Background

In 2007, almost 13 million citizens from 27 countries entered the United  States under the Visa Waiver Program. The program was created to  promote the effective use of government resources and facilitate  international travel without jeopardizing U.S. national security. The United  States last expanded the Visa Waiver Program’s membership in 1999; since  then, other countries have expressed a desire to become members. In  February 2005, President Bush announced that DHS and State would  develop a strategy, or “Road Map Initiative,” to clarify the statutory  requirements for designation as a participating country. According to DHS,  some of the countries seeking admission to the program are U.S. partners  in the war in Iraq and have high expectations that they will join the  program due to their close economic, political, and military ties to the  United States. As we reported in July 2006, DHS and State are consulting  with 13 “Road Map” countries seeking admission into the Visa Waiver  Program—Bulgaria, Cyprus, Czech Republic, Estonia, Greece, Hungary,  Latvia, Lithuania, Malta, Poland, Romania, Slovakia, and South Korea.
Following the terrorist attacks of September 11, 2001, Congress passed  additional laws to strengthen border security policies and procedures, and  DHS and State instituted other policy changes that have affected a  country’s qualifications for participating in the Visa Waiver Program. In  August 2007, Congress enacted the 9/11 Act, which provides DHS with the  authority to consider admitting into the Visa Waiver Program countries  that otherwise meet the program requirements, but have refusal rates  between 3 percent and 10 percent, provided the countries meet certain  conditions (see app. II for worldwide refusal rates for fiscal year 2007).  Before being admitted to the program, for example, the countries must  demonstrate a sustained reduction in refusal rates, and must be  cooperating with the United States on counterterrorism initiatives,  information sharing, and the prevention of terrorist travel, among other  things. In addition, DHS must complete two actions aimed at enhancing  the security of the program (see app. III for the key legislative  requirements for inclusion in the Visa Waiver Program). In particular, to  consider admitting countries into the Visa Waiver Program with refusal  rates between 3 percent and 10 percent, DHS must certify the following to  Congress:    A system is in place that can verify the departure of not less than 97  percent of foreign nationals who depart through U.S. airports. Initially,  this system will be biographic only. Congress required the eventual  implementation of a biometric exit system at U.S. airports. If the biometric  air exit system is not in place by July 1, 2009, the flexibility that DHS may  obtain to consider admitting countries with refusal rates between 3  percent and 10 percent will be suspended until the system is in place.
An electronic travel authorization system is “fully operational.” This  system will require nationals from Visa Waiver Program countries to  provide the United States with biographical information before boarding a  U.S.-bound flight to determine the eligibility of, and whether there exists a  law enforcement or security risk in permitting, the foreign national to  travel to the United States under the program. DHS recommends that  applicants obtain ESTA authorizations at the time of reservation or ticket  purchase, or at least 72 hours before their planned date of departure for  the United States. The ESTA application will electronically collect  information similar to the information collected in paper form by CBP.To the extent possible, according to DHS, applicants will find out almost  immediately whether their travel has been authorized, in which case they  are free to travel to the United States, or if their application has been  rejected, in which case they are ineligible to travel to the United States  under the Visa Waiver Program. Those found ineligible to travel under the  Visa Waiver Program must apply for a visa at a U.S. embassy to travel to  the United States.
In addition, the 9/11 Act requires that visa waiver countries    enter into an agreement with the United States to report, or make available  through Interpol or other means as designated by the Secretary of  Homeland Security, to the U.S. government information about the theft or  loss of passports within a strict time frame;    enter into an agreement with the United States to share information  regarding whether citizens and nationals of that country traveling to the  United States represent a threat to U.S. security; and    accept for repatriation any citizen, former citizen, or national of the  country against whom the United States has issued a final order of  removal.
When DHS exercises its authority to waive the 3 percent refusal rate  requirement, it shall, in consultation with State, take into account other  discretionary factors, pursuant to the 9/11 Act, including a country’s  airport security standards; whether the country assists in the operation of  an effective air marshal program; the standards of passports and travel  documents issued by the country; and other security-related factors,  including the country’s cooperation with (1) the United States’ initiatives  toward combating terrorism and (2) the U.S. intelligence community in  sharing information regarding terrorist threats. DHS works in consultation  with State and Justice, as well as the intelligence community, as part of  DHS’s assessment of countries seeking to join the Visa Waiver Program.

	Executive Branch Is Moving Quickly to Expand the Visa Waiver Program without a Transparent Process

The executive branch is moving aggressively to expand the Visa Waiver  Program by the end of 2008, but, in doing so, DHS has not followed a  transparent process for admitting new countries to the program—an  approach that has created confusion among other U.S. agencies in  Washington, D.C.; U.S. embassy officials overseas; and those countries  that are seeking to join the Visa Waiver Program. During the expansion  negotiations, DHS has achieved some security enhancements, such as new  agreements that, among other things, require the reporting of lost and  stolen blank and issued passports.

