a

GAO

United States Government Accountability Office

Report to Congressional Committees

February 2005 HOMELAND 

SECURITY

Some Progress Made, 

but Many Challenges 

Remain on U.S. Visitor 

and Immigrant Status 

Indicator Technology 

Program

GAO-05-202
What GAO Found

United States Government Accountability Office

Why GAO Did This Study

Highlights

Accountability Integrity Reliability

www.gao.gov/cgi-bin/getrpt?GAO-05-202.

To view the full product, including the scope 

and methodology, click on the link above. 

For more information, contact Randolph C. 

Hite at (202) 512-3439 or hiter@gao.gov. 

Highlights of GAO-05-202, a report to the 

Subcommittees on Homeland Security, 

Senate and House Committees on 

Appropriations 

February 2005

HOMELAND SECURITY

Some Progress Made, but Many 

Challenges Remain on U.S. Visitor and 

Immigrant Status Indicator Technology 

Program 

DHS’s fiscal year 2005 expenditure plan and related documentation at least 

partially satisfied all conditions established by the Congress, including 

meeting the capital planning and investment control requirements of the 

Office of Management and Budget (OMB). For example, DHS has developed 

a plan and a process for developing, implementing, and institutionalizing a 

program to manage risk. 

In its observations about the expenditure plan and DHS’s management of the 

program, GAO recognizes accomplishments to date and addresses the need 

for rigorous and disciplined program practices. For example, US-VISIT has 

acquired the services of a prime integration contractor to augment its ability 

to complete US-VISIT. However, DHS has not employed rigorous, disciplined 

processes typically associated with successful programs, such as tracking 

progress against commitments. More specifically, the fiscal year 2005 plan 

does not describe progress against commitments made in previous plans 

(e.g., capabilities, schedule, cost, and benefits). According to GAO’s analysis, 

delays have occurred in delivering capability to track the entry and exit of 

persons entering the United States at air, land, and sea ports of entry; the 

figure compares original and current commitments in this effort, as well as 

progress in delivering capability. Such information is essential for oversight.

DHS Fiscal Year 2003 and 2004 Commitments Compared with Current Commitments and 

Reported Progress in Delivering Capabilities 

Source: US-VISIT, GAO (analysis). 

Initial exit pilot at 

1 air and 1 sea 

port of entry began

Entry at air and 

sea ports of entry 

delivered

Deliver entry and exit 

capability at air and 

sea ports of entry by 

12/31/03

Deliver entry and initial 

exit capability at the 50 

busiest land ports of 

entry by 12/31/04

2003 2004 2005

May J AS DJF J O N JO MAM J AS DJF N MAM J

Original commitments

Current commitments and progress

Delivery for 

entry at the 50 

busiest land 

ports of entry

Pilot for initial 

land ports of 

entry exit 

capability

Second exit 

pilot at air and 

sea ports of 

entry began

Additionally, the effort to pilot alternatives for delivering the capability to 

track the departure of persons exiting the United States is faced with a 

compressed time line, missed milestones, and potentially reduced scope. In 

particular, the pilot evaluation period has been reduced from 3 to 2 months, 

and as of early November 2004, the alternatives were deployed and operating 

in only 5 of the 15 ports of entry scheduled to be operational by November 1, 

2004. According to US-VISIT officials, this is largely due to delays in DHS 

granting security clearances to the civilian employees who would operate 

the equipment at the ports of entry. These changing facts and circumstances 

surrounding the pilot introduce additional risk concerning US-VISIT’s 

delivery of promised capabilities and benefits on time and within budget.

The Department of Homeland 

Security (DHS) has established a 

program—the U.S. Visitor and 

Immigrant Status Indicator 

Technology (US-VISIT)—to collect, 

maintain, and share information, 

including biometric identifiers, on 

selected foreign nationals who 

travel to the United States. By 

congressional mandate, DHS is to 

develop and submit for approval an 

expenditure plan for US-VISIT that 

satisfies certain conditions, 

including being reviewed by GAO. 

Among other things, GAO was 

asked to determine whether the 

plan satisfied these conditions and 

to provide observations on the plan 

and DHS’s program management. 

What GAO Recommends

To better ensure that the US-VISIT 

program is worthy of investment 

and is managed effectively, GAO is 

reiterating its previous 

recommendations and is making 

several new recommendations, 

including that DHS fully disclose in 

future expenditure plans its 

progress against previous 

commitments and that it reassess 

plans for deploying an exit 

capability. DHS concurred with 

GAO’s findings and 

recommendations. 
Page i GAO-05-202 Homeland Security

Contents

Letter 1

Compliance with Legislative Conditions 2

Status of Open Recommendations 2

Observations on the Expenditure Plan 9

Conclusions 11

Recommendations for Executive Action 12

Agency Comments 13

Appendixes

Appendix I: Briefing to the Staffs of the Subcommittees on Homeland 

Security, Senate and House Committees on Appropriations 14

Appendix II: Comments from the Department of Homeland Security 135

Appendix III: GAO Contact and Staff Acknowledgments 137

GAO Contact 137

Staff Acknowledgments 137
Contents

Page ii GAO-05-202 Homeland Security

Abbreviations

ACE Automated Commercial Environment 

ADIS Arrival Departure Information System 

APIS Advance Passenger Information System 

APMO Acquisition and Program Management Office 

BIF Biometric Information File 

CCD Consular Consolidated Database 

CLAIMS 3 Computer Linked Application Information Management System

DHS Department of Homeland Security

EA enterprise architecture 

IDENT Automated Biometric Identification System

NIIS I-94/Non-Immigrant Information System

NIST National Institute of Standards and Technology 

OMB Office of Management and Budget

OPM Office of Personnel Management 

POE port of entry

SA-CMM Software Acquisition Capability Maturity Model 

SEI Software Engineering Institute 

SEVIS Student Exchange Visitor Information System 

TECS Treasury Enforcement Communications Systems 

US-VISIT U.S. Visitor and Immigrant Status Indicator Technology 

WSA Work Station Attendant 

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. It may be reproduced and distributed in its entirety without further 

permission from GAO. However, because this work may contain copyrighted images or 

other material, permission from the copyright holder may be necessary if you wish to 

reproduce this material separately.
Page 1 GAO-05-202 Homeland Security

United States Government Accountability Office

Washington, D.C. 20548

A

February 23, 2005 Letr

The Honorable Thad Cochran

Chairman

The Honorable Robert C. Byrd

Ranking Minority Member

Committee on Appropriations

United States Senate

The Honorable Jerry Lewis

Chairman

The Honorable David R. Obey

Ranking Minority Member

Committee on Appropriations

House of Representatives

Pursuant to the Department of Homeland Security Appropriations Act, 

2005,1

 the Department of Homeland Security (DHS) submitted to the 

Congress in October 2004 its fiscal year 2005 expenditure plan for the U.S. 

Visitor and Immigrant Status Indicator Technology (US-VISIT) program. 

US-VISIT is a governmentwide program to collect, maintain, and share 

information on foreign nationals. The program’s goals are to enhance the 

security of U.S. citizens and visitors, facilitate legitimate trade and travel, 

ensure the integrity of the U.S. immigration system, and protect the privacy 

of U.S. visitors. As required by the appropriations act, we reviewed USVISIT’s fiscal year 2005 expenditure plan. Our objectives were to 

(1) determine whether the expenditure plan satisfies certain legislative 

conditions, (2) determine the status of our US-VISIT open 

recommendations,2

 and (3) provide any other observations about the 

expenditure plan and DHS’s management of US-VISIT.

On November 23, 2004, we briefed the Homeland Security Subcommittee 

staff on the results of our review. This report transmits the results of our 

1

Pub. L. 108-334 (Oct. 18, 2004).

2

Our previous recommendations regarding US-VISIT’s expenditure plans were published in 

GAO, Information Technology: Homeland Security Needs to Improve Entry Exit System 

Expenditure Planning, GAO-03-563 (Washington, D.C.: June 9, 2003); Homeland Security:

Risks Facing Key Border and Transportation Security Program Need to Be Addressed, 

GAO-03-1083 (Washington, D.C.: Sept. 19, 2003); and Homeland Security: First Phase of

Visitor and Immigration Status System Operating, but Improvements Needed, GAO-04-

586 (Washington, D.C.: May 11, 2004).
Page 2 GAO-05-202 Homeland Security

work. The full briefing, including our scope and methodology, is reprinted 

as appendix I. 

Compliance with 

Legislative Conditions

DHS satisfied or partially satisfied each of the applicable legislative 

conditions specified in the appropriations act. In particular, the plan, 

including related program documentation and program officials’ 

statements, satisfied or provided for satisfying all key aspects of federal 

acquisition rules, requirements, guidelines, and systems acquisition 

management practices. Additionally, the plan partially satisfied the 

conditions that specified (1) compliance with the capital planning and 

investment review requirements of the Office of Management and Budget 

(OMB), (2) compliance with DHS’s enterprise architecture, and (3) the 

plan’s review and approval by DHS’s Investment Review Board, the 

Secretary of Homeland Security, and OMB.

Status of Open 

Recommendations

DHS has completely implemented, has partially implemented, is in the 

process of implementing, or plans to implement all the remaining 

recommendations contained in our reports on the fiscal years 2002, 2003, 

and 2004 expenditure plans. Each recommendation, along with its current 

status, is summarized below:

• Develop a system security plan and privacy impact assessment.

The department has partially implemented this recommendation. First, 

the US-VISIT program has developed a security plan that provides an 

overview of system security requirements, describes the controls in place 

or planned for meeting those requirements, and refers to the applicable 

documents that prescribe the roles and responsibilities for managing the 

US-VISIT component systems. However, a security risk assessment of the 

program has not been completed, and the plan does not include a date for 

the assessment’s completion. Second, the US-VISIT program has completed 

a privacy impact assessment for Increment 2. However, the assessment 

does not satisfy all aspects of OMB guidance for such an assessment, such 

as fully addressing privacy issues in relevant system documentation.
Page 3 GAO-05-202 Homeland Security

• Develop and implement a plan for satisfying key acquisition 

management controls, including acquisition planning, solicitation, 

requirements development and management, project management, 

contract tracking and oversight, evaluation, and transition to 

support, and implement the controls in accordance with the Software 

Engineering Institute’s (SEI) guidance.3

The department is in the process of implementing this recommendation. 

The US-VISIT Acquisition and Program Management Office has initiated a 

process improvement program and drafted a process improvement plan. 

The office has also developed processes or plans, some of which are 

approved and some of which are in draft, for all except one of SEI’s 

Software Acquisition Capability Maturity Model (SA-CMM) Level 24

 key 

process areas. 

• Ensure that future expenditure plans are provided to the department’s 

House and Senate Appropriations Subcommittees in advance of USVISIT funds being obligated.

With respect to the fiscal year 2005 expenditure plan, DHS implemented

this recommendation by providing the plan to the Senate and House 

Subcommittees on October 19, 2004.

• Ensure that future expenditure plans fully disclose US-VISIT system 

capabilities, schedule, cost, and benefits to be delivered.

The department has partially implemented this recommendation. The 

expenditure plan identifies high-level capabilities and high-level schedule 

estimates. It also identifies the amounts budgeted for each increment for 

fiscal years 2003 through 2005, but it does not associate this funding with 

specific capabilities and benefits. Further, while the plan identifies several 

benefits and associates these benefits with increments, it does not include 

any information on related metrics or on progress against achieving any of 

the benefits.

3

Carnegie Mellon University SEI, Software Acquisition Capability Maturity Model®, 

Version 1.03 (March 2002), defines acquisition process management controls for planning, 

managing, and controlling software-intensive system acquisitions.

4

The SA-CMM ranks organizational maturity according to five levels. Levels 2 through 5 

require verifiable existence and use of certain key processes.
Page 4 GAO-05-202 Homeland Security

• Ensure that future expenditure plans fully disclose how the US-VISIT 

acquisition is being managed.

The department is in the process of implementing this recommendation. 

The fiscal year 2005 plan describes some activities being employed to 

manage the US-VISIT acquisition, such as the governance structure, 

program office organizational structure, and staffing levels. However, the 

department does not describe how other important aspects of the program 

are being managed, such as testing, system capacity, and system 

configuration.

• Ensure that human capital and financial resources are provided to 

establish a fully functional and effective program office.

The department has partially implemented this recommendation. As of 

October 2004, US-VISIT had filled 59 of its 115 government positions, with 

plans to fill about half the vacant positions once security clearances have 

been completed. As of November 2004, the program office had filled 88 of a 

planned 117 contractor positions. The expenditure plan indicates that DHS 

has budgeted $83 million to maintain the US-VISIT program management 

structure and baseline operations.

