controlled items to be  reconciled daily, verified quarterly, and certified annually by senior  consular or post officials. At least quarterly, the accountability officer must  physically count the stock of each accountable item and reconcile the  inventory ledger, ensuring that the number of the item on hand in fact  matches the number that the ledger indicates should be on hand.  Discrepancies between inventory records and stocks of blank visas on  hand that can not be resolved must be reported within 24 hours to Consular  Affairs management.

			Criteria for Post-Referred Applicants

U.S. officers from any U.S. government agency posted at embassies and  consulates may refer to the consular section for favorable consideration  and expedited processing foreign applicants where visa issuance would  support U.S. interests or those of the mission. This so-called visa referral is  a means for other embassy officials to provide additional information on a  visa case and to document a perceived U. S. national interest served in  facilitating the travel of the applicant. According to a 2005 State Inspector  General’s report, embassy staff or prominent local figures often appeal to  ambassadors or other mission managers for favorable consideration in  obtaining visas, and consular officers have felt pressure to provide such  assistance. To ensure that post staff refer visas only for qualified  applicants, Consular Affairs has strengthened and formalized its criteria for  issuing referred visas. Prior to 2002, posts individually interpreted the  guidelines on making referrals and many posts did not have formal referral  policies. In 2002, Consular Affairs required posts to establish a formal  postwide referral system. Under this system, referral procedures are to be  reissued annually, and supervisory consular officers are to periodically  review referral activities, specifically noting frequency of referrals by  officer as well as applicant return-to-country rates. Consistent with the new  congressionally mandated biometric and interview requirements, the new  referral criteria require   fingerprinting and photos of all applicants and personal interviews of  nearly all referred visa applicants,  mandatory use of revised referral forms,   certification that the applicant is personally known to the sponsor and  presents no threat to national security,   supervisory approval of the referral request by the sponsor’s supervisor,   scanning of applicant forms and referral requests into the nonimmigrant  visa system to provide a record and an audit trail, and   post management reviews of aggregate visa trends by referrer.
Since 2002, Consular Affairs has repeatedly reiterated referral criteria in  policy updates and clarifications to overseas posts. Moreover, during our  review, in June 2005, Consular Affairs again revised the referral policy  reiterating the need for senior consular officers to adjudicate Class A  referrals and requiring posts to provide the Bureau of Consular Affairs  copies of their referral policies. In addition, Consular Affairs said that it  gives briefings to every ambassador, deputy chief of mission, and principal  officer emphasizing the importance of strict compliance with the visa  referral policy, that visa referrals are tracked, and that mission leaders bear  responsibility and liability for their own referrals.

			Emphasis on Supervisory Oversight

Citing cases of consular malfeasance resulting from lax supervision over  consular functions, Consular Affairs has continually emphasized the need  for supervisory oversight of the visa function, particularly by ambassadors,  deputy chiefs of mission, or principal officers. Depending on the size of the  post, daily oversight is exercised by senior consular officers over  nonimmigrant visa section chiefs (who supervise adjudicating officers and  other consular staff) or by the most senior available post officer. Senior  consular section chiefs, who generally adjudicate referrals or other visas at  smaller posts, are supervised by senior post managers. Consular Affairs  requires that supervisors review all visa refusals daily and perform spot- checks of issuances, as well as undertake periodic reviews of post  referrals.
Supervisors have tools to assist with this responsibility. For example, the  Nonimmigrant Visa application allows on-line oversight through reports of  consular activities, such as daily visa refusals and issuances, including the  time of visa issuance; the applicants interviewed and their nationalities;  and the types of visas issued, including those for visitors, students,  businesspersons, professionals, and performing artists, as well as the  reasons for denials. Additionally, reports providing aggregate information  on the number and types of referrals made by each post officer and their  disposition are available. A recent enhancement to the system permits  supervisors to view applications and referral forms showing applicant’s  purpose of travel and whether the referral was signed appropriately and  reviewed as required.
Consular Affairs also has emphasized in cables and training the importance  of ambassadors, deputy chiefs of mission, and principal officers’  supervisory role in reviewing the visa function. According to State officials,  training courses for these offices have included information on the  consular function, oversight responsibilities, and employee malfeasance.  According to State training records, the senior managers at six posts we  visited had received this training.

			Certification of Internal Controls

To ensure that the internal controls over the visa process are being  implemented, State requires that chiefs of mission certify annually that the  controls are adequate. In addition, since September 2002, State has  required that consular managers certify their compliance with key controls  over the visa process to chiefs of mission and to Consular Affairs. Each  year, posts are required to issue a report certifying their compliance with  internal controls, including routine inventory counts of controlled items,  established referral policies and procedures, and supervisory reviews of  visa refusals and issuances. In October 2004, Consular Affairs required the  review of 19 controls by each post.