		DHS Has Not Followed a Transparent Process for Visa Waiver Program Expansion

We found that the Visa Waiver Program Office has not followed its own  standard operating procedures, completed in November 2007, which set  forth the key milestones that DHS and aspiring countries must meet before  additional countries are admitted into the program. According to the  standard procedures, State should submit to DHS a formal, written  nomination for a particular country, after which DHS is to lead an  interagency team to conduct an in-country, comprehensive review of the  impact of the country’s admission into the Visa Waiver Program on U.S.  security, law enforcement, and immigration interests. Figure 1 depicts the  standard procedures that the program office established to guide  expansion of the Visa Waiver Program compared with DHS’s actions since  August 2007. Although State has only nominated one country—Greece— DHS has nonetheless conducted security reviews for countries that State  has not yet nominated—Czech Republic, Estonia, Hungary, Latvia,  Lithuania, Slovakia, and South Korea. According to State officials, until  DHS has implemented the required provisions of the 9/11 Act, and aspiring  countries have met all of the Visa Waiver Program’s statutory  requirements, State does not plan to nominate any other countries. DHS’s  Assistant Secretary for Policy Development told us that the department  had determined that it would not follow the standard operating  procedures during these expansion negotiations and, thus, had to “make  up the process as it went along,” in part because DHS had never expanded  the program before and because Congress significantly changed the  program’s legislative requirements in August 2007.
Nov.
Dec.
Jn.
Fe.
Mr.
Apr.
Ag.
Sept.
Oct.
Nov.
Dec.
State and Justice officials told us that the lack of a transparent timeline  and requirements for Visa Waiver Program expansion has led to confusion  among U.S. agencies in headquarters’ offices and at U.S. embassies  overseas, as well as foreign governments seeking to join the program. For  example, DHS’s standard procedures were not updated to account for the  department’s plans to sign with each of the aspiring Visa Waiver Program  countries separate memorandums of understanding (MOU) that lay out the  new legislative requirements from the 9/11 Act. According to DHS, while  not required by the act, the U.S. government is seeking to negotiate MOUs  with current and aspiring Visa Waiver Program countries to help put the  legislative provisions in place. Although DHS has not yet signed MOUs  with any current program countries, the department intends to complete  negotiations with existing program countries by October 2009. As  indicated in figure 1, DHS signed MOUs with aspiring countries before  conducting in-country security reviews. The MOUs are to be accompanied  by more specific “implementing arrangements” for sharing biographic,  biometric, and other data, as required by the 9/11 Act, within general  parameters of what the United States is willing and able to reciprocate— this includes sharing information on known or suspected terrorists.  According to DHS, the type and scope of these arrangements will vary by  country and will take into account existing bilateral information-sharing  arrangements. As of June 2008, DHS had signed MOUs with eight Road  Map countries and had begun negotiations on the implementing  arrangements. However, State and Justice officials told us that DHS had  not been clear in communicating these steps to aspiring and current  program countries. DHS officials acknowledged that the department was  still exploring how to best complete the implementing arrangements. U.S.  embassy officials in several Road Map countries told us that it had been  difficult to explain the expansion process to their foreign counterparts and  manage their expectations about when those countries might be admitted  into the Visa Waiver Program. Justice officials and U.S. officials in several  embassies told us that the implementing arrangements may be more  difficult to negotiate than the nonbinding MOUs because some countries  have expressed concerns about sharing private information on their  citizens due to strict national privacy laws—concerns that the United  States also has about its citizens’ information. In response to our request,  in late April 2008, DHS provided us with an outline of the department’s  completed and remaining actions for expanding the Visa Waiver Program  by the end of this year. DHS officials stated that this outline could be a  first step in providing guidance for all stakeholders, should the program be  expanded again in the future. However, the outline does not include  criteria for selecting countries under consideration for admission into the  program, other than the 13 Road Map countries.
The U.S. government is only considering the Road Map countries for  potential admission into the program in 2008 because the United States  began formal discussions with these 13 countries several years ago, not  due to the application of clearly defined requirements. DHS is negotiating  with 4 Road Map countries with fiscal year 2007 refusal rates over 10  percent (Hungary, Latvia, Lithuania, and Slovakia), with the expectation  that fiscal year 2008 refusal rates for these countries will fall below 10  percent. State officials told us that they lacked a clear rationale to explain  to other aspiring, non-Road Map countries with refusal rates under 10  percent (Croatia, Israel, and Taiwan) that they will not be considered in  2008 due to the executive branch’s plans to expand the program first to  South Korea and countries in Central and Eastern Europe. In addition, on  May 1 of each year, State must report to Congress those countries that are  under consideration for inclusion in the Visa Waiver Program; the  department has never submitted this report because, according to  consular officials, no country has been under consideration for admission  into the program since the reporting requirement was established in 2000.  As of late June 2008, State had not yet submitted its report for 2008. A  State official told us that, despite the actions that DHS, State, and other  U.S. agencies have taken to expand the Visa Waiver Program to as many as  9 countries in 2008, State was initially unclear about which countries it  should include in this report. While only Greece has been nominated, DHS  has made clear its goal to admit many of the Road Map countries in 2008.  (Fig. 2 shows the fiscal year 2007 refusal rates for the 13 Road Map  countries.)
According to DHS, it could not wait until all statutory requirements were  officially met before beginning bilateral negotiations with Road Map  countries, because doing so would not allow sufficient time to add the  countries by the end of 2008. DHS plans to complete the security reviews  and sign MOUs and implementing arrangements with Road Map countries  by the fall of 2008. If these and all other statutory provisions are  completed—including countries’ achievement of refusal rates below 10  percent—State indicated that it will then formally nominate the countries.  However, DHS has acknowledged that if it and the aspiring countries  cannot meet all of the program’s statutory requirements, the United States  will not admit additional countries into the program. In such an event, the  U.S. government could face political and diplomatic repercussions, given  the expectations raised that many of the Road Map countries will be  admitted in 2008. DHS, State, and Justice officials acknowledged that  following a more transparent process would be useful in the future as  additional countries seek to join the program.

		DHS Has Achieved Some Results in Visa Waiver Program Expansion Negotiations

DHS’s expansion negotiations with current and aspiring Visa Waiver  Program countries have led to commitments from countries to improve  information sharing processes with the United States. For example, by  signing MOUs, eight aspiring countries have signaled their intent to  comply with the program’s statutory provision to report to the United  States or Interpol in a timely manner the loss or theft of passports—a key  vulnerability in the Visa Waiver Program, as we have previously reported.  In addition, as a result of ongoing visa waiver negotiations with the South  Korean government, in January 2008, DHS initiated the Immigration  Advisory Program at Incheon International Airport in South Korea to help  prevent terrorists and other high-risk travelers from boarding commercial  aircraft bound for the United States.Furthermore, a senior consular  official testified that the executive branch’s dialogue on Visa Waiver  Program expansion is helping to stimulate U.S. negotiations on other  terrorist watch-list- sharing arrangements with Road Map countries.

	DHS Has Not Fully Developed Tools Aimed at Assessing and Mitigating Risks in the Visa Waiver Program

As of early September 2008, DHS had not yet met two key certification  requirements in the 9/11 Act that are necessary to allow the department to  consider expanding the Visa Waiver Program to countries with refusal  rates between 3 percent and 10 percent. In addition, the Visa Waiver  Program Office does not fully consider data on overstay rates for current  and aspiring Visa Waiver Program countries, even though doing so is  integral to meeting a statutory requirement for continued eligibility in the  Visa Waiver Program. Finally, in reviewing recommendations from our  2006 report aimed at improving efforts to assess and mitigate program  risks, we found that DHS has implemented many of our prior  recommendations, but some are only partially implemented.

		DHS Has Not yet Implemented Key Security Provisions of 9/11 Act That Are Necessary to Admit Certain Countries into the Visa Waiver Program

On February 28, 2008, we testified that DHS’s plan for certifying that it can  verify the departure of 97 percent of foreign nationals from U.S. airports  will not help the department mitigate risks of the Visa Waiver Program.  Furthermore, DHS will face a number of challenges in implementing ESTA  by January 2009. Finally, it is unlikely that DHS will implement a biometric  air exit system before July 2009, due to opposition from the airline  industry.