• Clarify the operational context in which US-VISIT is to operate.

The department is in the process of implementing this recommendation. In 

September 2003, DHS released version 1.0 of its enterprise architecture. We 

reviewed version 1.0 and found that it is missing, either partially or 

completely, all the key elements expected in a well-defined architecture, 

such as descriptions of business processes, information flows among these 

processes, and security rules associated with these information flows. 

Since we reviewed version 1.0 of the architecture, DHS has drafted version 

2.0. We have not reviewed version 2.0.
Page 5 GAO-05-202 Homeland Security

• Determine whether proposed US-VISIT increments will produce 

mission value commensurate with cost and risks.

The department is in the process of implementing this recommendation. 

US-VISIT developed a cost-benefit analysis for Increment 2B,5

 but it is 

unclear whether this increment will produce mission value commensurate 

with cost and risk. For example, the analysis addresses only government 

costs and does not address potential nongovernmental costs. Further, the 

analysis identifies three alternatives and identifies the third alternative as 

the preferred choice. However, US-VISIT is pursuing an alternative more 

closely aligned with alternative 2, because alternative 3 was considered too 

ambitious to meet statutorily required time lines.

• Define US-VISIT program office positions, roles, and responsibilities.

The department has partially implemented this recommendation. USVISIT has developed descriptions for positions within each office, and 

working with the Office of Personnel Management (OPM), it has drafted a 

set of core competencies that define the knowledge, skills, abilities, and 

other competencies needed for successful employee performance.

• Develop and implement a human capital strategy for the US-VISIT 

program office that provides for staffing positions with individuals 

who have the appropriate knowledge, skills, and abilities.

The department has partially implemented this recommendation. The USVISIT program office, in conjunction with OPM, has drafted a Human 

Capital Plan. The plan includes an action plan that identifies activities, 

proposed completion dates, and the organization responsible for 

completing these activities. The program office has completed some of the 

activities called for in the plan, including the designation of a liaison 

responsible for ensuring alignment between DHS and US-VISIT human 

capital policies. 

5

Increment 2B includes the electronic collection and matching of biographic and biometric 

information for foreign nationals entering the United States at the 50 busiest land ports of 

entry. DHS had planned to deploy this increment by December 2004. 
Page 6 GAO-05-202 Homeland Security

• Develop a risk management plan and report all high risks and their 

status to the executive body on a regular basis.

The department has partially implemented this recommendation. The USVISIT program office has developed a risk management plan and process 

and has established a governance structure involving three primary 

groups—the Risk Review Board, Risk Review Council, and Risk 

Management Team. The Risk Review Board represents the highest level of 

risk management within the program and is composed of senior level staff, 

such as the program director and functional area directors. However, USVISIT has not reported high risks beyond this board.

• Define performance standards for each US-VISIT program increment 

that are measurable and reflect the limitations imposed by relying on 

existing systems.

The department is in the process of implementing this recommendation. 

The US-VISIT program office has defined some technical performance 

measures—such as availability, timeliness, and output quantity—for 

Increments 1 and 2B, but it has not defined others, such as reliability, 

resource utilization, and scalability. Additionally, US-VISIT systems 

documentation does not contain sufficient information to determine the 

limitations imposed by US-VISIT’s reliance on existing systems that have 

less demanding performance requirements, such as the 98.0 percent 

availability of the Treasury Enforcement Communications Systems.6

• Develop and approve test plans before testing begins. These test plans 

should (1) specify the test environment; (2) describe each test to be 

performed, including test controls, inputs, and expected outputs; 

(3) define the test procedures to be followed in conducting the tests; 

and (4) provide traceability between test cases and the requirements 

to be verified by the testing.

The department is in the process of implementing this recommendation. 

According to the US-VISIT Systems Assurance Director, the Increment 2B 

system acceptance test plan was approved on October 15, 2004. However, 

no documentation was provided that explicitly indicated the approval of 

6

The Treasury Enforcement Communications Systems is a system that maintains lookout 

(i.e., watch list) data, interfaces with other agencies’ databases, and is currently used by 

inspectors at ports of entry to verify traveler information and update traveler data.
Page 7 GAO-05-202 Homeland Security

the plan. Further, the test plan did not fully address the test environment, 

include descriptions of tests to be performed, or provide test procedures to 

be followed in conducting the tests. The plan also did not provide 

traceability between test cases and the requirements to be verified by the 

testing. For example, 15 of the 116 requirements did not have test cases, 

and 2 requirements were labeled “not testable.”

• Ensure the independence of the Independent Verification and 

Validation (IV&V) Contractor.

The department is in the process of implementing this recommendation. 

The US-VISIT Information Technology (IT) Management Office is 

developing high-level requirements for IV&V, including a strategy and 

statement of work for acquiring an IV&V contractor.

• Implement effective configuration management practices, including 

establishing a US-VISIT change control board to manage and oversee 

system changes.

The department plans to implement this recommendation. The US-VISIT 

program office has not yet developed or implemented US-VISIT-level 

configuration management practices or a change control board. The office 

has developed a draft configuration management plan that describes key 

configuration management activities that are to be defined and 

implemented, such as defining and identifying processes and products to 

be controlled and recording and monitoring changes to the controlled 

items. The draft plan also proposes a governance structure, including 

change control boards. 

• Identify and disclose management reserve funding embedded in the 

fiscal year 2004 expenditure plan to the Appropriations 

Subcommittees.

The department has implemented this recommendation. The US-VISIT 

program office reported management reserve funding of $33 million for 

fiscal year 2004 in a briefing to the Subcommittees on Homeland Security, 

Senate and House Committees on Appropriations.
Page 8 GAO-05-202 Homeland Security

• Ensure that all future US-VISIT expenditure plans identify and 

disclose management reserve funding.

With respect to the fiscal year 2005 expenditure plan, DHS implemented

this recommendation. The fiscal year 2005 plan specified management 

reserve funding of $23 million.

• Assess the full impact of Increment 2B on land ports of entry 

workforce levels and facilities, including performing appropriate 

modeling exercises.

The department has partially implemented this recommendation. The USVISIT program office conducted an analysis to help determine the impact 

of Increment 2B on workforce and travelers. According to program 

officials, additional staff will not be needed to implement this increment at 

the land borders. In addition, the US-VISIT program office has conducted 

space utilization surveys at all of the 166 land ports of entry and has 

completed survey reports at 16 of the 50 busiest land ports of entry, with 

the remaining 34 reports planned to have been completed in the fall of 

2004. Although the survey reports indicated that most of the ports reviewed 

were at or near capacity and that facilities had no room for expansion, the 

program office maintains that Increment 2B will not require expansion of 

any facilities and will only require minor modifications.

• Develop a plan, including explicit tasks and milestones for 

implementing all our open recommendations and periodically report 

to the DHS Secretary and Under Secretary on progress in 

implementing this plan; also report this progress, including reasons 

for delays, in all future US-VISIT expenditure plans.

The Department is in the process of implementing this recommendation. 

The US-VISIT program office has developed a report for tracking the status 

of our open recommendations. This report is shared with the program 

office director but is not shared with the Secretary and Under Secretary. 
Page 9 GAO-05-202 Homeland Security

Observations on the 

Expenditure Plan

Our observations recognize accomplishments to date and address the need 

for rigorous and disciplined program management practices relating to 

describing progress against commitments, managing the exit alternatives 

pilot, managing system capacity, and estimating cost, as well as 

collaborating with DHS’s Automated Commercial Environment (ACE) 

program.7

 An overview of specific observations follows: 

• The program office has acquired the services of a prime integration 

contractor to augment its ability to complete US-VISIT. On May 28, 

2004, and on schedule, DHS awarded a contract for integrating existing 

and new business processes and technologies to a prime contractor and 

its related partners. 

• The fiscal year 2005 expenditure plan does not describe progress 

against commitments made in previous plans. Although this is the 

fourth US-VISIT expenditure plan, it does not describe progress against 

commitments made in the previous three plans. For example, the fiscal 

year 2004 plan committed to analyzing, field testing, and initiating 

deployment of alternative approaches for capturing biometrics during 

the exit process at air and sea ports of entry. However, while the fiscal 

year 2005 plan states that US-VISIT was to expand its exit pilot sites 

during the summer and fall of 2004 and deploy the exit solution during 

fiscal year 2005, it does not explain the reason for the change or its 

potential impact. Additionally, the fiscal year 2004 plan stated that $45 

million in fiscal year 2004 was to be used for exit activities. However, the 

fiscal year 2005 plan states that $73 million in fiscal year 2004 funds 

were to be used for exit activities, but it does not highlight this 

difference or address the reason for the change in amounts.

• The exit capability alternatives are faced with a compressed time line, 

missed milestones, and potentially reduced scope. In January 2004, USVISIT deployed an initial exit capability as a pilot to two ports of entry, 

while simultaneously developing other exit alternatives. The May 2004 

Exit Pilot Evaluation Plan stated that all exit pilot evaluation tasks were 

to be completed by September 2004. The plan allotted about 3 months to 

conduct the evaluation and report the results. However, an October 2004 

schedule indicated that all exit pilot evaluation tasks were to be 

7

ACE is a new trade processing system planned to support the movement of legitimate 

imports and exports and strengthen border security.
Page 10 GAO-05-202 Homeland Security

completed between late October 2004 and December 2004, which is 

about a 2-month evaluation and reporting period. As of early November 

2004, exit alternatives were deployed and operating in only 5 of the 15 

ports of entry that were scheduled to be operational by November 1, 

2004. According to program implementation officials, this was because 

of delays in DHS granting security clearances to the civilian employees 

who would operate the equipment at the ports of entry.

Additionally, the Evaluation Execution Plan describes the sample size of 

outbound passengers required to be evaluated at each port. This sample 

size will produce a specified confidence level in the evaluation results. 

Because of the reduced evaluation time frame, the program still plans to 

collect the desired sample size at each port by adding more personnel to 

the evaluation teams if needed. These changing facts and circumstances 

surrounding the exit pilot introduce additional risk concerning US-VISIT’s 

delivery of promised capabilities and benefits on time and within budget.

• US-VISIT and ACE collaboration is moving slowly. In February 2003, 

we recognized the relationship between US-VISIT and ACE and 

recommended steps to promote close collaboration between these two 

programs. Since then, US-VISIT and ACE managers have met to identify 

potential areas for collaboration between the two programs and to 

clarify how the programs can best support the DHS mission and provide 

officers with the information and tools they need. However, explicit 

plans have not been developed nor actions taken to understand USVISIT/ACE dependencies and relationships. Because both programs are 

making decisions on how to further define, design, develop, and 

implement these systems, it is important that they exploit their 

relationships to reduce rework that might be needed to integrate the 

programs.

• US-VISIT system capacity is being managed in a compartmentalized 

manner. Currently, DHS does not have a capacity management 

program.8

 Instead, the US-VISIT IT Management Office relies on the 

respective performance management activities of the pre-existing 

systems, such as those managed by U.S. Customs and Border Protection 

and U.S. Immigration and Customs Enforcement. Until US-VISIT has 

8

Capacity management is intended to ensure that systems are properly designed and 

configured for efficient performance and have sufficient processing and storage capacity for 

current, future, and unpredictable workload requirements.
Page 11 GAO-05-202 Homeland Security

developed a comprehensive performance management and capacity 

planning program, the program will continue to be reactive in its efforts 

to ensure that US-VISIT system resources are sufficient to meet current 

workloads, increasing the risk that it may not be able to adequately 

support mission needs.

• The cost estimating process used for Increment 2B did not follow some 

key best practices. The US-VISIT cost estimate did not fully satisfy most 

of the criteria called for in SEI guidance.9

 For example, costs related to 

development and integration tasks for US-VISIT component systems are 

specified, but information about estimated software lines of code is not. 

Additionally, no one outside the US-VISIT program office reviewed and 

concurred with the cost estimating categories and methodology. 

Without reliable cost estimates, the ability to make informed investment 

decisions and effectively manage progress and performance is reduced.

Conclusions The fiscal year 2005 expenditure plan (with related program office 

documentation and representations) either partially satisfies or satisfies 

the legislative conditions imposed by Congress. Further, steps are planned, 

initiated, under way, or completed to address all of our open 

recommendations. However, overall progress in addressing the 

recommendations has been slow, leaving considerable work to be done. 

Given that most of these open recommendations are aimed at correcting 

fundamental limitations in DHS’s ability to manage the program in a way 

that ensures the delivery of (1) mission value commensurate with costs and 

(2) promised capabilities on time and within budget, it is important that 

DHS implement the recommendations quickly and completely through 

effective planning and continuous monitoring and reporting. Until this 

occurs, the program will be at high risk of not meeting its stated goals on 

time and within budget.