			Assessing Visa Malfeasance and Reporting Suspicious Behavior

To safeguard the visa process, consular sections are required to assess post  vulnerability to employee malfeasance. Posts are to identify internal visa  malfeasance risks, such as inadequate oversight procedures, and to assess  post vulnerability to external fraud, such as bribery. To assess this  vulnerability, Consular Affairs has established Fraud Prevention Units at  posts and designated Fraud Prevention Manager positions. The units are  responsible for detecting suspected fraud by visa applicants as well as  possible employee malfeasance, and coordinating with the regional  security officer and local law enforcement authorities as necessary. The  positions are often filled on a part-time basis by consular officers who are  responsible for making vulnerability assessments along with their other  duties.
Consular Affairs also has guidance on reporting suspicious behavior.  Employees are required to report suspicions of employee malfeasance to  the senior consular manager at post and the regional security officer,  unless one of them is believed to be involved in the malfeasant activity.  Further, State’s guidance on reporting malfeasance emphasizes the need to  protect the integrity of an investigation and the commitment of  confidentiality to the source of an allegation. As such, State’s standard  operating procedures call for potential malfeasance information to be  closely held at post and in the department.

			Increased Headquarters’ Oversight

With 211 visa issuing posts, State requires adequate and continuous  oversight to reduce the risks of visa malfeasance. Headquarters  management is an essential part of that oversight. To assist headquarters in  monitoring post operations, State established the Vulnerability Assessment  Unit (VAU) jointly staffed by Consular Affairs and Diplomatic Security. In  addition, Consular Affairs established Consular Management Assistance  Teams (CMAT). VAU, established in 2003, attempts to detect and prevent  possible employee malfeasance by analyzing consular data from State’s  Consular Consolidated Database. VAU reviews several different reports for  variations that could indicate malfeasance. Among other things, these  reports and other information can (1) identify whether senior officers with  responsibility for reviewing adjudications have access to automated  systems to do required reviews of visa adjudications, as well as whether  they are actually doing so; (2) determine whether post employees follow  procedures and use appropriate forms to make referrals for applicants; (3)  review issuance and refusal rates of adjudicators; and (4) review rates of  visa refusals overturned by senior officers. In 2003, State instituted CMATs  to perform informal reviews of consular functions. The teams, which are  provided VAU reports on consular activities, examine access controls,  inventory reconciliations, training and knowledge of consular applications,  appropriate use of referral procedures, supervisory reviews of daily  adjudications, and other visa issues. Posts are selected for CMAT  examination if there is knowledge of a management problem and a review  can help to identify a systemic problem, if posts request a review, or if there  has been a previous case of malfeasance at the post. CMAT reports, which  may include recommendations to improve post management, are sent to  State’s Bureau of Consular Affairs and to the posts. State has conducted 81  CMAT reviews, including reviews of several posts twice, since program  inception.

		Internal Controls Not Fully and Consistently Implemented

Consular Affairs has established and reinforced a system of internal  controls, described above, designed to reduce visa malfeasance risks;  however, we found that the controls were not being fully and consistently  implemented. All the posts we visited had limited employee access to  systems and applicant access to consular staff. However, we found that  inventory counts of accountable items were performed inconsistently.  Further, the referral policy was not followed. Also, supervisory  adjudication reviews were not performed consistently. Moreover, we found  that some posts had certified compliance with these controls when we, and  in some cases, CMAT teams, indicated that they were not in compliance. In  addition, staff were unclear on employee malfeasance reporting policies.  Finally, headquarters oversight has been hindered by the lack of enhanced  technical tools to identify potential malfeasance. Table 1 summarizes the  results of our review of internal controls over the visa process at the 11  posts we visited.
To reduce the risks of visa malfeasance, all the posts we visited had  complied with department directives to limit employee access to visa  issuing systems. This compliance ensured that employees only had  appropriate level access to accomplish their responsibilities. We also  observed at all posts that consular staff did not have exposed passwords at  their workspace, and they logged off systems each time they left their  desks. Moreover, most posts ensured that applicants did not have access to  consular sections and that consular staff and applicants were interviewed  in a random manner.

			Inventory Reconciliations Performed Inconsistently

To prevent malfeasant issuance of visas, Consular Affairs requires that  blank visas (visa foils) be counted and safeguarded along with other  controlled equipment. We found that not all posts reconciled visa  inventories as required. Seven posts had not conducted quarterly  reconciliations as required, although posts did routinely perform daily  reconciliations. Moreover, some posts had certified that they had complied  with inventory controls when they had not, and other posts did not  accurately characterize their compliance. For example:   At one post, the accountable consular officer was absent and the back  up officer did not have the combination to the controlled area.  Therefore, we could not review inventory logs nor could the backup  perform the required daily reconciliation.
Two posts had discrepancies in their monthly reconciliations due to  miscounting. At one post, this discrepancy was discovered later when  the post prepared for a CMAT review.