			Plan to Verify the Air Departure of Foreign Nationals Will Not Help DHS Mitigate Program Risks

As we have previously mentioned, the 9/11 Act requires that DHS certify  that a system is in place that can verify the departure of not less than 97  percent of foreign nationals who depart through U.S. airports. In  December 2007, DHS reported to us that it will match records, reported by  airlines, of visitors departing the country to the department’s existing  records of any prior arrivals, immigration status changes,or prior  departures from the United States. At the time of our February 2008  testimony, DHS had confirmed that it planned to employ a methodology  that begins with departure records. During the hearing, we also testified  that this methodology will not demonstrate improvements in the air exit  system and will not help the department mitigate risks of the Visa Waiver  Program. We identified a number of weaknesses with this approach, as  follows:    First, DHS’s methodology will not inform overall or country-specific  overstay rates, which are key factors in determining illegal immigration  risks in the Visa Waiver Program. In particular, DHS’s methodology does  not begin with arrival records to determine if those foreign nationals  departed or remained in the United States beyond their authorized periods  of admission—useful data for oversight of the Visa Waiver Program and its  expansion. As we previously testified, an alternate approach would be to  track air arrivals from a given point in time and determine whether those  foreign nationals have potentially overstayed. Figure 3 compares DHS’s  plan to match visitor records using departure data as a starting point with  a methodology that would use arrival data as a starting point.
Second, for purposes of this provision and Visa Waiver Program  expansion, we do not see the value in verifying that a foreign national  leaving the United States had also departed at a prior point in time—in  other words, matching a new departure record back to a previous  departure record from the country. DHS’s Assistant Secretary for Policy  Development told us in January 2008 that the department chose to include  previous departures and changes of immigration status records because  this method allowed the department to achieve a match rate of 97 percent  or greater.
Third, DHS’s methodology does not address the accuracy of airlines’  transmissions of departure records, and DHS acknowledges that there are  weaknesses in the departure data. Foreign nationals who enter the United  States by air are inspected by DHS officers—a process that provides  information that can be used to verify arrival manifest data—and, since  2004, DHS has implemented the US-VISIT program to collect biometric  information on foreign nationals arriving in the United States.However,  the department has not completed the exit portion of this tracking system;  thus, there is no corresponding check on the accuracy and completeness  of the departure manifest information supplied by the airlines.According  to DHS, it works with air carriers to try to improve both the timeliness and  comprehensiveness of manifest records, and fines carriers that provide  incomplete or inaccurate information. If DHS could evaluate these data,  and validate the extent to which they are accurate and complete, the  department would be able to identify problems and work with the airlines  to further improve the data.
An air exit system that facilitates the development of overstay rate data is  important to managing potential risks in expanding the Visa Waiver  Program. We found that DHS’s planned methodology for meeting the “97  percent provision” so it can move forward with program expansion will  not demonstrate improvements in the air exit system or help the  department identify overstays or develop overstay rates. As of early  September 2008, DHS had not yet certified this provision, nor had it  finalized a methodology to meet the provision.