To its credit, the program office now has its prime contractor on board to 

support both near-term increments and to plan for and deliver the yet-to-bedefined US-VISIT strategic solution. However, it is important to recognize 

that this accomplishment is a beginning and not an end. The challenge for 

DHS is now to effectively and efficiently work with the prime contractor in 

achieving desired mission outcomes.

9

Carnegie Mellon University SEI, A Manager’s Checklist for Validating Software Cost and 

Schedule Estimates, CMU/SEI-95-SR-004 (January 1995).
Page 12 GAO-05-202 Homeland Security

To accomplish this, it is important that DHS move swiftly in building its 

program management capacity, which is not yet in place, as shown by the 

status of our open recommendations and our recent observations about 

(1) economic justification of US-VISIT Increment 2B, (2) completion of the 

exit pilot evaluation, (3) collaboration with a closely related import/export 

processing and border security program, (4) system capacity management 

activities, and (5) cost estimating practices. Moreover, it is important that 

DHS improve its measurement and disclosure to its Appropriations 

Subcommittees of its progress against commitments made in prior 

expenditure plans, so that the Subcommittees’ ability to effectively oversee 

US-VISIT’s plans and progress is not unnecessarily constrained.

Nevertheless, the fact remains that the program continues to invest 

hundreds of millions of dollars for a mission-critical capability under 

circumstances that introduce considerable risk that cost-effective mission 

outcomes will not be realized. At a minimum, it is incumbent upon DHS to 

fully disclose these risks, along with associated mitigation steps, to 

executive and congressional leaders so that timely and informed decisions 

about the program can be made.

Recommendations for 

Executive Action

To better ensure that the US-VISIT program is worthy of investment and is 

managed effectively, we reiterate our prior recommendations and further 

recommend that the Secretary of Homeland Security direct the Under 

Secretary for Border and Transportation Security to ensure that the USVISIT program director takes the following five actions:

• Fully and explicitly disclose in all future expenditure plans how well 

DHS is progressing against the commitments that it made in prior 

expenditure plans. 

• Reassess its plans for deploying an exit capability to ensure that the 

scope of the exit pilot provides for adequate evaluation of alternative 

solutions and better ensures that the exit solution selected is in the best 

interest of the program.

• Develop and implement processes for managing the capacity of the USVISIT system.

• Follow effective practices for estimating the costs of future increments.
Page 13 GAO-05-202 Homeland Security

• Make understanding the relationships and dependencies between the 

US-VISIT and ACE programs a priority matter, and report periodically to 

the Under Secretary on progress in doing so. 

Agency Comments In written comments on a draft of this report, signed by the Acting Director, 

Departmental GAO/IG Liaison Office (reprinted in app. II), DHS concurred 

with our findings and recommendations. DHS also stated that it 

appreciated the guidance that the report provides for future efforts and 

described actions taken and progress made in implementing the US-VISIT 

program.

We are sending copies of this report to the Chairmen and Ranking Minority 

Members of other Senate and House committees and subcommittees that 

have authorization and oversight responsibilities for homeland security. We 

are also sending copies to the Secretary of Homeland Security, Secretary of 

State, and the Director of OMB. Copies of this report will also be available 

at no charge on our Web site at www.gao.gov.

Should you or your offices have any questions on matters discussed in this 

report, please contact me at (202) 512-3439 or at hiter@gao.gov. Another 

contact and key contributors to this report are listed in appendix III.

Randolph C. Hite

Director, Information Technology Architecture 

and Systems Issues
Page 14 GAO-05-202 Homeland Security

Appendix I

Briefing to the Staffs of the Subcommittees on Apendxies

Homeland Security, Senate and House 

Committees on Appropriations ApendxiI

 

1

Homeland Security: Some Progress Made, but 

Many Challenges Remain on U.S. Visitor and 

Immigrant Status Indicator Technology Program

Briefing to the Staffs of the

Subcommittees on Homeland Security

Senate and House Committees on Appropriations

November 23, 2004
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 15 GAO-05-202 Homeland Security

2

Briefing Overview

• Introduction

• Objectives

• Results in Brief

• Background

• Results

• Legislative Conditions

• Status of Open Recommendations

• Observations

• Conclusions

• Recommendations for Executive Action

• Agency Comments

• Attachment 1. Scope and Methodology

• Attachment 2. Recent Studies of US-VISIT
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 16 GAO-05-202 Homeland Security

3

Introduction

The U.S. Visitor and Immigrant Status Indicator Technology (US-VISIT) program of 

the Department of Homeland Security (DHS) is a governmentwide program to 

collect, maintain, and share information on foreign nationals. The goals of USVISIT are to 

• enhance the security of U.S. citizens and visitors,

• facilitate legitimate travel and trade,

• ensure the integrity of the U.S. immigration system, and 

• protect the privacy of our visitors.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 17 GAO-05-202 Homeland Security

4

Introduction

The US-VISIT program involves the interdependent application of people,

processes, technology, and facilities.

Note: GAO analysis based on DHS data.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 18 GAO-05-202 Homeland Security

5

Introduction

The Department of Homeland Security Appropriations Act, 2005,1 states that DHS 

may not obligate $254 of the $340 million appropriated for the US-VISIT program 

until the Senate and House Committees on Appropriations receive and approve a 

plan for expenditure that 

• meets the capital planning and investment control review requirements

established by the Office of Management and Budget (OMB), including OMB 

Circular A-11, part 7;2

• complies with DHS’s enterprise architecture;

• complies with the acquisition rules, requirements, guidelines, and systems 

acquisition management practices of the federal government;

• is reviewed and approved by the DHS Investment Review Board, the Secretary

of Homeland Security, and OMB; and

• is reviewed by GAO.

1Pub. L. 108-334 (Oct. 18, 2004).

2OMB Circular A-11 establishes policy for planning, budgeting, acquisition, and management of federal capital assets.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 19 GAO-05-202 Homeland Security

6

Introduction

On October 19, 2004, DHS submitted its fiscal year 2005 expenditure plan for $340 

million to the House and Senate Appropriations Subcommittees on Homeland

Security.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 20 GAO-05-202 Homeland Security

7

Objectives

As agreed, our objectives were to

1. determine whether the US-VISIT fiscal year 2005 expenditure plan satisfies the 

legislative conditions,

2. determine the status of our US-VISIT open recommendations, and 

3. provide any other observations about the expenditure plan and DHS’s

management of US-VISIT.

We conducted our work at US-VISIT offices in Rosslyn, Virginia, from June 2004 

through November 2004, in accordance with generally accepted government

auditing standards. Details of our scope and methodology are described in

attachment 1 of this briefing.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 21 GAO-05-202 Homeland Security

8

Results in Brief: Objective 1

Legislative Conditions

Fiscal Year 2005 US-VISIT Expenditure Plan’s Satisfaction of Legislative

Conditions

aSatisfies or provides for satisfying many, but not all, key aspects of the condition that we reviewed.

bSatisfies or provides for satisfying every aspect of the condition that we reviewed.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 22 GAO-05-202 Homeland Security

9

Results in Brief: Objective 2

Open Recommendations 

Status of Actions to Implement Our 19 Open Recommendations

aActions are planned to implement the recommendation.

bActions have been initiated to implement the recommendation.

cActions are under way to implement the recommendation.

dActions have been taken that fully implement the recommendation.

eThe Software Acquisition Capability Maturity Model (SA-CMM®) developed by Carnegie Mellon University’s Software Engineering Institute (SEI)

defines acquisition process management controls for planning, managing, and controlling software-intensive system acquisitions.

f

With respect to the fiscal year 2005 expenditure plan.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 23 GAO-05-202 Homeland Security

10

Results in Brief: Objective 2

Open Recommendations 

Status of Actions to Implement Our 19 Open Recommendations

gThe purpose of independent verification and validation is to provide an independent review of processes and products throughout the acquisition

and deployment phase.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 24 GAO-05-202 Homeland Security

11

Results in Brief: Objective 3

Observations

Summary of GAO Observations

• The program office has acquired the services of a prime integration contractor

to augment its ability to complete US-VISIT.

• The fiscal year 2005 Expenditure Plan does not describe progress against

commitments (e.g., capabilities, schedule, cost, and benefits) made in previous

plans.

• The exit capability alternatives evaluation is faced with a compressed time line, 

missed milestones, and potentially reduced scope.

• US-VISIT and Automated Commercial Environment (ACE)3 collaboration is 

moving slowly.

• US-VISIT system capacity is being managed in a compartmentalized manner.

• The cost estimating process used for Increment 2B did not follow some key

best practices.

3ACE is a new trade processing system planned to support the movement of legitimate imports and exports and

strengthen border security.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 25 GAO-05-202 Homeland Security

12

Results in Brief: Objective 3

Observations

To assist DHS in managing US-VISIT, we are making five recommendations to the 

Secretary of DHS.

In their comments on a draft of this briefing, US-VISIT program officials stated that 

they generally agreed with our findings, conclusions, and recommendations.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 26 GAO-05-202 Homeland Security

13

Background

US-VISIT Overview

The US-VISIT program is a governmentwide endeavor intended to enhance the 

security of U.S. citizens and visitors, facilitate legitimate travel and trade, ensure 

the integrity of the U.S. immigration system, and protect the privacy of our visitors. 

US-VISIT is to accomplish these things by 

• collecting, maintaining, and sharing information on certain foreign nationals

who enter and exit the United States;

• identifying foreign nationals who (1) have overstayed or violated the terms of 

their visit; (2) can receive, extend, or adjust their immigration status; or 

(3) should be apprehended or detained by law enforcement officials;

• detecting fraudulent travel documents, verifying traveler identity, and 

determining traveler admissibility through the use of biometrics; and

• facilitating information sharing and coordination within the border management

community.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 27 GAO-05-202 Homeland Security

14

Background

US-VISIT Program Office

US-VISIT Program Office Structure
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 28 GAO-05-202 Homeland Security

15

Background

Acquisition Strategy

DHS plans to deliver US-VISIT capability incrementally. Currently, DHS has

decided that there will be four increments, with Increments 1 through 3 being

interim, or temporary, solutions, and Increment 4 being the yet-to-be-defined future 

vision for US-VISIT. Increments 1 through 3 include the interfacing and

enhancement of existing system capabilities and the deployment of these 

capabilities to air, sea, and land ports of entry (POE). These increments are to be 

largely acquired through the implementation of existing contracts and task orders.

In May 2004, DHS awarded an indefinite-delivery/indefinite-quantity4 prime contract 

to Accenture and its partners.5 This collection of contractors is known as the Smart 

Border Alliance.

4An indefinite-delivery/indefinite-quantity contract provides for an indefinite quantity, within stated limits, of supplies or services

during a fixed period of time. The government schedules deliveries or performance by placing orders with the contractor.

5Accenture’s partners include, among others, Raytheon Company, the Titan Corporation, and SRA International, Inc.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 29 GAO-05-202 Homeland Security

16

Background

Acquisition Strategy

According to the contract, the prime contractor will support the integration and

consolidation of processes, functionality, and data, and will develop a strategy to 

build on the technology and capabilities already available to fully support the USVISIT vision. Meanwhile, the US-VISIT program will continue to leverage existing

contractors in deploying the interim solution using the prime contractor to assist.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 30 GAO-05-202 Homeland Security

17

Background

Overview of Increments

Increment 1 Status

Increment 1 (air and sea) includes the electronic collection and matching of

biographic and biometric information at all major air and some sea POEs for 

selected foreign travelers with visas.6 As of September 30, 2004, Increment 1 was 

expanded to include foreign nationals from visa waiver countries.

On January 5, 2004, Increment 1 capability was deployed to 115 airports and 14 

seaports for entry and as a pilot to 2 POEs for exit.7 US-VISIT is evaluating three 

additional exit alternatives and has recently deployed these alternatives to three

additional POEs.8

68 C.F.R. 235.1(d)(1)(iv) and 215.8(a)(2) state that classes of travelers that are not subject to US-VISIT are foreign nationals

admitted on A-1, A-2, C-3 (except for attendants, servants, or personal employees of accredited officials), G-1, G-2, G-3, G-4,

NATO-1, NATO-2, NATO-3, NATO-4, NATO-5, or NATO-6 visas; certain Taiwan officials who hold E-1 visas and members of 

their immediate families who hold E-1 visas, unless the Secretary of State and the Secretary of Homeland Security jointly

determine that a class of such aliens should be subject to the rule; children under the age of 14; persons over the age of 79;

classes of aliens to whom the Secretary of Homeland Security and the Secretary of State jointly determine it shall not apply;

and an individual alien to whom the Secretary of Homeland Security, the Secretary of State, or the Director of Central

Intelligence determines shall not be subject to the rule.