			Referral Policy Not Followed

A referral is also a useful foreign policy tool. However, if it is not  implemented properly, it could create risks in the visa process by allowing  expedited visa processing for potentially unqualified applicants to enter the  United States. We found problems with the implementation and monitoring  of referrals at seven posts. Moreover, in 2002, an Inspector General Report  cited several instances where malfeasant employees sold referrals and  recommended strengthening the nonimmigrant visa referral policy. The  cases cited by the Inspector General involved Drug Enforcement  Administration and Department of Commerce employees, but sales of  referrals by State employees have also occurred.
Consular Affairs has issued and reinforced guidance on referrals to posts  three times since 2002. However, the Inspector General noted in March  2005 that the Bureau of Consular Affairs needed to be better informed of  referral procedures in place at overseas posts. The report cited concerns  that not all posts were following State guidance and recommended that  posts verify that applicants had returned at the end of their authorized stay  in the United States. State subsequently required posts to conduct  periodic studies on whether referred applicants left the United States  before their visa expired. State requires that all posts have a referral policy  that defines specific criteria referred applicants must meet. The post  policies are intended as a supplement to overall Consular Affairs guidance  on referrals. As a further safeguard, referrals must be (1) adjudicated by  senior consular officers, (2) reviewed by supervisors, and (3) monitored by  post management. Class A referents, generally high-level foreign  government, business, or cultural officials, are fingerprinted and undergo a  document review but do not have to be interviewed by the consular  section. We found that four posts did not have a current post-specific  referral policy. Furthermore, based on our spot-checks of visa referral  records, there was no evidence at six posts that some supervisors had  performed the required reviews. In fact, at three of these posts, the  supervisors, principal officers, or deputy chiefs of mission were not  enabled to access the systems designed to permit and document  supervisory review. Consular Affairs indicated that it encourages  supervisors to document their review within the consular computer  system. Our review of referral forms and applications revealed that not all  referred applicants met State’s referral criteria. For example,   A senior consular officer at one post issued referrals that did not meet  Class A criteria, including approving referrals for the secretary of a  foreign official and the adult children of foreign officials on personal  travel, when only minor children accompanying the official qualify.
One post could not identify the individual who had made a referral. The  recent referral was approved by the consular section in February 2005.  The individual making the referral did not appear on the post roster, and  the post agency where the referrer was assigned could not identify the  individual at the time of our visit. U.S. personnel not under the authority  of the Chief of Mission cannot use the referral system, according to  Consular Affairs. As a result, the post was unable to verify that the  referral was legitimate.
To monitor the referral process, State requires consular managers to review  referral adjudications daily (as they do other issuances) and to annually  examine 12 months of referrals for anomalies. To comply, all posts had  prepared, as required, executive management aggregate reports of referrals  by employee. Our review of these aggregate reports indicated no  abnormalities; however, when we reviewed individual referral and  applicant forms available online, we found that referrals had not been  submitted or adjudicated appropriately. For example:   One referral was made by a local employee, when only U.S. officers at  the post are allowed to make referrals.
At one post, a referral was made and adjudicated by the same officer.
Consular officers may not refer and approve the same applicants for  visas. This referral was for a cousin of a consular section employee, and  consular officers are not allowed to adjudicate matters involving  friends.
Three posts had incorrectly used the Class A referral for local  employees on personal travel. State permits Class A referrals for locally  employed staff only for official travel.

			Supervisory Adjudication Reviews Inconsistent

Nonimmigrant Visa chiefs are to review daily all refusals and a sample of  issuances. When visa section chiefs adjudicate, senior consular officers  are to perform the reviews, while at small posts with one or two consular  officers, the deputy chief of mission, principle officer, or other senior post  staff are to do so. State policy recommends on-line reviews, but permits  paper reviews as well. Reviewers have an automated system that provides  management reports that would reveal anomalies in consular officer visa  issuances. However, we found little evidence that reviews were being  undertaken consistently at the posts we visited. For example:  Six posts did not consistently perform State required daily reviews of  visa issuances and refusals. For example, at one post a review of the  Nonimmigrant Visa system showed that required daily reviews had not  been done for a month.
At one post, with the consular section located in a different building  from the embassy, we saw several months of visa adjudications on the  floor awaiting review by the deputy chief of mission.
A review of Nonimmigrant Visa adjudication reports at the posts we  visited showed that some posts consistently reviewed daily visa  applicant refusals, but did not follow Consular Affairs’ policy to spot- check daily visa issuances.

			Certification of Internal Controls May Not Disclose Shortcomings

Due to inaccurate or incomplete submissions, the certifications of consular  management controls may not provide the level of assurance desired that  internal controls are being followed. For example:   Seven of the posts we visited had not conducted quarterly  reconciliations, as required, although five had certified compliance with  inventory controls. The October 2004 CMAT reviews of two of these  posts had found similar problems, noting that required inventory  controls had not been reconciled on a quarterly basis, although all had  routinely performed daily reconciliations.
Some posts submitted the required certifications but did not indicate  whether they were in compliance. Two posts, for example, reported  reviewing controlled items, but did not note whether they were  reconciled.