			DHS’s Planned Implementation of ESTA by January 2009 Will Face Challenges

In June 2008, DHS announced in the Federal Register that it anticipates  that all visa waiver travelers will be required to obtain ESTA authorization  for visa waiver travel to the United States after January 12, 2009. However,  we identified four potential challenges that DHS may face in implementing  ESTA, including a limited time frame to adequately inform U.S. embassies  and the public and the significant impact that ESTA will have on the airline  and travel industry.
We have previously reported that visa waiver travelers pose inherent  security and illegal immigration risks to the United States, since they   (1) are not subject to the same degree of screening as travelers with visas  and (2) are not interviewed by a consular officer before arriving at a U.S.  port of entry. In the 9/11 Act conference report,Congress agreed on the  need for significant security enhancements to the Visa Waiver Program  and to the implementation of ESTA prior to permitting DHS to admit new  countries into the program with refusal rates between 3 percent and 10  percent. According to DHS, ESTA will allow DHS to identify potential  ineligible visa waiver travelers before they embark on a U.S.-bound carrier.  DHS also stated that by recommending that travelers submit ESTA  applications 72 hours in advance of their departure, CBP will have  additional time to screen visa waiver travelers destined for the United  States.
DHS must follow several steps in implementing ESTA (see fig. 4). First, the  9/11 Act requires that DHS must certify both the 97 percent air exit system  and ESTA as fully operational before the department can consider  expanding the Visa Waiver Program to countries with refusal rates  between 3 percent and 10 percent. DHS has not announced when it plans  to make this certification. DHS attorneys told us that the department could  admit additional countries to the program once it provides this  certification. In addition, according to DHS, the act provides that 60 days  after the Secretary of Homeland Security publishes a final notice in the  Federal Register of the ESTA requirement, each alien traveling under the  Visa Waiver Program must use ESTA to electronically provide DHS with  biographic and other such information as DHS deems necessary to  determine, in advance of travel, the eligibility of, and whether there exists  a law enforcement or security risk in permitting, the alien to travel to the  United States. DHS stated that it expects to issue this final notice in early  November 2008, and, as of January 12, 2009, all visa waiver travelers would  be required to obtain authorization through ESTA prior to boarding a U.S.- bound flight or cruise vessel. DHS stated that if, after certifying ESTA as  fully operational, it admits an additional country prior to January 12, 2009,  it will require that visa waiver travelers from that country obtain ESTA  authorizations immediately. For example, if Estonia were admitted into  the Visa Waiver Program on October 10, 2008, citizens of that country  traveling to the United States under the program would be required to  begin using ESTA on that date; however, visa waiver travelers from  existing program countries would not be required to obtain approval  through ESTA until January 12, 2009, more than 3 months later.
Aug.
Sept.
Oct.
Nov.
Dec.
Jan.
We identified four potential challenges to DHS’s planned implementation  of ESTA by January 12, 2009. It is difficult to predict the extent to which  DHS will address these challenges due to the short time frame in which  the department is implementing the system. These challenges include the  following:    DHS has a limited time frame to adequately inform U.S. embassies in  Visa Waiver Program countries and the public about ESTA. U.S. embassy  officials in current and aspiring Visa Waiver Program countries told us that  the United States will need to ensure that there is sufficient time to inform  travelers, airlines, and the travel industry of ESTA requirements and  implementation timelines. U.S. commercial and consular officials at a U.S.  embassy in a current Visa Waiver Program country told us that they would  ideally like 1 year’s advance notice before ESTA is implemented to allow  sufficient time to inform and train the public and the travel industry of the  new requirement. However, DHS’s announcement in June 2008 accelerated  the timeline for ESTA implementation in current visa waiver countries.  During our site visits in March 2008, U.S. embassy officials in a visa waiver  country told us that they had been informed by DHS officials that the  department did not plan to require ESTA authorization for travelers from  that country until the summer of 2009 or later. According to a senior U.S.  official at one embassy, DHS had confirmed this plan with host country  government officials in early May 2008. Following the June 2008  announcement, a senior U.S. embassy official in another country told us  that DHS did not give the embassy adequate advance notice—to prepare  translated materials, brief journalists from the major media, prepare the  embassy Web site, or set up a meeting with travel and tourism  professionals to discuss the implications of ESTA requirements—before  publishing the interim final rule. DHS officials told us that the department  is currently working on an outreach strategy to ensure that travelers are  aware of the ESTA requirement.
Impact on air and sea carriers could be significant. DHS estimates that 8  U.S.-based air carriers and 11 sea carriers, as well as 35 foreign-based air  carriers and 5 sea carriers, will be affected by ESTA requirements for visa  waiver travelers. In addition, DHS stated that it did not know how many  passengers annually would request that their carrier apply for ESTA  authorization on their behalf to travel under the Visa Waiver Program or  how much it will cost carriers to modify their existing systems to  accommodate such requests. Thus, in the short term, DHS expects that the  carriers could face a notable burden if most of their non-U.S. passengers  request that their carriers submit ESTA applications. On the basis of DHS’s  analysis, ESTA could cost the carriers about $137 million to $1.1 billion  over the next 10 years, depending on how the carriers decide to assist the  passengers. DHS has noted that these costs to carriers are not compulsory  because the carriers are not required to apply for an ESTA authorization  on behalf of their visa waiver travelers. DHS is developing a separate  system, independent from ESTA, which will enable the travel industry to  voluntarily submit an ESTA application on behalf of a potential Visa  Waiver Program traveler. As of early August 2008, DHS had analyzed the  role that transportation carriers could play in applying for and submitting  ESTA applications on behalf of their customers when they arrive at an air  or sea port. However, CBP stated that there had been no further  development on this issue.
ESTA could increase consular workload. In May 2008, we reported that  State officials and officials at U.S. embassies in current Visa Waiver  Program countries are concerned with how ESTA implementation will  affect consular workload.Consular officers are concerned that more  travelers will apply for visas at consular posts if their ESTA applications  are rejected or because they may choose to apply for a visa that has a  longer validity period (10 years) than an ESTA authorization. We reported  that if 1 percent to 3 percent of current Visa Waiver Program travelers  came to U.S. embassies for visas, it could greatly increase visa demand at  some locations, which could significantly disrupt visa operations and  possibly overwhelm current staffing and facilities.DHS officials told us  that the department is aware of concerns regarding rejection rates and has  been working with State to create a system that mitigates these concerns.
Developing a user-friendly ESTA could be difficult. According to DHS,  the ESTA Web site will initially be operational in English; additional  languages will be available by October 15, 2008. Even when the Web site is  operational in additional languages, ESTA will only allow travelers to fill  out the application in English, as with CBP’s paper-based form. In  addition, during our site visits, embassy officials expressed concerns that  some Visa Waiver Program travelers do not have Internet access and, thus,  will face difficulties in submitting their information to ESTA.Implementing a user-friendly ESTA is essential, especially for those  travelers who do not have Internet access or are not familiar with  submitting forms online.

			Implementation of Biometric Air Exit System before July 2009 Will Be Difficult

A third provision of the 9/11 Act requires that DHS implement a biometric  air exit system before July 1, 2009, or else the department’s authority to  waive the 3 percent refusal rate requirement—and thereby consider  admitting countries with refusal rates between 3 percent and 10 percent— will be suspended until this system is in place. In March 2008, DHS  testified that US-VISIT will begin deploying biometric exit procedures in  fiscal year 2009. DHS released a proposed rule for the biometric exit  system in April 2008, and the department plans to issue a final rule before  the end of 2008. According to the proposed rule, air and sea carriers are to  collect, store, and transmit to DHS travelers’ biometrics. During the public  comment period on the proposed rule, airlines, Members of Congress, and  other stakeholders have raised concerns about DHS’s proposal, and  resolving these concerns could take considerable time. For example, the  airline industry strongly opposes DHS’s plans to require airline personnel  to collect digital fingerprints of travelers departing the United States  because it believes it is a public sector function. We have issued a series of  reports on the US-VISIT program indicating that there is no clear schedule  for implementation of the exit portion of the system, and that DHS will  encounter difficulties in implementing the system by July 2009. Although  DHS program officials stated that DHS is on track to implement the  biometric exit system by July 2009, it is unlikely that DHS will meet this  timeline. We are currently reviewing DHS’s proposed rule and plan to  report later this year on our findings.

		DHS Does Not Fully Consider Overstay Rates to Assess the Illegal Immigration Risks of the Visa Waiver Program