7At that time, the pilot employed a self-serve kiosk to capture biographic information and biometric data (two index

fingerprints). The pilots are deployed to Miami Royal Caribbean seaport and the Baltimore/Washington International Airport.

8Chicago O’Hare International Airport, Denver International Airport, and Dallas/Ft. Worth International Airport.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 31 GAO-05-202 Homeland Security

18

Background

Overview of Increments

The three alternatives are as follows:

• The enhanced kiosk captures a digital photograph and prints out a receipt. 

• The mobile device includes a handheld wireless unit at the gates to capture

electronic fingerprints and photographs.

• The hybrid combines the enhanced kiosk, which is used to generate a receipt,

with the mobile device, which scans the receipt and the electronic fingerprint of 

the traveler at the gate to verify exit.

As of November 18, 2004, US-VISIT had processed about 13 million foreign

nationals, including about 2 million from visa waiver countries. According to USVISIT, it had positively matched over 1,500 persons against watch list databases.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 32 GAO-05-202 Homeland Security

19

Background

Overview of Increments

Increment 2 Plans

Increment 2 is divided into three Increments—2A, 2B, and 2C. 

• Increment 2A (air, sea, and land) is to provide all POEs the capability to 

process machine-readable visas and other travel and entry documents that

use biometric identifiers; it is to be implemented by October 26, 2005.9

• Increment 2B (land) is to expand the Increment 1 solution for entry to 

secondary inspection10 at the 50 highest volume land POEs by December 31,

2004.11 According to the US-VISIT Increment 2B Manager, US-VISIT deployed 

Increment 2B as a pilot to three sites on November 15, 2004.12

9Pub. L. 108-299 (Aug. 9, 2004) extended the deadline from October 26, 2004, to October 26, 2005.

10Secondary inspection is used for more detailed inspections that may include checking more databases, conducting more

intensive interviews, or both.

11As required by the Immigration and Naturalization Service Data Management Improvement Act of 2000, 8 U.S.C.

1365a(d)(2).

12The three sites are Laredo, Texas; Port Huron, Michigan; and Douglas, Arizona.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 33 GAO-05-202 Homeland Security

20

Background

Overview of Increments

• Increment 2C (border technology and infrastructure) is to deliver a solution

that captures both entry and exit information using technologies such as radio

frequency technology13 at primary inspection and exit lanes. US-VISIT plans to 

deploy this technology to one or more POEs by June 2005.

Increment 3 Plans

• Increment 3 (land) is to expand Increment 2B system capability to the 

remaining 115 land POEs. It is to be implemented by December 31, 2005.14

Increment 4 Plans

• Increment 4 (long-term strategy) is the yet-to-be-defined future vision of USVISIT program capability, which US-VISIT officials have stated will likely

consist of a series of releases. The program is currently working with its prime

contractor and partners to develop an overall vision for immigration and border

management operations.

13Radio frequency (RF) technology relies on proximity cards and card readers. RF devices read the information contained on

the card when the card is passed near the device and can also be used to verify the identity of the cardholder.

14As required by the Immigration and Naturalization Service Data Management Improvement Act of 2000, 8 U.S.C.

1365a(d)(3).
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 34 GAO-05-202 Homeland Security

21

Background

Facilities and Staffing

For facilities, US-VISIT is installing the infrastructure, such as new computer

workstations, printers, peripherals (fingerprint scanning machines/camera),

modifications to the counters, and printer stands, and ensuring adequate power

availability for the collection of biometric and biographical information in secondary

inspection areas for Increment 2B. DHS is working with the Federal Highway

Administration, state transportation departments, and the U.S. General Services

Administration on a “proof of concept” for the new RF technology associated with 

Increment 2C, which is still in the preliminary stages.

For human capital, DHS does not anticipate the need for additional inspection staff 

for Increment 2B. 
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 35 GAO-05-202 Homeland Security

22

Background

Component Systems

US-VISIT (Increments 1 through 4) will potentially include the interfacing of over 19 

existing systems. Examples of systems included in Increment 1 and 2B are as 

follows:

• Treasury Enforcement Communications Systems (TECS) is a system that 

maintains lookout (i.e., watch list) data,15 interfaces with other agencies’

databases, and is currently used by inspectors at POEs to verify traveler

information and update traveler data. Within TECS are several databases,

including the following:

• Advance Passenger Information System (APIS) includes arrival and

departure manifest information provided by air and sea carriers.

• Crossing History includes information about individuals’ crossing histories.

15Lookout data sources include DHS’s Customs and Border Protection and Immigration and Customs Enforcement;

the Federal Bureau of Investigation (FBI); legacy DHS systems; the U.S. Secret Service; the U.S. Coast Guard; the

Internal Revenue Service; the Drug Enforcement Agency; the Bureau of Alcohol, Tobacco, & Firearms; the U.S.

Marshals Service; the U.S. Office of Foreign Asset Control; the National Guard; the Treasury Inspector General; the 

U.S. Department of Agriculture; the Department of Defense Inspector General; the Royal Canadian Mounted Police;

the U.S. State Department; Interpol; the Food and Drug Administration; the Financial Crimes Enforcement Network;

the Bureau of Engraving and Printing; and the Department of Justice Office of Special Investigations.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 36 GAO-05-202 Homeland Security

23

Background

Component Systems

• Biographic Watchlist includes biographic information on individuals of 

interest.

• Secondary includes the results of prior secondary inspections performed 

on an individual, including if the person was admitted or denied entry.

• US-VISIT Biometric Information File (BIF) includes keys or links to other 

databases in TECS, IDENT, and ADIS and includes such information as

fingerprint identification numbers, name, and date of birth.

• Addresses includes addresses of individuals.

• I-94/Non-Immigrant Information System (NIIS) includes information from I94 forms.

• US-Visa (Datashare) includes Department of State records of visa 

applications, such as photographs, biographic information, and fingerprint

identification number.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 37 GAO-05-202 Homeland Security

24

Background

Component Systems

• Arrival Departure Information System (ADIS) is a database that stores traveler 

arrival and departure data and that provides query and reporting functions.

• Automated Biometric Identification System (IDENT) is a system that collects 

and stores biometric data about foreign visitors.16

• Student Exchange Visitor Information System (SEVIS) is a system that 

contains information on foreign students. 

• Computer Linked Application Information Management System (CLAIMS 3) is 

a system that contains information on foreign nationals who request benefits,

such as change of status or extension of stay.

• Consular Consolidated Database (CCD) is a system that includes information

on whether a visa applicant has previously applied for a visa or currently has a 

valid U.S. visa.

16Includes data such as FBI information on all known and suspected terrorists, selected wanted persons (foreign-born,

unknown place of birth, previously arrested by DHS), and previous criminal histories for high-risk countries; DHS

Immigration and Customs Enforcement information on deported felons and sexual registrants; and DHS information on

previous criminal histories and previous IDENT enrollments. Information from the FBI includes fingerprints from the

Integrated Automated Fingerprint Identification System.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 38 GAO-05-202 Homeland Security

25

Background

Increment 1 Process

Increment 1 Processes

According to DHS, Increment 1 includes the following five processes: pre-entry,

entry, status management, exit, and analysis, which are depicted in the graphic

below.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 39 GAO-05-202 Homeland Security

26

Background

Increment 1 Process

Pre-entry Process:

Pre-entry processing begins with initial petitions for visas, grants of visa status, or 

the issuance of travel documentation. When a foreign national applies for a visa at 

a U.S. consulate, biographic and biometric data are collected. The biometric data 

(i.e., fingerprint scan of the right and left index fingers) are transmitted from State to 

DHS, where the fingerprints are run against IDENT to verify identity. The results of 

the biometric check are transmitted back to State. A “hit” response prevents State’s 

system from printing a visa for the applicant until the information is reviewed and 

cleared by a consular officer. 

Commercial air and sea carriers are required by law to transmit crew and 

passenger manifests before arriving in the United States.17 These manifests are 

transmitted through APIS. The APIS lists are run against the biographic lookout

system and identify those arrivals who have biometric data available.

In addition, POEs review the APIS list for a variety of factors that would target

arriving crew and passengers for additional processing.

178 U.S.C. 1221(a).
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 40 GAO-05-202 Homeland Security

27

Background

Increment 1 Process

Entry Process:

When the foreign national arrives at a primary POE inspection booth, the inspector,

using a document reader, scans the machine-readable travel documents. APIS 

returns any existing records on the foreign national, including manifest data

matches and biographic lookout hits. When a match is found in the manifest data, 

the foreign national’s name is highlighted and outlined on the manifest data portion 

of the screen. 

Biographic information, such as name and date of birth, is displayed on the bottom 

half of the screen, as well as the photograph from State’s CCD. TECS also returns 

information about whether there are, within IDENT, existing fingerprints for the 

foreign national.

The inspector switches to another screen and scans the foreign national’s

fingerprints (left and right index fingers) and takes a photograph. The system 

accepts the best fingerprints available within the 5-second scanning period. This 

information is forwarded to IDENT, where it is checked against stored fingerprints

in the IDENT lookout database.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 41 GAO-05-202 Homeland Security

28

Background

Increment 1 Process

If no prints are currently in IDENT, the foreign national is enrolled in US-VISIT (i.e., 

biographic and biometric data are entered). If the foreign national’s fingerprints are 

already in IDENT, the system performs a 1:1 match (a comparison of the fingerprint

taken during the primary inspection to the one on file) to confirm that the person 

submitting the fingerprints is the person on file. If the system finds a mismatch of 

fingerprints or a watch list hit, the foreign national is sent to secondary inspection

for further screening or processing.

While the system is checking the fingerprints, the inspector questions the foreign

national about the purpose of his or her travel and length of stay. The inspector

adds the class of admission and duration of stay information into TECS, and

stamps the “admit until” date on the I-94 form.18

If the foreign national is ultimately determined to be inadmissible, the person is 

detained, lookouts are posted in the databases, and appropriate actions are taken.

18The I-94 form is used to track the arrival and departure of nonimmigrants. It is divided into two parts. The first part is an 

arrival portion, which includes, for example, the nonimmigrant’s name, date of birth, and passport number. The second part is

a departure portion, which includes the name, date of birth, and country of citizenship.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 42 GAO-05-202 Homeland Security

29

Background

Increment 1 Process

Within 2 hours after a flight lands and all passengers have been processed, TECS 

is to send ADIS the records showing the class of admission and the “admit until”

dates that were modified by the inspector.

Status Management Process:

The status management process manages the foreign national’s temporary

presence in the United States, including the adjudication of benefits applications

and investigations into possible violations of immigration regulations.

Commercial air and sea carriers are required by law to transmit departure 

manifests electronically for each passenger.19 These manifests are transmitted 

through APIS and shared with ADIS. ADIS matches entry and exit manifest data to 

ensure that each record showing a foreign national entering the United States is 

matched with a record showing the foreign national exiting the United States. ADIS 

also provides the ability to run queries on foreign nationals who have entry

information but no corresponding exit information. ADIS receives status information

from CLAIMS 3 and SEVIS on foreign nationals.

198 U.S.C. 1221(b).
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 43 GAO-05-202 Homeland Security

30

Background

Increment 1 Process

Exit Process:

The exit process includes the carriers’ electronic submission of departure manifest

data to APIS. This biographic information is passed to ADIS, where it is matched 

against entry information. As we have previously discussed, when the foreign

national departs the country through a pilot location, the departure is processed by 

one of three alternative pilot methods. The alternative used is dependent on the 

departure port. Within each port, one or more alternatives will be deployed. Not all 

alternatives are deployed to every pilot port. All three alternatives are generally

operated by a Work Station Attendant (WSA), although the mobile device can 

sometimes be operated by a law enforcement officer. Foreign nationals are

informed of the requirement to process through exit upon departure.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 44 GAO-05-202 Homeland Security

31

Background

Increment 1 Process

The three alternatives are as follows.

• Enhanced kiosk: The traveler approaches the kiosk for departure processing.

At the kiosk, the traveler, guided by a WSA if needed, scans the machinereadable travel documents, provides electronic fingerprints, and has a digital

photograph taken. A receipt is printed to provide documentation of compliance

with the exit process and to assist in compliance on the traveler’s next

attempted entry to the country. After the receipt prints, the traveler proceeds to 

his/her departure gate. At the conclusion of the transaction, the collected 

information is transmitted to IDENT.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 45 GAO-05-202 Homeland Security

32

Background

Increment 1 Process

• Mobile device: At the departure gate, and just before the traveler boards the

departure craft, either a WSA or law enforcement officer scans the machinereadable travel documents, scans the traveler’s fingerprints (right and left index 

fingers), and takes a digital photograph. A receipt is printed to provide 

documentation of compliance with the exit process and to assist in compliance

on the traveler’s next attempted entry to the country. The device wirelessly

transmits the captured data in real time to IDENT via the Transportation

Security Administration’s Data Operations Center.