			Staff Unaware of Malfeasance Reporting Procedures

Many consular staff at most posts were aware that they should report  suspected visa malfeasance but did not know the appropriate reporting  procedures. Internal control standards require agencies to clearly establish  areas of authority and appropriate lines for reporting. State policy requires  that suspicions of malfeasance at posts be reported to Consular Affairs’  consular section chiefs and Diplomatic Security’s regional security officers,  unless they are the subject of the allegations. In practice, most consular  staff we spoke with said they report suspicions of consular malfeasance up  their chain of command. If suspected malfeasance is not promptly  reported to the regional security officer, subsequent investigations could be  affected. In August 2005, Consular Affairs and Diplomatic Security  provided more explicit guidance to the field on the actions that posts, in  particular consular and security officers, must take in the event they  suspect or uncover malfeasance.

			Headquarters Oversight Hindered by the Lack of Enhanced Technical Tools

Consular Affairs’ headquarters oversight unit, the VAU, does not have  adequate tools to assist their review of the visa process to identify fraud  trends. The Consular Consolidated Database contains various reports that  provide information on daily visa issuances, denials, and referrals by  consular staff. Currently, the VAU can only recall this information on an ad- hoc basis, which is time consuming for the two staff assigned to the unit.  For example, it took several hours for us and a VAU staff to review two  categories of data—assigned roles allowing post staff to use consular  databases and whether daily reviews of visa refusals and issuances were  being conducted at five posts. Moreover, the unit has no automated means  to sort data and generate reports that flag unusual variances in visa  issuances or to track trends. As a result, the unit is currently reactive,  focusing its research on supporting allegations and investigations of  malfeasance and generating reports on individual post consular activities in  preparation for CMAT team visits to posts. Unit officials indicated that they  are working toward developing a more proactive approach to malfeasance  analysis that will allow automated searches of anomalies, fraudulent or not,  through a more efficient data mining and search capability. The new  capability will include identification of consular activity outside of normal  operating patterns, unusual timing of issuances, adjudications made by  someone unauthorized to do so by controlled systems, and overrides of  visa refusals, and would also result in further inquiry into the anomalies.  Consular Affairs indicated that the software enhancements’ usefulness  would be tested beginning in late September 2005.

	Documented Cases of Visa Malfeasance

Between 2001 and 2004, Diplomatic Security substantiated through  investigation 28 cases of U.S. employee visa malfeasance that resulted in  various actions. In examining these case files, we could not discern why  the malfeasance occurred in part because the data were not contained in  Diplomatic Security case files or because in some instances the case was  ongoing. However, in examining case data on several prosecuted cases, we  found that a breakdown in post adherence to internal controls could have  been a contributing factor. Several factors impede visa malfeasance  investigations, including differences in U.S. and foreign laws, investigative  techniques, and other issues. Malfeasance prosecutions also face several  impediments.