Some DHS components have expanded efforts to identify citizens who  enter the United States under the Visa Waiver Program and then overstay  their authorized period of admission. In 2004, US-VISIT established the  Data Integrity Group, which develops data on potential overstays by  comparing foreign nationals’ arrival records with departure records from  U.S. airports and sea ports. US-VISIT provides data on potential overstays  to ICE, CBP, and U.S. Citizenship and Immigration Services, as well as to  State’s consular officers to aid in visa adjudication. For example, US-VISIT  sends regular reports to ICE’s Compliance Enforcement Unit on potential  overstays, and ICE officials told us they use these data regularly during  investigations. In fiscal year 2007, ICE’s Compliance Enforcement Unit  received more than 12,300 overstay leads from the Data Integrity Group.As an example of one of these leads, on November 27, 2007, ICE agents in  Ventura, California, arrested and processed for removal from the United  States an Irish citizen whose term of admission expired in September 2006.  On the basis of concerns that Visa Waiver Program travelers could be  overstaying, ICE has requested that US-VISIT place additional emphasis on  identifying potential overstays from program countries. In turn, ICE has  received funding to establish a Visa Waiver Enforcement Program within  the Compliance Enforcement Unit to investigate the additional leads from  US-VISIT. As part of this funding, ICE plans to hire 46 additional  employees to help the unit increase its focus on identifying individuals  who traveled to the United States under the Visa Waiver Program and  potentially overstayed.
However, DHS is not fully monitoring compliance with a legislative  provision that requires a disqualification rate (this calculation includes  overstays) of less than 3.5 percent for a country to participate in the Visa  Waiver Program.Monitoring these data is a long-standing statutory  requirement for the program. We have testified that the inability of the U.S.  government to track the status of visitors in the country, identify those  who overstay their authorized period of visit, and use these data to  compute overstay rates has been a long-standing weakness in the  oversight of the Visa Waiver Program.DHS’s Visa Waiver Program Office  reported that it does not monitor country overstay rates as part of its  mandated, biennial assessment process for current visa waiver countries  because of weaknesses in US-VISIT’s data.
Since 2004, however, the Data Integrity Group has worked to improve the  accuracy of US-VISIT’s overstay data and can undertake additional  analyses to further validate these data. For example, using available  resources, the group conducts analyses, by hand, of computer-generated  overstay records to determine whether individuals identified as overstays  by the computer matches are indeed overstays. In addition, US-VISIT  analysts can search up to 12 additional law enforcement and immigration  databases to verify whether a potential overstay may, in fact, be in the  country illegally. While it receives periodic reporting on potential  overstays from US-VISIT, the Visa Waiver Program Office has not  requested that the Data Integrity Group provide validated overstay rate  estimates from visa waiver or Road Map countries since 2005. Although  DHS has not designated an office with the responsibility of developing  such data for the purposes of the Visa Waiver Program, US-VISIT officials  told us that, with the appropriate resources, they could provide more  reliable overstay data and estimated rates, by country, to the Visa Waiver  Program Office, with support from other DHS components, such as the  Office of Immigration Statistics. For example, the Visa Waiver Program  Office could request additional analysis for countries where the  preliminary, computer-generated overstay rates raised concerns about  illegal immigration risks in the program. These resulting estimates would  be substantially more accurate than the computer-generated overstay  rates. However, the resulting estimates would not include data on  departures at land ports of entry. In addition, as we have previously  mentioned, airline departure data have weaknesses.DHS has asserted  that overstay data will continue to improve with the implementation of the  biometric US-VISIT exit program.
In addition to US-VISIT, State’s overseas consular sections develop data on  overstay rates that might be useful for assessing potential illegal  immigration risks of the Visa Waiver Program. Specifically, some consular  sections have conducted validation studies to determine what percentage  of visa holders travel to the United States and potentially overstay. For  example, at the U.S. embassy in Estonia, consular officials conducted a  validation study in the summer of 2006 that concluded that 2.0 percent to  2.7 percent of Estonian visa holders traveling to the United States in 2005  had potentially overstayed. US-VISIT overstay data, after appropriate  analysis and in conjunction with other available data, such as validation  studies, would provide DHS with key information to help evaluate the  illegal immigration risks of maintaining a country’s membership or  admitting additional countries into the Visa Waiver Program.

		DHS Has Implemented Many of GAO’s Prior Recommendations Aimed at Improving Efforts to Assess and Mitigate Risks in the Visa Waiver Program

In July 2006, we reported that the process for assessing and mitigating  risks in the Visa Waiver Program had weaknesses, and that DHS was not  equipped with sufficient resources to effectively monitor the program’s  risks.For example, at the time of our report, DHS had only two full-time  staff charged with monitoring countries’ compliance with the program’s  requirements and working with countries seeking to join the program. We  identified several problems with the process by which DHS was  monitoring countries’ adherence to the program requirements, including a  lack of consultation with key interagency stakeholders. In addition, we  reported that DHS needed to improve its communication with officials at  U.S. embassies so it could communicate directly with officials best  positioned to monitor compliance with the program’s requirements, and  report on current events and issues of potential concern in each of the  participating countries. Also, at the time of our 2006 report, the law  required the timely reporting of passport thefts for continued participation  in the Visa Waiver Program, but DHS had not established or  communicated these time frames and operating procedures to  participating countries. In addition, DHS had not yet issued guidance on  what information must be shared, with whom, and within what time frame.
To address these weaknesses, we recommended that DHS take a number  of actions to better assess and mitigate risks in the Visa Waiver Program.  As we note in table 1, DHS has taken actions to implement some of our  recommendations, but still needs to fully implement others. In particular,  DHS has provided the Visa Waiver Program Office with additional  resources since our 2006 report. As of April 2008, the office had five  additional full-time employees, and two other staff from the Office of  Policy that devote at least 50 percent of their time to Visa Waiver Program  tasks. In addition, staff from several other DHS components assists the  office on a regular basis, as well as during the in-country security  assessments for Road Map and current program countries. In response to  our recommendation to finalize clear, consistent, and transparent  protocols for the biennial country assessment, the Visa Waiver Program  Office drafted standard operating procedures in November 2007 for  conducting reviews of nominated and participating visa waiver countries.
In addition, DHS now provides relevant stakeholders with copies of the  most current mandated, biennial country assessments; during our visits in  early 2008, U.S. embassy officials confirmed that the assessments are now  accessible. Furthermore, regarding our recommendation to develop and  communicate clear, standard operating procedures for the reporting of  lost and stolen blank and issued passports, DHS established criteria for the  reporting of lost and stolen passport data—including a definition of  “timely reporting” and an explanation of to whom in the U.S. government  countries should report—as part of the MOUs it is negotiating with  participating and Road Map countries.
Furthermore, DHS, in coordination with the U.S. National Central Bureau,  has initiated a system that allows DHS to screen foreign nationals arriving  at all U.S. international airports against Interpol’s database of lost and  stolen travel documents before the foreign nationals arrive in the country.  Results to date indicate that the system identifies two to three instances of  fraudulent passports per month. According to the National Central Bureau,  Interpol’s database has intercepted passports that were not identified by  DHS’s other screening systems. For example, on February 18, 2008, the  Interpol database identified a Nigerian national traveling on a  counterfeited British passport who attempted to enter the United States at  Newark International Airport. Upon arrival, the individual was referred to  secondary inspection and determined to be inadmissible to the United  States.
While DHS has taken action on many of our recommendations, it has not  fully implemented others. We recommended that DHS require that all Visa  Waiver Program countries provide the United States and Interpol with  nonbiographical data from lost or stolen blank and issued passports.  According to DHS, all current and aspiring visa waiver countries report  lost and stolen passport information to Interpol, and many report such  information to the United States. The 9/11 Act requires agreements  between the United States and Visa Waiver Program countries on the  reporting of lost and stolen passports within strict time limits; however,  none of the current visa waiver countries have yet to formally establish  lost and stolen passport reporting agreements by signing MOUs with DHS.  DHS also still needs to fully implement our recommendations to create  real-time monitoring arrangements, establish protocols for direct  communication with contacts at overseas posts, and require periodic  updates from these contacts. For example, while the Visa Waiver Program  Office has recently begun communicating and disseminating relevant  program information regularly with U.S. embassy points of contact at Visa  Waiver Program posts, officials at some of the posts we visited in early  2008 reported that they had little contact with the office and were not  regularly informed of security concerns or developments surrounding the  program.