If the device is being operated by a WSA, the WSA provides a printed receipt

to the traveler, and the traveler then boards the departure craft. If the mobile 

device is being operated by a law enforcement officer, the captured biographic

and biometric information is checked in near real time against watch lists. Any 

potential match is returned to the device and displayed visually for the officer. If 

no match is found, the traveler boards the departure craft.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 46 GAO-05-202 Homeland Security

33

Background

Increment 1 Process

• Hybrid: Using an enhanced kiosk, the traveler, guided by a WSA if needed,

scans the machine-readable travel documents, provides electronic fingerprints,

and has a digital photograph taken.

As with the enhanced kiosk alternative, a receipt is printed to provide 

documentation of compliance with the exit process and to assist in compliance

on the traveler’s next attempted entry to the country. However, this receipt has

biometrics (i.e., the traveler’s fingerprints and photograph) embedded on the

receipt. At the conclusion of the transaction, the collected information is 

transmitted to IDENT.

The traveler presents his or her receipt to the WSA or law enforcement officer 

at the gate or departure area, who scans the receipt using a mobile device.

The traveler’s identity is verified against the biometric data embedded on the 

receipt. Once the traveler’s identity is verified, he/she is allowed to board the

departure craft. The captured information is not transmitted in real time back to 

IDENT. Data collected on the mobile device are periodically uploaded through

the kiosk to IDENT.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 47 GAO-05-202 Homeland Security

34

Background

Increment 1 Process

Analysis:

An ongoing analysis capability is to provide for the continuous screening against

watch lists of individuals enrolled in US-VISIT for appropriate reporting and action.

As more entry and exit information becomes available, it can be used to analyze

traffic volume and patterns as well as to perform risk assessments. The analysis is 

to be used to support resource and staffing projections across the POEs, strategic

planning for integrated border management analysis performed by the intelligence

community, and determination of travel use levels and expedited traveler programs.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 48 GAO-05-202 Homeland Security

35

Background

Increment 2B Process

Increment 2B Processes

As mentioned previously, US-VISIT has recently deployed Increment 2B (which is 

focused on land POEs) as a pilot and plans to fully deploy the increment by

December 31, 2004. Increment 2B is similar to Increment 1, with several 

noteworthy differences.

• No advance passenger information is to be available to the inspector before

the traveler arrives for inspection.

• Travelers subject to US-VISIT are to be processed at secondary inspection,

rather than at primary inspection.

• Inspectors’ workstations are to use a single screen, which eliminates the need

to switch between the TECS and IDENT screens. 
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 49 GAO-05-202 Homeland Security

36

Background

Increment 2B Process

• Form I-94 data are to be captured electronically. The form is populated by data

obtained when the machine-readable zone of the travel document is swiped. If 

visa information about the traveler exists in the Datashare database,20 it is 

used to populate the form. Fields that cannot be populated electronically are

manually entered. A copy of the completed form is printed and given to the 

traveler for use upon exit.

• No electronic exit information is to be captured.

20Datashare includes a data extract from State’s CCD system and includes the visa photograph, biographical data, and

the fingerprint identification number assigned when a nonimmigrant applies for a visa.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 50 GAO-05-202 Homeland Security

37

Background

Increments 1 and 2B Overview

Simplified

Diagram of 

US-VISIT

Increment 1 

and 2B 

Systems
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 51 GAO-05-202 Homeland Security

38

Background

Chronology of Expenditure Plans

Chronology of US-VISIT Expenditure Plans

Since November 2002, four US-VISIT expenditure plans have been submitted.

• On November 15, 2002, the Immigration and Naturalization Service (INS)21

submitted to its appropriations subcommittees its first expenditure plan, which 

outlined $13.3 million in expenditures for contract activities; design, 

development, and deployment of the Visa Waiver Support System; facilities

assessments; biometric standards development; prototyping; IBIS support 

activities; travel; program office operations; and fingerprint scanner

procurements.

• On June 5, 2003, the second expenditure plan outlined $375 million in

expenditures for system enhancements and infrastructure upgrades, POE 

information technology (IT) and communication upgrades, facilities planning

analysis and design, program management support, proof of concept 

demonstrations, operations and system sustainment, and training.

21Effective March 1, 2003, INS became part of DHS.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 52 GAO-05-202 Homeland Security

39

Background

Chronology of Expenditure Plans

• On January 27, 2004, the third expenditure plan outlined $330 million in 

expenditures for exit pilots; capability to read biometrically enabled travel

documents; land infrastructure upgrades; system development and testing; 

radio frequency technology deployment to the 50 busiest land POEs; technical

infrastructure planning and development; program management; and

operations and maintenance.

• The current and fourth expenditure plan, submitted on October 19, 2004,

outlines $340 million in expenditures (see table, next slide).
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 53 GAO-05-202 Homeland Security

40

Background

Review of Current Expenditure Plan

Fiscal Year 2005 Expenditure Plan Summary (see next slides for descriptions)

Area of expenditure Amount

Increment 1—Air and Sea $32,000,000

Increment 2A—Air, Sea, and Land 15,000,000

Increment 2B—Land 0

Increment 2C—Border Technology and Infrastructure 55,000.000

Increment 3—Land 25,000,000

Increment 4—Long-Term Strategy 21,000,000

Program Management 83,000,000

Operations and Maintenance 86,000,000

Management Reserve 23,000,000

Total $340,000,000

Source: DHS.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 54 GAO-05-202 Homeland Security

41

Background

Current Expenditure Plan

Increment 1—Air and Sea: Includes deploying an exit capability to capture 

departure information and acquiring lease space for exit at air and sea POEs.

Increment 2A—Air, Sea, and Land: Includes continued work on developing and 

testing the US-VISIT equipment and software necessary to biometrically compare

and authenticate travel documents.

Increment 2C—Border Technology and Infrastructure: Includes testing,

modeling, and deploying technology to provide the capability to view previously

collected biographic and biometric data of enrolled travelers and integrating Border 

Crossing Card biometric data with IDENT.

Increment 3—Land: Includes extending the Increment 2B capability to collect

biometric data and verify identity at the 115 remaining land POEs.

Increment 4—Long-Term Strategy: Includes developing the long-term strategy;

integrating the strategy with the interim system, legacy systems, and the DHS

enterprise architecture; and planning for facilities compliance.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 55 GAO-05-202 Homeland Security

42

Background

Current Expenditure Plan

Program Management: Includes maintaining the program management structure 

and baseline operations.

Operations and Maintenance: Includes operations and maintenance of existing

information systems and support costs for ongoing software configuration and

maintenance.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 56 GAO-05-202 Homeland Security

43

Objective 1: Legislative Conditions

Condition 1

The US-VISIT expenditure plan satisfies or partially satisfies each of the legislative

conditions.

Condition 1. The plan, including related program documentation and program

officials’ statements, partially satisfies the capital planning and investment control 

review requirements established by OMB, including OMB Circular A-11, part 7, 

which establishes policy for planning, budgeting, acquisition, and management of 

federal capital assets.

The table that follows provides examples of the results of our analysis.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 57 GAO-05-202 Homeland Security

44

Objective 1: Legislative Conditions

Condition 1

Examples of A-11 conditions Results of our analysis

Provide justification and describe

acquisition strategy.

US-VISIT has completed an Acquisition Plan, dated November

2003. The plan provides a high-level justification and

description of the acquisition strategy for the system.

Summarize life-cycle costs and

cost/benefit analysis, including the

return on investment.

US-VISIT completed a cost/benefit analysis for Increment 2B

on June 11, 2004.

Provide performance goals and

measures.

The plan includes benefits, but does not identify corresponding

metrics. The plan states that performance measures are under

development.

Address security and privacy. US-VISIT has developed a security plan that partially satisfies

OMB and the National Institute of Standards and Technology

security guidance. US-VISIT has not yet conducted a security

risk assessment on the overall US-VISIT program. While the

plan states the intention to do the assessment, it does not

specify when it will be completed. The US-VISIT program

published a privacy policy and privacy impact assessment for

Increment 2.

Provide risk inventory and

assessment.

US-VISIT has developed a risk management plan and process

for developing, implementing, and institutionalizing a risk

management program. Risks are currently tracked using a risktracking database.

Source: GAO.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 58 GAO-05-202 Homeland Security

45

Objective 1: Legislative Conditions

Condition 2

Condition 2. The plan, including related program documentation and program

officials’ statements, partially satisfies the condition that it provide for compliance

with DHS’s enterprise architecture (EA). 

DHS released version 1.0 of the architecture in September 2003.22 We reviewed 

the initial version of the architecture and found that it was missing, either partially or 

completely, all the key elements expected in a well-defined architecture, such as a 

description of business processes, information flows among these processes, and 

security rules associated with these information flows.23 Since we reviewed version 

1.0, DHS has drafted version 2.0 of its EA. We have not reviewed this draft.

22Department of Homeland Security Enterprise Architecture Compendium Version 1.0 and Transitional Strategy.

23GAO, Homeland Security: Efforts Under Way to Develop Enterprise Architecture, but Much Work Remains, GAO-04-777

(Washington, D.C.: Aug. 6, 2004).
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 59 GAO-05-202 Homeland Security

46

Objective 1: Legislative Conditions

Condition 2

According to officials from the Office of the Chief Strategist, concurrent with the 

development of the strategic vision, the US-VISIT program office has been working

with the DHS EA program office in developing version 2.0 to ensure that US-VISIT

is aligned with DHS’s evolving EA. According to these officials, US-VISIT

representatives participate in both the DHS EA Center of Excellence and the DHS 

Enterprise Architecture Board.24

In July 2004, the Center of Excellence reviewed US-VISIT’s submission for 

architectural alignment with some EA components, but not all. Specifically, the 

submission included information intended to show compliance with business and 

data components, but not, for example, the application and technology

components. According to the head of DHS’s EA Center of Excellence, the

application and technical components were addressed by this center, which found 

that US-VISIT was in compliance.

24The Center of Excellence supports the Enterprise Architecture Board in reviewing component documentation. The purpose

of the Board is to ensure that investments are aligned with the DHS EA.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 60 GAO-05-202 Homeland Security

47

Objective 1: Legislative Conditions

Condition 2

Based on its review, the DHS Enterprise Architecture Board recommended that the 

US-VISIT program be given conditional approval to proceed for investment,

provided that the program resubmit its documentation upon completion of its 

strategic plan, which is anticipated in January 2005. DHS has not yet provided us 

with sufficient documentation to allow us to understand DHS architecture 

compliance methodology and criteria, or verifiable analysis justifying the conditional

approval.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 61 GAO-05-202 Homeland Security

48

Objective 1: Legislative Conditions

Condition 3

Condition 3. The plan, including related program documentation and program

officials’ statements, satisfies the condition that it comply with the acquisition rules,

requirements, guidelines, and systems acquisition management practices of the 

federal government.

The plan provides for satisfying this condition, in part, by describing efforts to 

develop Software Engineering Institute (SEI) Software Acquisition Capability

Maturity Model (SA-CMM) key process areas, such as requirements development

and management and contract tracking and oversight. The plan also states that the 

program intends to achieve SA-CMM Level 225 by establishing a process

improvement program based on SEI-identified industry best practices. As part of 

establishing this program, US-VISIT has developed a draft process improvement

plan that specifies process improvement goals, objectives, assumptions, and risks, 

and which describes a process improvement time line and phase methodology.

If these processes are implemented effectively, they will help US-VISIT meet

federal acquisition rules, requirements, and guidelines and comply with systems

acquisition management practices.

25The SA-CMM ranks organizational maturity according to five levels. Maturity levels 2 through 5 require verifiable existence

and use of certain key process areas.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 62 GAO-05-202 Homeland Security

49

Objective 1: Legislative Conditions

Condition 4

Condition 4. The plan, including related program documentation and program

officials’ statements, partially satisfies the requirement that it be reviewed and

approved by the DHS Investment Review Board (IRB), the Secretary of Homeland

Security, and OMB.

The DHS Under Secretary for Management26 reviewed and approved the fiscal

year 2005 expenditure plan on October 14, 2004, and OMB approved the plan on 

October 15, 2004.

According to the US-VISIT Budget and Finance Director, the IRB reviewed the

fiscal year 2005 expenditure plan but did not approve it because DHS management

determined that review of the expenditure plan was not in the scope of the IRB 

review process.