		Nature and Substance of Malfeasance Allegations

Cases are opened only for those allegations found to be supported by some  evidence, even if that evidence is eventually determined to be unreliable.  Allegations of visa malfeasance, initiated from tips or reporting of  suspicious activity, are vetted through post security officers and  investigated when warranted. According to Diplomatic Security  Investigators, the investigative process can result in several outcomes:   unfounded, with no reliable evidence found to support the allegation;   unsubstantiated, with some evidence found that might indicate  wrongdoing, but not sufficient to establish culpability and build a  criminal case; or  substantiated, with sufficient evidence found to support the allegation  of malfeasance.
Substantiated cases lead to further investigation and typically result in  resignation, termination, arrest, or referral to Justice for criminal  prosecution.
The 28 substantiated cases of visa malfeasance between 2001 and 2004  resulted in various dispositions, according to Diplomatic Security records.  Thirteen investigations resulted in arrests, 13 resulted in termination of the  employee, and 2 resulted in employee resignations. Generally, the officers  involved in these cases were arrested and the majority of Foreign Service  Nationals were terminated. Most of the 28 cases we reviewed involved the  alleged sale of visas by both consular and other post officers and Foreign  Service nationals. However, possibly because the information provided was  not complete, we could not identify any particular trend in the cases we  reviewed covering 2001 to 2004 or in the 28 cases that were substantiated.  Diplomatic Security does not have the capability to automatically pinpoint  specific types of visa malfeasance or perform trend analyses. As a law  enforcement entity, Diplomatic Security and its regional security officers  overseas focus on gathering sufficient evidence to substantiate the  allegation and do not focus on what allowed the alleged activity to occur.  Consequently, in reviewing the information provided, we could not  consistently determine across cases, for example, how the alleged  malfeasance was discovered, the exact nature of the malfeasance, the rank  of the individual allegedly involved in the malfeasance, and whether similar  allegations were made when the individual was at other posts. This type of  information would benefit investigations and could be a tool for consular  management’s monitoring and training efforts. Diplomatic Security officials  acknowledged this capability would be useful but noted that progress in  developing this capability has been slow because Diplomatic Security has  other priorities.
Of the 28 cases substantiated, at least 10 individuals have been  prosecuted. The individuals prosecuted received prison terms ranging  from 18 to 63 months, and two individuals were given probation. In some of  these cases, it appeared that the lack of adherence to internal controls  could have played a role in allowing employee malfeasance to go  undetected for a considerable period of time. Consular officials indicated  that strict compliance to internal controls could not prevent malfeasance.  However, they acknowledged that lack of strict compliance could create an  environment that would make it easier to commit malfeasance. The  following are examples of visa malfeasance or alleged visa malfeasance  and how lack of strict compliance with internal controls may have been a  contributing factor in creating an environment where the malfeasance  could take place.
Consular Affairs requires supervisors to review reports on visa refusals  and issuances to detect anomalous activity. Between 2000 and 2003,  two consular employees at one post sold visas to unqualified applicants.  Diplomatic Security said it did not know how many visas were sold.  However, 181 visas were revoked after the malfeasance was discovered.  Diplomatic Security believes that many of the persons with revoked  visas had already entered the country. We believe that strict compliance  with internal controls could have identified this malfeasance earlier.  Applicants for nonimmigrant visas generally apply at an embassy or  consulate with jurisdiction over their place of normal residence,  although they are not required to do so. However, in this case, there  were a large number of third country nationals receiving visas from the  same officer. Supervisory review of the issuances to the third country  nationals or review of a standard report on visa issuances could have  alerted management to this unusual activity. The consular officer ceased  the illegal activity following a supervisory reprimand but soon was able  to resume selling visas. The convicted employees received a 63-month  sentence and forfeited $750,000 in illicit gains.
Consular managers are required to continually oversee visa functions  and suspicions of malfeasance must be examined carefully. Between  2000 and 2002 a senior consular officer at a small post accepted  fraudulent applications and documents from a visa broker, issued them  outside the normal process, and returned visas to the broker. After a  supervisory reprimand, the officer revised the fraud scheme and  conspired with the broker to approve visas for applicants with false  passports. The officer received money for processing 85 visas, was  convicted, and received a 24-month sentence.
During the course of our work, State reported another case of visa  malfeasance where we believe that lack of strict compliance with internal  controls could have been a contributing factor. State requires consular and  post management to periodically review referral activities and check on the  return rates of applicants receiving a visa. Between 1999 and 2001, a State  political officer at a small post allegedly referred unqualified applicants for  visas, according to a State press release issued in April 2005. In the absence  of the senior consular officer, the political officer was also responsible for  visa adjudications and allegedly provided blank visa applications to an  individual, assisted in filling them out, and then issued them to unqualified  applicants. In return for these services the officer allegedly received a  vintage BMW motorcycle. The officer was arrested in 2005.
Consular Affairs emphasized that although some of its officers have  engaged in visa malfeasance, other U.S. government employees and  Foreign Service nationals have as well. Between 2000 and 2001, a U.S.- based Foreign Agricultural Service officer recommended 99 unqualified  applicants and was able to influence the visa process through his  recommendations and the submission of fraudulent documents, according  to court documents. In exchange, the officer received bribes totaling  $77,400. The officer, who was given the names of ineligible applicants by  visa brokers, provided the applicants, on U.S. Department of Agriculture  letterhead, letters stating that the individuals were agricultural specialists  invited to the United States for official meetings. The officer then sent  follow-up faxes to posts confirming the invitations. The individuals, who all  listed the same destination address, presented the letters at embassy visa  offices and unlawfully obtained visas. The officer was sentenced to 21  months in prison for participating in the visa malfeasance scheme.