	Conclusions

The executive branch is moving aggressively to expand the Visa Waiver  Program in 2008 to allies in Central and Eastern Europe and South Korea,  after the countries have met certain requirements and DHS has completed  and certified key security requirements in the 9/11 Act. However, DHS has  not followed a transparent process for expanding the program, thereby  causing confusion among other U.S. agencies and embassies overseas. The  lack of a clear process could bring about political repercussions if  countries are not admitted to the program in 2008, as expected. In  addition, DHS is not fully assessing a critical illegal immigration risk of the  Visa Waiver Program and its expansion since it does not consider overstay  data in its security assessments of current and aspiring countries. DHS  should determine what additional data and refinements of that data are  necessary to ensure that it can assess and mitigate this potential risk to the  United States. Finally, DHS still needs to take actions to fully implement  our prior recommendations in light of plans to expand the program.

	Recommendations for Executive Action

To improve management of the Visa Waiver Program and better assess and  mitigate risks associated with it, we are recommending that the Secretary  of Homeland Security take the following four actions:    establish a clear process, in coordination with the Departments of State  and Justice, for program expansion that would include the criteria used to  determine which countries will be considered for expansion and timelines  for nominating countries, security assessments of aspiring countries, and  negotiation of any bilateral agreements to implement the program’s  legislative requirements;    designate an office with responsibility for developing overstay rate  information for the purposes of monitoring countries’ compliance with the  statutory requirements of the Visa Waiver Program;    direct that established office and other appropriate DHS components to  explore cost-effective actions necessary to further improve, validate, and  test the reliability of overstay data; and    direct the Visa Waiver Program Office to request an updated, validated  study of estimated overstay rates for current and aspiring Visa Waiver  Program countries, and determine the extent to which additional research  and validation of these data are required to help evaluate whether  particular countries pose a potential illegal immigration risk to the United  States.

	Agency Comments and Our Evaluation

We provided a draft of this report to DHS, State, and Justice for review and  comment. DHS provided written comments, which are reproduced in  appendix IV, and technical comments, which we incorporated into the  report, as appropriate. Justice also provided written comments, which are  reprinted in appendix V. State did not provide comments on the draft  report.
DHS either agreed with, or stated that it was taking steps to implement, all  of our recommendations. For example, DHS indicated that it is working  with State to create procedures so that future Visa Waiver Program  candidate countries are selected and designated in as transparent and  uniform a manner as possible. In addition, DHS noted that it is taking steps  to improve the accuracy and reliability of the department’s overstay data.  DHS also provided additional details about its continued outreach efforts  to the department’s interagency partners and foreign counterparts on the  expansion process for the Visa Waiver Program. Justice did not comment  on our recommendations, but provided additional information about the  importance of monitoring countries’ reporting of lost and stolen passport  data to Interpol. In addition, Justice discussed its efforts, in collaboration  with DHS, to include screening against Interpol’s lost and stolen passport  database as part of ESTA. Justice noted that use of Interpol’s database  continues to demonstrate significant results in preventing the misuse of  passports to fraudulently enter the United States.
We are sending copies of this report to interested congressional  committees, the Secretaries of Homeland Security and State, and the U.S.  Attorney General. Copies of this report will be made available to others  upon request. In addition, this report is available at no charge on the GAO  Web site at http://www.gao.gov.
If you or your staffs have any questions about this report, please contact  Jess T. Ford, Director, International Affairs and Trade, at (202) 512-4128 or  fordj@gao.gov. Contact points for our Offices of Congressional Relations  and Public Affairs may be found on the last page of this report. Key  contributors to this report are listed in appendix VI.

Appendix I: Objectives, Scope, and Methodology

To describe the process that the Department of Homeland Security (DHS)  is following to admit countries into the Visa Waiver Program, we reviewed  laws governing the program and its expansion, and relevant regulations  and agency operating procedures, as well as our prior reports and  testimonies. In particular, we reviewed DHS’s standard operating  procedures for oversight and expansion of the Visa Waiver Program. We  spoke with officials from the Visa Waiver Program Office, which is  responsible for oversight of Visa Waiver Program requirements, as well as  representatives from the Department of State’s (State) Consular Affairs,  Europe and Eurasia, and East Asia and Pacific Bureaus. In addition, we  visited U.S. embassies in three current visa waiver countries—France,  Japan, and the United Kingdom—whose nationals comprise a large  percentage annually of visa waiver travelers to the United States. We also  visited U.S. embassies in four countries—Czech Republic, Estonia, Greece,  and South Korea—with which DHS is negotiating visa waiver status.  During these visits, we interviewed political, economic, consular,  commercial, and law enforcement officials regarding oversight of the Visa  Waiver Program and its expansion. We also conducted telephone  interviews with consular officials in four additional countries—Hungary,  Latvia, Lithuania, and Slovakia—that DHS also aims to admit into the Visa  Waiver Program in 2008. We did not interview officials in Bulgaria, Poland,  or Romania because DHS told us that it does not anticipate that these  countries will be admitted into the program in 2008. We did not interview  officials in Malta because of the country’s relatively small number of  annual Visa Waiver Program travelers to the United States.
To assess actions taken to mitigate potential risks in the Visa Waiver  Program, we focused on DHS’s efforts to implement the new security  enhancements required by the 9/11 Act, as well as the recommendations  from our July 2006 report. First, to review the department’s plans for air  exit system implementation, we collected and analyzed documentation  and interviewed officials from DHS’s Office of Policy, Customs and Border  Protection (CBP), and the U.S. Visitor and Immigrant Status and Indicator  Technology (US-VISIT) Program Office. We also reviewed prior GAO  reports on immigrant and visitor entry and exit tracking systems.
Second, to analyze plans for the implementation of the Electronic System  for Travel Authorization (ESTA), we collected and analyzed  documentation and interviewed officials from DHS’s Offices of Policy,  Screening Coordination, and General Counsel, as well as CBP officials  who are implementing the Web-based program. In addition, to understand  DHS’s legal position regarding the statutory requirements for ESTA  implementation, on May 5, 2008, we requested, in writing, DHS’s legal  position on certain ESTA statutory requirements, which the department  provided to us on June 6, 2008.
Third, regarding DHS’s efforts to monitor citizens who enter the United  States under the Visa Waiver Program and then overstay their authorized  period of admission (referred to as “overstays”), we assessed the reliability  of the US-VISIT data on potential overstays, which are based on air and  sea carriers’ arrival and departure data. We reviewed documentation and  interviewed cognizant U.S. VISIT officials about how data on potential  overstays are generated and validated. As we have previously mentioned,  we determined that data on potential overstays that are generated  automatically by US-VISIT’s systems have major limitations; however,  many of these limitations could be overcome by a series of manual checks  and validations that US-VISIT can perform, upon request.
Fourth, to determine the status of our prior recommendations to DHS on  oversight of the Visa Waiver Program, we developed a scale to classify  them as (1) implemented, (2) partially implemented, or (3) not  implemented. We collected and analyzed documentation and interviewed  officials from DHS’s Visa Waiver Program Office on the actions that office  has taken since July 2006 to respond to our recommendations. In addition,  we met with International Criminal Police Organization (Interpol) officials  in Lyon, France, as well as officials from the Department of Justice’s  Interpol-U.S. National Central Bureau to discuss the status of DHS’s access  to Interpol’s database of lost and stolen travel documents. We concluded  that a recommendation was (1) “implemented,” if the evidence indicated  that DHS had taken a series of actions addressing the recommendation;   (2) “partially implemented,” if the evidence indicated that DHS had taken  some action toward implementation; and (3) “not implemented,” if the  evidence indicated that DHS had not taken any action.
We conducted this performance audit from September 2007 to September  2008 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