26According to DHS Delegation Number 0201.1, the Secretary of Homeland Security delegated authority to the Under

Secretary for Management for, among other things, the budget, appropriations, and expenditure of funds.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 63 GAO-05-202 Homeland Security

50

Objective 1: Legislative Conditions

Condition 5

Condition 5. The plan satisfies the requirement that it be reviewed by GAO. 

Our review was completed on November 23, 2004.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 64 GAO-05-202 Homeland Security

51

Objective 2: Open Recommendations

Recommendation 1

Open Recommendation 1: Develop a system security plan and privacy impact

assessment.

Status: Partially complete

Security Plan. US-VISIT has developed a security plan.27

OMB and the National Institute of Standards and Technology (NIST) have issued 

security planning guidance28 requiring, in part, the completion of system security 

plans that (1) provide an overview of the system security requirements, (2) include

a description of the controls in place or planned for meeting the security 

requirements, and (3) delineate roles and responsibilities of all individuals who

access the system.

27US-VISIT Program, Security Plan for US-VISIT Program Version 1.1 (Sept. 13, 2004).

28OMB Circular A-130, Revised (Transmittal Memorandum No. 4), Appendix III, Security of Federal Automated Information

Resources (Nov. 28, 2000) and NIST, Guide for Developing Security Plans for Information Technology Systems, NIST Special

Publication 800-18 (December 1998).
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 65 GAO-05-202 Homeland Security

52

Objective 2: Open Recommendations

Recommendation 1

According to the guidance, the plan should also describe the methodology used to 

identify system threats and vulnerabilities and to assess risks, and it should include

the date the assessment was conducted. If no system risk assessment has been 

completed, the plan is to include a milestone date for completion.

The US-VISIT security plan provides an overview of the system security 

requirements, describes the controls in place or planned for meeting those

requirements, and references the applicable documents that contain roles and

responsibilities for the US-VISIT component systems.

However, the plan states that although a security risk assessment on the US-VISIT

program will be completed in accordance with NIST guidelines, it has not yet been 

completed, and the plan does not indicate a date for doing so.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 66 GAO-05-202 Homeland Security

53

Objective 2: Open Recommendations

Recommendation 1

Privacy Impact Assessment. The US-VISIT program has conducted a privacy

impact assessment for Increment 2, and according to the US-VISIT Privacy Officer, 

a privacy impact assessment will be completed for the exit portion of Increment 1 in 

early 2005. According to OMB guidance,29 the depth and content of such an 

assessment should be appropriate for the nature of the information to be collected

and the size and complexity of the system involved.

The assessment should also, among other things, (1) be updated when a system

change creates new privacy risk, (2) ensure that privacy is addressed in the

documentation related to system development, (3) address the impact the system 

will have on an individual’s privacy, (4) analyze the consequences of collection and 

flow of information, and (5) analyze alternatives to collection and handling as

designed.

29OMB, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002, OMB M-03-22 (Sept. 26, 2003).
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 67 GAO-05-202 Homeland Security

54

Objective 2: Open Recommendations

Recommendation 1

The Increment 2 assessment satisfies some, but not all, of the above OMB 

guidance areas. To DHS’s credit, the assessment, which was completed in 

September 2004, states that the DHS Chief Privacy Officer directed that the 

assessment be updated as necessary to reflect future changes to Increment 2. The 

assessment also discusses the impact that Increment 2 will have on an individual’s

privacy and analyzes the consequences of collection and flow of information.

However, privacy is only partially addressed in the Increment 2 system 

documentation. For example, privacy is used in the Increment 2B cost-benefit

analysis to evaluate the weighted risk of Increment 2B alternative solutions.

Additionally, the ADIS functional requirements specify that access to information

contained in the system, which is protected by the Privacy Act,30 must be limited to 

authorized users. However, the IDENT Server 2.0 requirements do not consider

privacy at all. Additionally, the assessment’s only discussion of design is a 

statement that a major choice for US-VISIT was whether to develop an entirely new 

system, develop a largely new system, or build upon existing systems. The 

assessment does not analyze these options.

305 U.S.C. 552(a).
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 68 GAO-05-202 Homeland Security

55

Objective 2: Open Recommendations

Recommendation 1

The timing of the planned privacy impact assessment for the exit portion of 

Increment 1 is consistent with plans for completing the exit pilots.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 69 GAO-05-202 Homeland Security

56

Objective 2: Open Recommendations

Recommendation 2

Open Recommendation 2: Develop and implement a plan for satisfying key 

acquisition management controls—including acquisition planning, solicitation,

requirements development and management, project management, contract

tracking and oversight, evaluation, and transition to support—and implement the 

controls in accordance with SEI guidance.

Status: In progress

The US-VISIT program plans to achieve SEI SA-CMM Level 2 status in October 

2006. According to SEI, a process improvement effort should involve building a 

process infrastructure, establishing current levels of process maturity, and 

completing an action plan. The plan should include, among other things, process

improvement assumptions and risks, goals, objectives, and criteria for success. 

The US-VISIT Acquisition and Program Management Office (APMO) has initiated a 

process improvement program and drafted a process improvement plan.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 70 GAO-05-202 Homeland Security

57

Objective 2: Open Recommendations

Recommendation 2

The draft US-VISIT plan discusses assumptions, such as the improvement

program being sponsored and supported by senior US-VISIT management, and 

risks, such as not meeting the process improvement time line if the process 

improvement effort is not fully staffed.

The plan also lists both process improvement goals and short- and long-term

objectives. However, the goals and objectives are generally not defined in

measurable terms. For example, the plan identifies the following goal and objective:

• Goal: ensure that US-VISIT is in compliance with federal mandates, making

future funding more likely.

• Objective: define a strategy for attaining SEI SA-CMM Level 2 as soon as

possible within the existing constraints—limited contractor and government

staff resources and centralized facility.

The plan also does not address criteria for success.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 71 GAO-05-202 Homeland Security

58

Objective 2: Open Recommendations

Recommendation 2

APMO has developed processes or plans, some of which are approved and some 

of which are in draft, for all key process areas except “transition to support.”31 The

Director of APMO could not say when APMO plans to develop the documentation

for this key process area, but noted that US-VISIT is considering a transition from 

the SA-CMM to SEI’s Capability Maturity Model Integration (CMMI) model.32 No

time line was provided as to when this decision might be made. The Director of 

APMO acknowledges that a transition to the CMMI will likely change the previously

mentioned time line for CMM certification.

31The purpose of transition to support is to provide for the effective and efficient “handing off” of the acquired software

products to the support organization responsible for software maintenance.

32CMU/SEI-2004-TR-001 (February 2004).
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 72 GAO-05-202 Homeland Security

59

Objective 2: Open Recommendations

Recommendation 3

Open Recommendation 3: Ensure that future expenditure plans are provided to 

the DHS’s House and Senate Appropriations Subcommittees on Homeland

Security in advance of US-VISIT funds being obligated.

Status: Complete

On October 18, 2004, the President signed the Department of Homeland Security 

Appropriations Act, 2005, which included $340 million in fiscal year 2005 funds for 

the US-VISIT program.33 The act states that $254 million of the $340 million is 

subject to the expenditure plan requirement.

On October 19, 2004, DHS provided its fiscal year 2005 expenditure plan to the 

Senate and House Appropriations Subcommittees on Homeland Security.

33Department of Homeland Security Appropriations Act, 2005, Pub. L. 108-334 (Oct. 18, 2004).
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 73 GAO-05-202 Homeland Security

60

Objective 2: Open Recommendations

Recommendation 4

Open Recommendation 4: Ensure that future expenditure plans fully disclose USVISIT system capabilities, schedule, cost, and benefits to be delivered.

Status: Partially complete

Capabilities

The expenditure plan identifies high-level capabilities by increments. However, the 

capabilities are not consistently presented. For example, in one section of the plan,

Increment 2B capabilities are identified as 

• collect biometric data and verify identity at the 50 busiest land POEs,

• develop global enrollment system capability, and

• support facilities delivery.

However, later in the plan, Increment 2B capabilities are identified as 

• Increment 1 functionality at the top 50 land POEs,

• biometric data collection, and 

• infrastructure upgrades.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 74 GAO-05-202 Homeland Security

61

Objective 2: Open Recommendations

Recommendation 4

Further, some of the capabilities are described in vague and ambiguous terms. For 

example, the plan describes such Increment 2C capabilities as 

• integration of Border Crossing Cards with US-VISIT,

• test, model, and deploy technology to preposition biographic and biometric

data of enrolled travelers, and

• desktop upgrades.

Schedule

The plan identifies specific milestones for some increments, but not for others. For 

example, it states that Increment 2B is to be implemented by December 31, 2004, 

and Increment 3 by December 31, 2005. However, it states that Increment 1 exit 

and Increment 2C are to be implemented in fiscal year 2005.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 75 GAO-05-202 Homeland Security

62

Objective 2: Open Recommendations

Recommendation 4

Costs

The plan identifies the amounts budgeted for each increment for fiscal years 2003 

through 2005. For example, the plan states that US-VISIT plans to obligate $55 

million in fiscal year 2005 funds for Increment 2C. However, the plan does not

associate the $55 million with specific Increment 2C capabilities and benefits.

Rather, it states that this amount will be used to support Increment 2C by funding

the installation of technology in entry and exit lanes at land borders and supporting

facility delivery.

Further, the plan does not identify any estimated nongovernmental costs, such as 

the social costs associated with any potential economic impact at the border. 
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 76 GAO-05-202 Homeland Security

63

Objective 2: Open Recommendations

Recommendation 4

Benefits

The plan identifies several benefits and associates these benefits with increments.

For example, for Increment 1, the plan identifies such benefits as 

• prevention of entry of high-threat or inadmissible individuals through improved

and/or advanced access to data before the foreign national’s arrival,

• improved enforcement of immigration laws through improved data accuracy 

and completeness,

• reduction in foreign nationals remaining in the country under unauthorized

circumstances, and 

• reduced threat of terrorist attack and illegal immigration through improved

identification of national security threats and inadmissible individuals.

As we previously reported,34 these benefits were identified in the fiscal year 2004 

expenditure plan, although they were not associated with Increment 1. 

34 GAO, Homeland Security: First Phase of Visitor and Immigration Status Program Operating, but Improvements Needed,

GAO-04-586 (Washington, D.C.: May 11, 2004).
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 77 GAO-05-202 Homeland Security

64

Objective 2: Open Recommendations

Recommendation 4

Further, the fiscal year 2004 plan included planned metrics for the first two benefits 

identified above and stated that US-VISIT was developing metrics for measuring

the projected benefits, including baselines by which progress can be assessed.

However, the fiscal year 2005 plan does not include any information on these

metrics or on progress against any of the benefits. The fiscal year 2005 plan again

states that performance measures are still under development.

While the plan does not associate any measures with the defined benefits, it does 

identify several measures and links them to the US-VISIT processes—pre-entry,

entry, status management, exit, and analysis.

The plan also identifies examples of how US-VISIT is addressing its four stated 

goals. The examples, however, largely describe US-VISIT functions rather than

measures of goal achievement. For example, in support of the stated goal of 

ensuring the integrity of our immigration system, the plan states that through USVISIT, officers at primary inspection are able to instantly search databases of 

known criminals and known and suspected terrorists. It does not, however, identify 

how this ensures immigration system integrity.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 78 GAO-05-202 Homeland Security

65

Objective 2: Open Recommendations

Recommendation 5

Open Recommendation 5: Ensure that future expenditure plans fully disclose how

the US-VISIT acquisition is being managed.

Status: In progress 

The expenditure plan describes some activities being employed to manage the USVISIT acquisition. For example, the plan describes the US-VISIT governance 

structure, as well as the program office organizational structure and staffing levels. 

The plan also describes certain management processes currently being used. For 

example, the plan states that US-VISIT program officials hold formal weekly

meetings to discuss program risks/issues, schedule items, and critical path items. 

In addition, it states that formal points of contact for risk issues have been

designated across the Increment Integrated Project teams, and the US-VISIT

program organization and the plan states that US-VISIT is establishing a formal risk 

review board to review and manage risk.

However, the plan does not describe how other important aspects of the program 

are being managed, several of which are discussed in this briefing. For example, it 

does not describe how testing, system capacity, and systems configuration are

being managed.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 79 GAO-05-202 Homeland Security

66

Objective 2: Open Recommendations

Recommendation 6

Open Recommendation 6: Ensure that human capital and financial resources are 

provided to establish a fully functional and effective program office.

Status: Partially complete 

DHS established the US-VISIT program office in July 2003 and determined the 

office’s staffing needs to be 115 government and 117 contractor personnel.

As of October 2004, DHS had filled 59 of the 115 government positions. Of those 

positions that have not been filled, 5 have reassignments in progress and 51 have 

competitive announcements pending. According to US-VISIT, about half of these 

positions are to be filled when security clearances are completed.