		Factors Affecting Visa Malfeasance Investigations

Visa malfeasance investigations are impeded by several factors, according  to Diplomatic Security officials, including untimely reporting of alleged  visa malfeasance. The ability to gather evidence is adversely affected, for  example, when allegations are made several years after the alleged  malfeasance occurred and witnesses have been reassigned, or are  unavailable. In particular, entry-level officers, fearing reprisal, may delay  reporting malfeasance until after they have been reassigned to a new post,  according to State officials. In such cases, reconstructing the actions  constituting any malfeasance is difficult because years may have passed  since the incident occurred.
When visa malfeasance occurs overseas, differences in legal systems can  pose obstacles to investigators. Local laws may not permit the use of U.S.  investigative techniques such as recorded conversations, undercover  operations, or interrogation of suspects, according to Diplomatic Security  officials. Additionally, according to Diplomatic Security investigators,  investigations of local employees may be complicated due to differences in  U.S. and foreign laws. According to Diplomatic Security officials, bribery is  not a criminal offense in some countries and therefore it is difficult and  sometimes impossible to obtain local warrants for searches in these  countries.
Conflicting priorities may also impede evidence gathering. For example, at  one post, the Diplomatic Security investigator noted that he had to  concentrate on ensuring the security of the post and was not able to devote  adequate attention to investigating a recent allegation of visa  malfeasance. Diplomatic Security officials confirmed that protecting  personnel and infrastructure is the first priority of post security officers.  Additionally, when malfeasance is suspected, Consular Affairs’ and  Diplomatic Security’s differing objectives may affect evidence gathering.  Diplomatic Security officials abroad and in headquarters, as well as Justice  officials, all noted that documenting the illegal activity and gathering a  sufficient amount of evidence to make a criminal case often requires  allowing the suspect to continue working, unaware of the investigation.  Consular Affairs noted that when this occurs, consular management  closely reviews the suspect’s adjudications and monitors his or her  activities to prevent issuances to ineligible applicants. However, Consular  Affairs management interviewed on this issue expressed a preference for  removing suspected individuals from their positions as quickly as possible.  At one post, the ambassador, at the recommendation of the senior consular  officer, took action to remove an employee under investigation in order to  stop even the possibility that a visa could be issued to an ineligible  applicant, thereby ending the covert investigation. As a result, a criminal  case could not be developed, and the employee was dealt with  administratively and was fired.

		Malfeasance Prosecutions Face Impediments

Justice’s efforts to prosecute malfeasance are limited by a range of factors,  including the inability to use U.S. warrants to search U.S. employees’  offices and residences overseas, according to Justice. U.S. magistrates  generally cannot issue warrants for overseas searches. Further, Justice  officials noted that they only accept for prosecution cases with sufficient  evidence to warrant convictions.
Under Rule 41 of the Federal Rules of Criminal Procedures, U.S.  magistrates do not have the authority to issue search warrants for locations  outside their districts, such as an embassy or residence overseas.  According to Diplomatic Security officials, the ability to obtain U.S. search  warrants, rather than relying on local warrants issued and executed by the  host government, is important since investigations of visa malfeasance  generally focus on embassy property or diplomatic residences. The U.S.  mission and the residences of certain U.S. diplomats in country are  inviolable, which means that agents of the host government may not enter  the premises without the consent of the head of the mission, according to  State officials. State officials also told us that the United States will never  waive inviolability for the U.S. mission, and, therefore, investigators could  not rely on a host country’s warrant to search an employee’s office at the  U.S. mission. However, in certain instances, State officials said that they  would waive inviolability for the personal residences of U.S. diplomats,  located outside the U.S. mission.
In instances where inviolability is waived, the United States can use current  tools, such as letter rogatories and Mutual Legal Assistance Treaties, to  request that a host government issue and execute a search warrant under  the host government’s laws. Nonetheless, Diplomatic Security officials  cited many difficulties they say can arise when using these tools. For  example, according to these officials, differences between the United  States’ and some host government’s techniques in gathering evidence can  affect the admissibility of that evidence in U.S. courts. As a result of these  and other difficulties, diplomatic security officials told us that they do not  often utilize these tools to obtain local search warrants.
In discussing with State and Diplomatic Security officials the possibility of  obtaining additional search authorities under U.S. law, these officials raised  issues regarding the magnitude of the need, as well as concerns over  sovereignty and reciprocity. For example, Diplomatic Security officials  indicated that in approximately six cases in the past year they would have  wanted to conduct searches of employee residences and offices in  connection with suspected visa malfeasance. State officials raised  concerns that should the United States execute U.S. search warrants  overseas, host governments could view this as a challenge to their  sovereignty. Further, if the United States were to execute U.S. warrants  overseas, the question arises whether the United States would have to  extend the same privilege to foreign governments to execute their own  warrants here in the United States.

	Conclusions

A visa system that is beyond reproach, with strong internal controls to  protect against consular malfeasance, is critical to ensuring the integrity of  visa decisions, national security, and U.S. immigration objectives. There is  no way to prevent applicants from offering bribes; therefore, State  recognizes that along with the integrity of its employees, an effective  internal control program is needed to guard against employee malfeasance.  Established internal controls make it more difficult for an employee to  commit visa malfeasance. State has established a system of internal  controls. However, at the posts we visited, we found that compliance with  some of these internal controls was inconsistent. This increases the risk of  visa malfeasance. Furthermore, most consular staff we spoke with did not  know the appropriate way to report suspicions of employee visa  malfeasance, which could hinder investigations. A further weakness to  investigations is the lack of data on allegations and investigations to  identify vulnerable points in the visa process. Finally, U.S. investigators  cannot obtain a U.S. search warrant to search the offices or residences  overseas of employees, which, according to Justice and Diplomatic  Security officials, affects their ability to gather evidence in malfeasance  cases. However, there are numerous factors that would need to be  considered in pursuing additional search authorities.