Appendix II: Worldwide Refusal Rates for Short-term Business and Tourism Visas, Fiscal Year 2007

The Visa Waiver Program nonimmigrant visa refusal rate is based on the  number of visitor visa applications submitted, worldwide, by nationals of  that country. Visitor visas are issued for short-term business or pleasure  travel to the United States. The adjusted refusal rate is calculated by first  subtracting from the number of visas that were initially refused (referred  to as “refusals”), the number of visas that were subsequently issued after  further administrative consideration (referred to as “overcomes”)—or, in  short, refusals minus overcomes (see table 2). This resulting number is  then divided by the number of visa issuances plus refusals minus  overcomes—that is, refusals minus overcomes divided by issuances plus  refusals minus overcomes. Adjusted visa refusal rates for nationals of Visa  Waiver Program countries reflect only visa applications submitted at U.S.  embassies and consulates abroad. These rates do not take into account  persons who, under the Visa Waiver Program, travel to the United States  without visas. Visa Waiver Program country refusal rates, therefore, tend  to be higher than they would be if the Visa Waiver Program travelers were  included in the calculation, since such travelers in all likelihood would  have been issued visas had they applied, according to State. We are  presenting these data to show that the countries under consideration for  Visa Waiver Program admission do not all have refusal rates of less than 10  percent; we did not assess the reliability of these data.

Appendix III: Key Legislative Requirements for Inclusion in the Visa Waiver Program

The Immigration Reform and Control Act of 1986 created the Visa Waiver  Program as a pilot program.In 2000, the program became permanent  under the Visa Waiver Permanent Program Act.In 2002, we reported on  the legislative requirements to which countries must adhere before they  are eligible for inclusion in the Visa Waiver Program. In general, the  requirements are as follows:    A low nonimmigrant visa refusal rate. To qualify for visa waiver status, a  country must maintain a refusal rate of less than 3 percent for its citizens  who apply for business and tourism visas. If DHS certifies that it has met  certain requirements under the 9/11 Act, it will have the authority to waive  the 3 percent refusal rate requirement—currently up to a maximum of 10  percent—provided that the country meets other security requirements.
A machine-readable passport program. The country must certify that it  issues machine-readable passports to its citizens. As of June 26, 2005, all  travelers are required to have a machine-readable passport to enter the  United States under this program.
Reciprocity. The country must offer visa-free travel for U.S. citizens.
Persons entering the United States under the Visa Waiver Program must    have a valid passport issued by the participating country and be a national    be seeking entry for 90 days or less as a temporary visitor for business or    have been determined by CBP at the U.S. port of entry to represent no  threat to the welfare, health, safety, or security of the United States;    have complied with conditions of any previous admission under the  program (e.g., individuals must have stayed in the United States for 90  days or less during prior visa waiver visits);  if entering by air or sea, possess a round-trip transportation ticket issued  by a carrier that has signed an agreement with the U.S. government to  participate in the program, and must have arrived in the United States  aboard such a carrier; and  if entering by land, have proof of financial solvency and a domicile abroad  to which they intend to return.

Appendix IV: Comments from the Department of Homeland Security

Following are GAO’s comments on the Department of Homeland  Security’s letter dated August 27, 2008.