In addition, US-VISIT has changed its organizational structure, and some positions

were moved to other offices within US-VISIT. For example, the number of positions 

in the Office of Mission Operations Management decreased from 23 to 18, and the 

number of positions in the Office of Chief Strategist increased from 10 to 14. Also, 

the number of positions in the Office of Administration and Management—now

called the Office of Administration and Training—increased from 10 to 11. 
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 80 GAO-05-202 Homeland Security

67

Objective 2: Open Recommendations

Recommendation 6

The graphic on the next page shows the US-VISIT program office organization

structure and functions, the number of positions needed by each office, and the 

number of positions filled. This graphic reflects the recent changes to the US-VISIT 

organizational structure. 
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 81 GAO-05-202 Homeland Security

68

Objective 2: Open Recommendations

Recommendation 6

US-VISIT Program Organizational Structure,

Functions, and 

Filled and 

Vacant

Positions
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 82 GAO-05-202 Homeland Security

69

Objective 2: Open Recommendations

Recommendation 6

In addition to the 115 government staff that were anticipated, the program 

anticipated 117 contractor support staff. As of November 2004, program officials

told us they had filled 88 of these 117 positions.

The expenditure plan also states that DHS has budgeted $83 million to maintain

the program management structure and baseline operations, including, among

other things, salaries and benefits for government full-time equivalents, personnel

relocation costs, rent, and supplies.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 83 GAO-05-202 Homeland Security

70

Objective 2: Open Recommendations

Recommendation 7

Open Recommendation 7: Clarify the operational context in which US-VISIT is to 

operate.

Status: In progress 

DHS is in the process of defining the operational context in which US-VISIT is to 

operate. In September 2003, DHS released version 1.0 of its enterprise 

architecture.35 We reviewed the initial version of the architecture and found that this 

architecture was missing, either partially or completely, all the key elements

expected in a well-defined architecture, such as descriptions of business 

processes, information flows among these processes, and security rules

associated with these information flows.36 Since we reviewed version 1.0, DHS has 

drafted version 2.0 of its architecture. We have not reviewed the draft, but DHS EA 

program officials told us this version focuses on departmental operations, and that 

later versions will incrementally focus on the national homeland security picture.

This is important to the US-VISIT operational context because US-VISIT is a 

governmentwide program, including entities outside DHS, such as the Departments

of State and Justice.

35Department of Homeland Security Enterprise Architecture Compendium Version 1.0 and Transitional Strategy.

36GAO, Homeland Security: Efforts Under Way to Develop Enterprise Architecture, but Much Work Remains, GAO-04-777

(Washington, D.C.: Aug. 6, 2004).
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 84 GAO-05-202 Homeland Security

71

Objective 2: Open Recommendations

Recommendation 8

Open Recommendation 8: Determine whether proposed US-VISIT increments will 

produce mission value commensurate with cost and risks. 

Status: In progress

US-VISIT developed a cost-benefit analysis (CBA) for Increment 2B, dated June 

11, 2004. However, the CBA’s treatment of both benefits and costs raises several 

issues, making it unclear whether Increment 2B will produce mission value

commensurate with cost and risks. 

First, the CBA primarily addresses government costs and is silent on some

potential nongovernmental costs. For example, the CBA does not consider

potential social costs like the economic impact on border communities.

Second, the CBA identifies two categories of quantifiable benefits, but it does not 

provide any quantitative or monetary estimates for those benefits. Instead, the CBA 

focuses on two categories of nonquantifiable benefits: 

• strategic alignment benefits, such as the improvement of national security and 

the promotion of legitimate trade and travel, and
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 85 GAO-05-202 Homeland Security

72

Objective 2: Open Recommendations

Recommendation 8

• operational performance benefits, such as improvement of traveler 

identification and validation of traveler documentation.

Moreover, the CBA does not explain why these benefits cannot be quantified. Also, 

the CBA states that none of the proposed alternatives result in a positive net

present value or return on investment, which it attributes to the limited scope of 

Increment 2B.

Third, the CBA includes three alternatives and identifies alternative 3 as the

preferred alternative. However, US-VISIT is not pursuing alternative 3, but rather is 

pursuing an alternative more aligned with alternative 2. According to the Program 

Director, this is because alternative 3 was considered too ambitious to meet the 

statutory requirement that US-VISIT be implemented at the 50 busiest land POEs 

by December 31, 2004. 
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 86 GAO-05-202 Homeland Security

73

Objective 2: Open Recommendations

Recommendation 9

Open Recommendation 9: Define US-VISIT program office positions, roles, and 

responsibilities.

Status: Partially complete

US-VISIT has developed descriptions for positions within each office. In addition,

US-VISIT has worked with the Office of Personnel Management (OPM) to draft a 

set of core competencies that define the knowledge, skills, abilities, and other

characteristics (competencies) needed for successful employee performance.

According to US-VISIT’s draft Human Capital Plan, these core competencies will 

form the foundation for recruitment and selection, training and development, and 

employee performance evaluations. Currently, US-VISIT is using some of these 

draft core competencies in its employee performance appraisal process.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 87 GAO-05-202 Homeland Security

74

Objective 2: Open Recommendations

Recommendation 10

Open Recommendation 10: Develop and implement a human capital strategy for 

the US-VISIT program office that provides for staffing positions with individuals who

have the appropriate knowledge, skills, and abilities.

Status: Partially complete

The US-VISIT program office awarded a contract to OPM to develop a draft Human 

Capital Plan. Our review of the draft plan showed that OPM developed a plan for 

US-VISIT that employed widely accepted human capital planning tools and

principles.

OPM’s recommendations to US-VISIT include the following:

• Develop and adopt a competency-based system and a corresponding human

capital planning model that illustrate the alignment of US-VISIT’s mission with 

individual and organizational performance.

• Conduct a comprehensive workforce analysis to determine diversity trends, 

retirement and attrition rates, and mission-critical and leadership competency

gaps.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 88 GAO-05-202 Homeland Security

75

Objective 2: Open Recommendations

Recommendation 10

• Develop a leadership competency model and establish a formal leadership

development program to ensure continuity of leadership.

• Link the competency-based human capital management system to all aspects

of human resources, including recruitment, assessment, training and

development, and performance.

The draft human capital plan includes an action plan that identifies activities,

proposed completion dates, and the office (OPM or US-VISIT) responsible for 

completing these activities. According to OPM, it has completed its work under the 

draft plan. As of October 2004, US-VISIT had completed some of the activities 

called for in the draft plan. For example, US-VISIT’s Office of Administration and 

Training has designated a liaison responsible for ensuring alignment between DHS 

and US-VISIT human capital policies.

However, it remains to be seen how full implementation of the plan will impact the 

US-VISIT program office. For example, the workforce analysis called for in the draft 

plan could result in a change in the number and competencies of the staff needed

to implement US-VISIT.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 89 GAO-05-202 Homeland Security

76

Objective 2: Open Recommendations

Recommendation 11

Open Recommendation 11: Develop a risk management plan and report all high

risks and their status to the executive body on a regular basis.

Status: Partially complete

The US-VISIT program office has developed a risk management plan (dated June

2, 2004) and process (dated June 9, 2004). The plan addresses, among other

things, the process for identifying, analyzing, mitigating, tracking, and controlling

risks. As part of its process, US-VISIT has developed a risk management

database. The database includes, among other things, a description of the risk, its 

priority (e.g., high, medium, low), and mitigation strategy. 

US-VISIT has also established the governance structure for managing risks. The 

governance structure includes three primary groups—the Risk Review Board, Risk 

Review Council, and Risk Management Team.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 90 GAO-05-202 Homeland Security

77

Objective 2: Open Recommendations

Recommendation 11

• The Risk Review Board provides overall decision making, communication, and

coordination in regard to risk activities. The board is composed of senior-level

staff, such as the program director and functional area directors. 

• The Risk Review Council reviews initially reported risks, validates their 

categorizations, and ensures that a mitigation approach has been developed. It 

also serves as a filter for the Board by deciding which risks can be mitigated 

without being elevated to the Board.

• The Risk Management Team provides risk management expertise and

institutional knowledge. This group is staffed by APMO.

According to the Director, APMO, US-VISIT has not reported high risks beyond the 

Review Board. 
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 91 GAO-05-202 Homeland Security

78

Objective 2: Open Recommendations

Recommendation 12

Open Recommendation 12: Define performance standards for each US-VISIT

increment that are measurable and reflect the limitations imposed by relying on 

existing systems. 

Status: In progress 

Available documentation shows that some technical performance measures for 

Increments 1 and 2B have been defined. For example: 

• Availability.37 The system will be available 99.5 percent of the time. 

• Timeliness.38 Login, visa query, and TECS/NCIC default query will be less than

5 seconds; TECS optional queries will be less than 60 seconds; and IDENT

watch list queries will be less than 10 seconds (matcher time only).

• Output quantity.39 70,000 primary inspection transactions per user, per day, 

with a maximum of 105,000 transactions during peak times.

37The time the system is operating satisfactorily, expressed as a percentage of time that the system is required to be 

operational.

38The time needed to perform a unit of work correctly and on time.

39The number of transactions processed.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 92 GAO-05-202 Homeland Security

79

Objective 2: Open Recommendations

Recommendation 12

However, other measures, such as reliability,40 resource utilization,41 and

scalability,42 are not defined in the documentation. Further, the documentation does 

not contain sufficient information to determine the limitations imposed by USVISIT’s reliance on existing systems that have less demanding performance 

requirements, such as TECS availability of 98.0 percent. Such information would

include, for example, the processing sequencing and dependencies among the 

existing systems. 

40The probability that a system, including all hardware, firmware, and software, will satisfactorily perform the task for

which it was designed.

41A ratio representing the amount of time a system or component is busy divided by the time it is available.

42Ability of a system to function well when it is changed in size or volume.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 93 GAO-05-202 Homeland Security

80

Objective 2: Open Recommendations

Recommendation 13

Open Recommendation 13: Develop and approve test plans before testing

begins. These test plans should (1) specify the test environment; (2) describe each

test to be performed, including test controls, inputs, and expected outputs; 

(3) define the test procedures to be followed in conducting the tests; and 

(4) provide traceability between test cases and the requirements to be verified by 

the testing.

Status: In progress

According to the US-VISIT Systems Assurance Director, the Increment 2B system 

acceptance test (SAT) plan was approved during an October 15, 2004, test

readiness review (TRR). However, no documentation was provided that explicitly

indicated the approval of the plan, and the results of the TRR were not approved

until October 28, 2004, which is 11 days after the date we were told that 

acceptance testing began.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 94 GAO-05-202 Homeland Security

81

Objective 2: Open Recommendations

Recommendation 13

Further:

• The test plan does not fully address the test environment. For example, the 

plan does not describe the scope, complexity, and completeness of the test 

environment or identify necessary training. The plan does include generic

descriptions of testing hardware, such as printers and card readers.

• The plan does not include descriptions of tests to be performed. However,

officials from the IT Management Office provided us with other documentation

describing the tests to be performed that included expected outputs, but it did

not include inputs or controls.

• The plan does not provide test procedures to be followed in conducting the 

tests.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 95 GAO-05-202 Homeland Security

82

Objective 2: Open Recommendations

Recommendation 13

• The plan does not provide traceability between test cases and the 

requirements to be verified by the testing. Our analysis of the 116 

requirements identified in the consolidated requirements document showed

that

• 39 requirements mapped to test cases that lacked sufficient detail to 

determine whether the test cases are testable,

• 15 requirements did not have test cases,

• 2 requirements were labeled “not testable,” and

• 1 requirement was identified as “TBD,” but was mapped to an actual test 

case.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 96 GAO-05-202 Homeland Security

83

Objective 2: Open Recommendations

Recommendation 14

Open Recommendation 14: Ensure the independence of the Independent

Verification and Validation (IV&V) contractor. 

Status: In progress

According to the US-VISIT Program Director, the US-VISIT IT Management Office 

is developing high-level requirements for IV&V. In particular, it is developing a 

strategy and statement of work for acquiring an IV&V contractor.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 97 GAO-05-202 Homeland Security

84

Objective 2: Open Recommendations

Recommendation 15

Open Recommendation 15: Implement effective configuration management

practices, including establishing a US-VISIT change control board to manage and 

oversee system changes.