	Recommendations for Executive Action

To emphasize the importance of internal controls to consular officers,  section heads, and post managers, we recommend that the Secretary of  State take the following two actions:  Develop a strategy to achieve strict compliance with internal controls.
The strategy should include a system to spot check compliance. The  strategy should also include formalized procedures in Fraud Prevention  Units to document how the post will address the risk of employee  malfeasance and emphasize the importance of reporting suspected  internal malfeasance to consular managers and post security officers.
Improve State’s existing mechanisms to combat visa malfeasance. This  could be accomplished by (1) improving the software available to the  Vulnerability Assessment Unit to automatically sort data to identify and  analyze abnormalities in post visa issuance statistics that could be an  indication of malfeasance and (2) enhancing the investigative case  tracking systems used by the Bureau of Diplomatic Security in order to  better identify trends and vulnerabilities in the visa process for use by  investigators and consular managers.
We also recommend that the Secretary of State and the Attorney General  determine whether seeking additional overseas search authorities is  warranted to facilitate investigations of visa malfeasance. If they determine  that such authorities are warranted, the Secretary of State and the Attorney  General should develop an implementation plan and notify the Congress of  any required legislative changes.

	Agency Comments and Our Evaluation

We provided a draft of this report to the Departments of State and Justice.  The Department of State provided written comments, which are included  in appendix II. State concurred with our conclusions and recommendations  and has begun taking actions to improve and monitor posts’ adherence to  internal controls. Specifically, the department said it will review and  approve post referral policies, and it has established an ombudsman to  ensure that there is no undue influence on consular officers to issue visas.  To monitor compliance with internal controls, the department plans to  establish an automated control system for controlled items, field test an  automated data mining system of consular activities, and launch a  worldwide fraud case tracking system in 2006. Lastly, the department said  it will work with the Attorney General to determine if additional authority  for overseas searches of employees’ residences and offices is warranted  and, if so, how it could best be achieved. Justice did not comment on our  recommendations, but provided technical comments, which we  incorporated in the report as appropriate.
As agreed with your office, unless you publicly announce its contents  earlier, we plan no further distribution of this report until 30 days after its  issue date. At that time, we will send copies of the report to relevant  congressional committees and subcommittees, the Secretary of State, the  Attorney General, and other interested parties. In addition, this report will  be available at no charge on the GAO Web site at http://www.gao.gov.
If you or your staff have any questions about this report, please contact me  at (202) 512-4128. Contact points for our Offices of Congressional Relations  and Public Affairs may be found on the last page of this report. GAO staff  who made major contributions to this report are listed in appendix III.