	GAO Comments

1.  We disagree that the department followed a transparent process for  expansion of the program. As we state in our report, State and Justice  officials told us that the lack of a transparent timeline and  requirements for Visa Waiver Program expansion has led to confusion  among U.S. agencies in headquarters’ offices and at U.S. embassies  overseas, as well as foreign governments seeking to join the program.  Moreover, absent clear direction from DHS, U.S. embassy officials in  several aspiring countries told us that it had been difficult to explain  the expansion process to their foreign counterparts and manage their  expectations about when those countries might be admitted into the  Visa Waiver Program. Therefore, we recommend in this report that  DHS establish a clear process, in coordination with State and Justice,  for program expansion. DHS noted that it is currently working to  create procedures so that future candidate countries are selected and  designated in as transparent and uniform a manner as possible and  expectations are appropriately managed during the process.  2.  Aside from the 13 Road Map countries identified in 2005, State officials  told us that they lacked a clear rationale to explain to other aspiring,  non-Road Map countries with refusal rates under 10 percent (Croatia,  Israel, and Taiwan) that they will not be considered in 2008 due to the  executive branch’s plans to expand the program first to South Korea  and countries in Central and Eastern Europe. DHS noted that it is  currently working to create procedures so that future candidate  countries are selected and designated in as transparent and uniform a  manner as possible and expectations are appropriately managed  during the process.  3.  We have updated the report to indicate that ESTA began accepting  voluntary applications from visa waiver travelers on August 1, 2008.  However, DHS does not anticipate that ESTA authorizations will be  mandatory for visa waiver travelers until after January 12, 2009. As we  state in our report, and as DHS noted, the department has not yet  certified that it can verify the departure of not less than 97 percent of  foreign nationals exiting U.S. airports, or that an Electronic System for  Travel Authorization (ESTA) for screening visa waiver travelers in  advance of their travel is “fully operational.” Moreover, DHS has not  yet implemented a biometric air exit system at U.S. airports. Thus,  DHS has not yet fully developed the tools to assess and mitigate risks  in the Visa Waiver Program.  4.  In July 2006, we reported that DHS needed to improve its  communication with officials at U.S. embassies so it could  communicate directly with officials best positioned to monitor  compliance with the program’s requirements, and report on current  events and issues of potential concern in each of the participating  countries. Therefore, we recommended that DHS establish points of  contact at U.S. embassies and develop protocols to ensure that the  Visa Waiver Program Office receives periodic updates in countries  where there are security concerns. As we note in this report, the Visa  Waiver Program Office has recently begun communicating and  disseminating relevant program information regularly with U.S.  embassy officials at Visa Waiver Program posts. However, despite our  requests during the course of this review—and again following our  receipt of DHS’s formal comments on the draft of this report—the  department has not provided us with sufficient documentation to  demonstrate that it has established points of contact at U.S. embassies  for all 27 participating countries or established protocols for  communications between these contacts and the Visa Waiver Program  Office. Furthermore, the department has not provided us with  documentation to demonstrate that established points of contact are  reporting periodically to the Visa Waiver Program Office. Therefore,  we cannot conclude that these 2006 recommendations are fully  implemented.  5.  DHS noted that it has not yet signed memorandums of understanding  (MOU) with any of the 27 current Visa Waiver Program countries.  Because the MOUs will commit all signatories to report to Interpol or  otherwise make available to the United States information about lost  and stolen blank and issued passports, this recommendation will  remain open until all MOUs are finalized.  6.  To verify the departure of not less than 97 percent of foreign nationals  exiting U.S. airports, DHS reported to us in December 2007 that it will  match records, reported by airlines, of visitors departing the country  with the department’s existing records of any prior arrivals,  immigration status changes, or prior departures from the United  States. In January 2008, the Assistant Secretary for Policy  Development made this statement, which corroborated data that we  received from US-VISIT in late October 2007. At the time of our  February 2008 testimony,DHS confirmed to us that it planned to  employ a methodology that begins with departure records; however, as  DHS indicated in its written comments on a draft of this report, it has  still not decided on a final methodology. DHS has not provided us with  information on any other options that it might be considering to meet  this provision. Furthermore, the department has not explained how  and when it intends to validate these data.

Appendix V: Comments from the Department of Justice

Appendix VI: GAO Contact and Staff Acknowledgments

	Staff Acknowledgments

In addition to the individual named above, John Brummet, Assistant  Director; Teresa Abruzzo; Kathryn Bernet; Joseph Carney; Martin de  Alteriis; Etana Finkler; Eric Larson; and Mary Moutsos made key  contributions to this report.

Summary:
Why GAO Did This Study

The Visa Waiver Program, which enables citizens of participating countries to travel to the United States without first obtaining a visa, has many benefits, but it also has risks. In 2006, GAO found that the Department of Homeland Security (DHS) needed to improve efforts to assess and mitigate these risks. In August 2007, Congress passed the 9/11 Act, which provides DHS with the authority to consider expanding the program to countries whose short-term business and tourism visa refusal rates were between 3 and 10 percent in the prior fiscal year. Countries must also meet certain conditions, and DHS must complete actions to enhance the program's security. GAO has examined DHS's process for expanding the Visa Waiver Program and evaluated the extent to which DHS is assessing and mitigating program risks. GAO reviewed relevant laws and procedures and interviewed agency officials in Washington, D.C., and in U.S. embassies in eight aspiring and three Visa Waiver Program countries.

What GAO Found

The executive branch is moving aggressively to expand the Visa Waiver Program by the end of 2008, but, in doing so, DHS has not followed a transparent process. DHS did not follow its own November 2007 standard operating procedures, which set forth key milestones to be met before countries are admitted into the program. As a result, Departments of State (State) and Justice and U.S. embassy officials stated that DHS created confusion among interagency partners and aspiring program countries. U.S. embassy officials in several aspiring countries told us it had been difficult to explain the expansion process to foreign counterparts and manage their expectations. State officials said it was also difficult to explain to countries with fiscal year 2007 refusal rates below 10 percent that have signaled interest in joining the program (Croatia, Israel, and Taiwan) why DHS is not negotiating with them, given that DHS is negotiating with several countries that had refusal rates above 10 percent (Hungary, Latvia, Lithuania, and Slovakia). Despite this confusion, DHS achieved some security enhancements during the expansion negotiations, including agreements with several aspiring countries on lost and stolen passport reporting. DHS, State, and Justice agreed that a more transparent process is needed to guide future program expansion. DHS has not fully developed tools to assess and mitigate risks in the Visa Waiver Program. To designate new program countries with refusal rates between 3 and 10 percent, DHS must first make two certifications. First, DHS must certify that it can verify the departure of not less than 97 percent of foreign nationals who exit from U.S. airports. In February 2008, we testified that DHS's plan to meet this provision will not help mitigate program risks because it does not account for data on those who remain in the country beyond their authorized period of stay (overstays). DHS has not yet finalized its methodology for meeting this provision. Second, DHS must certify that the Electronic System for Travel Authorization (ESTA) for screening visa waiver travelers in advance of their travel is "fully operational." While DHS has not announced when it plans to make this certification, it anticipates ESTA authorizations will be required for all visa waiver travelers after January 12, 2009. DHS determined that the law permits it to expand the program to countries with refusal rates between 3 and 10 percent after it makes these two certifications, and after the countries have met the required conditions, but before ESTA is mandatory for all Visa Waiver Program travelers. For DHS to maintain its authority to admit certain countries into the program, it must incorporate biometric indicators (such as fingerprints) into the air exit system by July 1, 2009. However, DHS is unlikely to meet this timeline due to several unresolved issues.In addition, DHS does not fully consider countries' overstay rates when assessing illegal immigration risks in the Visa Waiver Program. Finally, DHS has implemented many recommendations from GAO's 2006 report, including screening U.S.-bound travelers against Interpol's lost and stolen passport database, but has not fully implemented others. Implementing the remaining recommendations is important as DHS moves to expand both the program and the department's oversight responsibilities.