Scope and Methodology

The scope of our work covered the visa application and adjudication  process at selected U.S. Consulates and Embassies overseas. To assess the  policies and procedures governing visa operations, we obtained copies of  written procedures and interviewed officials from the Bureau of Consular  Affairs. At the embassies and consulates we visited, we interviewed foreign  service nationals, foreign service officers, adjudicating officers, the  Nonimmigrant Visa section chiefs, the consular section chiefs, and the  deputy chiefs of mission or principal officers. When available, we also  interviewed consuls general and ambassadors.
To assess the internal controls designed to prevent the illegal provision of  visas, we asked State to identify the policies, procedures, and key internal  controls governing visa operations. State identified a number of key  internal controls, and, in particular, identified the Consular Management  Handbook (Chapter 600), their Standard Operating Procedures, and the  relevant sections of the Foreign Affairs Manual as sources for these  controls. We obtained and examined the Department of State’s Consular  Management Handbook, Standard Operating Procedures, key sections of  the Foreign Affairs Manual, and documents related to how the department  develops and enforces standards of conduct for visa adjudication officers  from the department’s Bureau of Consular Affairs. To determine if  supervisors were reviewing records of visa issuances, we reviewed on line  reports at posts and at the Vulnerability Assessment Unit (VAU). To assess  whether the key internal controls were being followed, we examined post  records for the year preceding our visit, except in the case of referral  policies, where we examined judgmental samples of four months of  referrals at each post.
We visited 11 consular posts in six countries to observe and verify the  implementation of the key internal controls. These posts are Nogales,  Guadalajara, and Mexico City, Mexico; Quito and Guayaquil, Ecuador;  Lima, Peru; Ho Chi Minh City and Hanoi, Vietnam; Bangkok and Chiang  Mai, Thailand; and Mumbai, India. To select the posts to visit, we reviewed  overall post staffing data and issuance rates and selected posts that had  both large and small staffing levels with varied experience. Selected posts  performed a varying amount of adjudications, and some had regional  responsibilities for fraud detection and investigations. Some posts had also  undergone internal reviews and permitted examination of external  oversight functions. Lastly, some posts selected had been the subject of  fraud allegations, enabling the review of investigative procedures. Our  reported results apply to the posts we visited, and we cannot generalize the  results to posts not visited.
To assess the nature and extent of malfeasance, we examined records  provided by State’s Bureau of Diplomatic Security on investigations of visa  malfeasance involving employees between 2001 and 2004. We reviewed 140  cases collected by Diplomatic Security covering alleged visa malfeasance  involving employees over the last 4 years. The cases reviewed represented  2004, 2003, and 2002, as well as prominent, but not all cases from 2001. The  reports included information on the types of employees being investigated  for visa malfeasance, such as U.S. Foreign Service officers, and employees  of other U.S. government agencies overseas and locally hired staff.  Diplomatic Security does not maintain automated data on employee  malfeasance, and it obtained these reports for us by reviewing its files on  all types of visa fraud and identifying those where employee malfeasance  was involved. While Diplomatic Security reported that it made its best  efforts to obtain complete data from 2002 through 2004, it could not assure  us that it had identified every case that had been opened and involved  employee malfeasance. These data covered 2001 to 2004 because this was  the most recent information available. However, there were a number of  limitations in these data. For example, the information available did not  include a comprehensive set of allegations, nor completely describe the  nature of the fraudulent activity under investigation. We determined that  these data were sufficiently reliable to provide details on approximate  figures of the employee malfeasance cases that were opened, as well as  details about the types of cases. We also obtained information from the  Department of Justice on visa fraud prosecutions by the Public Integrity  Section conducted between January 2001 and March 2005. These data  allowed us to determine how many cases this office in Justice has pursued  in the last 4 years, as well as the status or outcome of those cases.  Additionally, we interviewed officials from State’s Office of the Inspector  General, Consular Affairs’ Office of Fraud Prevention, and its VAU. We  observed VAU officials as they conducted their analysis and queries. We  interviewed the fraud prevention staff and management at all the  embassies and consulates visited, and also interviewed the Regional  Security Officers and Assistant Regional Security Officers/Investigators at  all posts where such officers were posted and available.
To determine how State and Justice interact to investigate suspicious  activity and allegations of employee malfeasance, we interviewed officials  from State’s Bureaus of Consular Affairs and Diplomatic Security, and  Justice’s Criminal Division, Public Integrity Section, and the Executive  Office for United States Attorneys.
We conducted our work from August 2004 through July 2005 in accordance  with generally accepted government auditing standards.

Comments from the Department of State

GAO Contact and Staff Acknowledgments

	GAO Contact

	Staff Acknowledgments

In addition to the person named above, John Brummet, Assistant Director;  Claude Adrien; Joseph Carney; Martin de Alteriis; Etana Finkler; Patricia  Martin; and Mary Moutsos made key contributions to this report.

Summary:
Why GAO Did This Study

Issuing a U.S. visa to a foreign citizen in exchange for money or something of value is a crime that can facilitate entry into the United States of unqualified persons, including those who may wish to do our country harm. Internal controls make it difficult for an employee to commit visa malfeasance without being detected, but, despite these safeguards, visa malfeasance does occur. GAO examined (1) State's internal controls to prevent nonimmigrant visa malfeasance and if they are being implemented and (2) visa malfeasance cases from 2001-2004 and factors cited by State and the Department of Justice (Justice) that contributed to visa malfeasance and affected investigations and prosecutions.

What GAO Found

State has a set of internal controls to prevent visa malfeasance and has taken actions to improve them; however, these internal controls are not being fully and consistently implemented by the posts we visited. While State's controls are consistent with accepted control standards, we found noncompliance with required supervisory oversight at 6 of the 11 posts we visited. This included failure to inventory items used to issue visas, review visa decisions, and follow State's procedures when issuing visas for applicants referred by officers within the post. Lack of full compliance with internal controls increases vulnerability to visa malfeasance. State recently established two headquarters entities to monitor post visa operations. While stronger oversight should help strengthen compliance with internal controls, State has not developed automated software to sort and analyze abnormalities in visa issuances that could indicate potential malfeasance. The Bureau of Diplomatic Security substantiated 28 visa malfeasance cases between 2001 and 2004 involving U.S. employees. The suspects were fired, chose to resign, or were arrested. State investigators could not tell us how many opened cases were referred to Justice for possible prosecution because they had not been routinely collecting that information. In fact, their case records did not permit investigators to identify malfeasance trends or consular managers to identify internal control weaknesses needing attention. Justice's Public Integrity Section successfully prosecuted 10 U.S. government employees. State Diplomatic Security and Justice officials noted that their investigations and prosecutions were impeded by constraints on evidence gathering. Additionally, investigators can not obtain U.S. search warrants to search consular officer's offices or residences overseas. Justice and State are discussing the possibility of pursuing legal changes and other means to address these constraints.