Status: Planned 

According to US-VISIT’s draft configuration management (CM) plan, dated July 

2004, and US-VISIT officials, US-VISIT has not yet developed or implemented USVISIT-level configuration management practices or a change control board. In the 

interim, for Increments 1, 2A and 2B, US-VISIT continues to follow relevant IDENT, 

ADIS, and TECS configuration management procedures, including applicable

change control boards and system change databases. According to the US-VISIT 

System Assurance Director, for Increment 2B, US-VISIT is using the TECS change

requests database for US-VISIT change requests, including those for IDENT and 

ADIS.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 98 GAO-05-202 Homeland Security

85

Objective 2: Open Recommendations

Recommendation 15

The draft configuration management plan describes key configuration activities that 

are to be defined and implemented, including (1) defining and identifying processes

and products to be controlled; (2) evaluating, coordinating, and approving/rejecting

changes to controlled items; (3) recording and monitoring changes to the controlled

items; and (4) verifying that the controlled items meet their requirements and are 

accurately documented.

The draft plan also proposes a governance structure, including change control

boards. The proposed governance structure includes the following:

• A US-VISIT CM team is responsible for implementing, controlling, operating,

and maintaining all aspects of configuration management and administration

for US-VISIT. The team is to be composed of a CM manager, CM team staff, 

DHS system CM liaisons, prime integrator CM liaison, and testers and users.

• A change control board is to serve as the ultimate authority on changes to any 

US-VISIT system baseline, decide the content of system releases, and 

approve the schedule of releases.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 99 GAO-05-202 Homeland Security

86

Objective 2: Open Recommendations

Recommendation 16

Open Recommendation 16: Identify and disclose management reserve funding

embedded in the fiscal year 2004 expenditure plan to the Appropriations

Subcommittees.

Status: Complete

The US-VISIT program office reported the management reserve funding of $33 

million for fiscal year 2004 to the Appropriations Subcommittees. According to the 

Deputy Program Manager, US-VISIT provided this information in a briefing to the 

Subcommittee staff. 
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 100 GAO-05-202 Homeland Security

87

Objective 2: Open Recommendations

Recommendation 17

Open Recommendation 17: Ensure that all future US-VISIT expenditure plans 

identify and disclose management reserve funding.

Status: Complete

The fiscal year 2005 expenditure plan specified management reserve funding of 

$23 million.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 101 GAO-05-202 Homeland Security

88

Objective 2: Open Recommendations

Recommendation 18

Open Recommendation 18: Assess the full impact of Increment 2B on land POE 

workforce levels and facilities, including performing appropriate modeling

exercises.

Status: Partially complete

US-VISIT conducted an Increment 2B baseline analysis to help determine the 

impact of Increment 2B on workforce and travelers. The analyses included three 

sites and addressed the Form I-94 issuance process and the Form I-94W43 process

in secondary inspection. According to program officials, additional staff will not be 

needed to implement 2B at the border. Instead, US-VISIT has developed a plan to 

train existing Customs and Border Protection officers on the collection of traveler 

entry data, has completed the “train the trainer” classes at the training academy,

and has begun training at three land POEs.

43I-94W is used for foreign nationals from visa waiver countries.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 102 GAO-05-202 Homeland Security

89

Objective 2: Open Recommendations

Recommendation 18

In addition, US-VISIT has conducted space utilization surveys at all of the 166 land

POEs and completed survey reports at 16 of the 50 busiest land POEs. US-VISIT 

expects to have completed survey reports for the remaining 34 busiest land POEs 

during the fall of 2004. According to the 16 completed survey reports, existing

traffic at most of these facilities was at or near capacity and the facilities had no 

room for expansion. However, US-VISIT officials said that Increment 2B will not 

require expansion at any facilities; rather, it will require mostly minor modifications,

such as the installation of new or updated countertops and electrical power outlets 

to accommodate new equipment.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 103 GAO-05-202 Homeland Security

90

Objective 2: Open Recommendations

Recommendation 19

Open Recommendation 19: Develop a plan, including explicit tasks and 

milestones, for implementing all our open recommendations and periodically report 

to the DHS Secretary and Under Secretary on progress in implementing this plan;

also report this progress, including reasons for delays, in all future US-VISIT

expenditure plans.

Status: In progress

The US-VISIT program office has developed a report for tracking the status of our 

open recommendations. This report is shared with the program office director, but 

according to the Deputy Program Director, it is not shared with the Secretary and 

Under Secretary. In addition, he stated that the program office meets weekly with 

the Under Secretary, but the status of our recommendations are not discussed.

The fiscal year 2005 expenditure plan summarizes our recommendations, but it 

does not identify tasks and milestones for implementing them or discuss progress

in implementing them.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 104 GAO-05-202 Homeland Security

91

Objective 3: Observations

Contract

Observation 1: The program office has acquired the services of a prime 

integration contractor to augment its ability to complete US-VISIT.

DHS reported in its fiscal year 2004 US-VISIT expenditure plan that it had intended

to award a contract by the end of May 2004 to a prime contractor for integrating

existing and new business processes and technologies. US-VISIT awarded the 

contract on time. Specifically, on May 28, 2004, DHS awarded its prime contract to 

Accenture LLP and its related partners. 
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 105 GAO-05-202 Homeland Security

92

Objective 3: Observations

Progress

Observation 2: The fiscal year 2005 Expenditure Plan does not describe progress

against commitments (e.g., capabilities, schedule, cost, and benefits) made in 

previous plans.

Given the immense importance of the US-VISIT program to the security of our 

nation’s borders and the need to acquire and implement it efficiently and effectively, 

the Congress has placed limitations on the use of appropriations for the US-VISIT 

program until DHS submits periodic expenditure plans.

As we had previously reported,44 to permit meaningful congressional oversight, it is 

important that expenditure plans describe how well DHS is progressing against the 

commitments made in prior expenditure plans.

44GAO, Information Technology: Homeland Security Needs to Improve Entry Exit System Expenditure Planning, GAO-03-563

(Washington, D.C.: June 9, 2003).
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 106 GAO-05-202 Homeland Security

93

Objective 3: Observations

Progress

The fiscal year 2005 expenditure plan does not describe progress against

commitments made in prior expenditure plans. For example, in its fiscal year 2004

expenditure plan, US-VISIT committed to, among other things,

• analyzing, field testing, and initiating deployment of alternative approaches for 

capturing biometrics during the exit process at air and sea POEs and

• implementing entry and exit capabilities at the 50 busiest land POEs by 

December 31, 2004, including delivering the capability to read radio frequency

enabled documents at the 50 busiest land POEs for both entry and exit

processes.

The fiscal year 2005 plan does not address progress against these commitments. 

For example, the plan does not describe the status of the exit pilot testing or

deployment, such as whether it has met its target schedule or whether the 

schedule has slipped. While the plan does state that US-VISIT will expand its pilot 

sites during the summer and fall of 2004 and deploy the exit solution during fiscal 

year 2005, it does not explain the reason for the change or its potential impact.

The following graphic provides our analysis of the commitments made in the fiscal 

year 2003 and 2004 plans, compared with currently reported and planned

progress.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 107 GAO-05-202 Homeland Security

94

Objective 3: Observations

Progress

Time Line Comparing Commitments Made in the US-VISIT Fiscal Year 2003 and 

2004 Plans with Current Commitments and Reported Progress
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 108 GAO-05-202 Homeland Security

95

Objective 3: Observations

Progress

Further, the fiscal year 2004 plan states that $45 million in fiscal year 2004 funds 

were to be used for exit activities. However, the fiscal year 2005 plan states that 

$73 million in fiscal year 2004 funds were to be used for exit activities, but does not 

highlight this difference or address the reason for the change in budget amounts.

Also, the fiscal year 2005 expenditure plan includes benefits stated in the fiscal 

year 2004 plan, but it does not provide progress in addressing those benefits,

despite the fact that, in the fiscal year 2004 plan, US-VISIT stated that it was 

developing metrics for measuring the projected benefits, including baselines by 

which progress could be assessed. The fiscal year 2005 plan again states that 

performance measures are under development.

This information is needed to allow meaningful congressional oversight of plans 

and progress.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 109 GAO-05-202 Homeland Security

96

Objective 3: Observations

Exit Deployment

Observation 3: The exit capability alternatives are faced with a compressed time 

line, missed milestones, and potentially reduced scope.

On January 5, 2004, US-VISIT deployed an initial exit capability in pilot status to 

two POEs. At that time, the Program Director stated that US-VISIT was developing

other exit alternatives, along with criteria for evaluating and selecting one or more 

of the alternatives by December 31, 2004.

Planned evaluation time line compressed

In May 2004, US-VISIT issued an Exit Pilot Evaluation Execution Plan. This plan 

states that three alternative exit solutions are to be evaluated while deployed to a 

total of 15 air and sea POEs. The plan allotted about 3 months to conduct the 

evaluation and report the results. Specifically, the deployment was to be completed 

by August 1, 2004, and all exit pilot evaluation tasks were to be completed by 

September 30, 2004, with an evaluation report finished by October 28, 2004.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 110 GAO-05-202 Homeland Security

97

Objective 3: Observations

Exit Deployment

However, according to the exit master schedule provided to us on October 26, 

2004, the three alternatives were scheduled to be fully deployed by October 29, 

2004, and all evaluation tasks are to be completed on December 6, 2004, with

delivery of the evaluation report on December 30, 2004, which is about a 2-month 

evaluation and reporting period.

The following graphic illustrates how the exit pilot schedule has been shortened

from the originally planned 3 months to the currently planned 2 months and

compares the original plan with the current plan.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 111 GAO-05-202 Homeland Security

98

Objective 3: Observations

Exit Deployment

Changes in Planned Exit Pilot Evaluation Period
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 112 GAO-05-202 Homeland Security

99

Objective 3: Observations

Exit Deployment

Pilot deployment delayed

As of November 8, 2004, the three alternatives were deployed and operational in

only 5 of the 15 POEs that were to be operational by November 1.

According to the Exit Implementation Manager, all ports had received and installed

the exit equipment. However, the requisite number of contract employees (WSAs)

is not yet available to make all 15 POEs operational because of delays in DHS

granting security clearances to the attendants. The manager stated that a recent 

meeting with DHS security officials has helped to improve the pace of finalized

security clearances, but the manager did not know when the remaining 10 ports 

would become operational.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 113 GAO-05-202 Homeland Security

100

Objective 3: Observations

Exit Deployment

Potentially reduced evaluation scope

The Evaluation Execution Plan describes the evaluation methodology that is to be 

employed for the three alternatives. An important element of that methodology is 

the targeted sample size per port. For each port, a targeted number of outbound

passengers will be processed by the three alternatives and data gathered on these 

encounters. The plan’s specified sample sizes are described as sufficient to 

achieve a 95 percent confidence level with a margin of error of 5 percent. 

According to the Exit Implementation Manager, the desired sample size will be 

collected at each port, despite the compressed time frame for conducting the 

evaluations, by adding additional personnel to the evaluation teams if needed.

These changing facts and circumstances surrounding the exit pilot introduce

additional risk concerning US-VISIT’s delivery of promised capabilities and benefits

on time and within budget.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 114 GAO-05-202 Homeland Security

101

Objective 3: Observations

Exit Deployment

On November 12, 2004, US-VISIT issued a revised draft Exit Pilot Evaluation Plan. 

However, the plan does not address any of the concerns cited, in part because it 

does not include a planned completion date. Instead, the plan states that the 

evaluation period is planned for October 31, 2004, until completion. Without a 

planned completion date, it is not possible to determine the length of the evaluation

period or any impact that the length of the evaluation may have on the evaluation’s

scope.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 115 GAO-05-202 Homeland Security

102

Objective 3: Observations

Collaboration

Observation 4: US-VISIT and Automated Commercial Environment (ACE) 

collaboration is moving slowly.

The US-VISIT EA alignment analysis document describes a port of entry/exit 

management conceptual project that is to establish uniform processes at POEs and 

the capability to inspect and categorize people and goods and act upon the

information collected. The document recognizes that both US-VISIT and ACE45

support this project because they have related missions and a planned presence at 

the borders, including the development and deployment of infrastructure and

technology.

We recognized the relationships between these two programs in February 2003,46

when we recommended that future ACE expenditure plans specifically address any 

proposals or plans, whether tentative or approved, for extending and using ACE 

infrastructure to support other homeland security applications.

45ACE is a new trade processing system planned to support the movement of legitimate imports and exports and strengthen

border security.

46GAO, Customs Service Modernization: Automated Commercial Environment Progressing, but Further Acquisition

Management Improvements Needed, GAO-03-406 (Washington D.C.: Feb. 28, 2003).
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 116 GAO-05-202 Homeland Security

103

Objective 3: Observations

Collaboration

In February 2004, US-VISIT and ACE managers met to identify potential areas for 

collaboration between the two programs and to clarify how the programs could best

support the DHS mission and provide officers with the information and tools they

need. During the meeting, US-VISIT and ACE managers recognized that the

system infrastructure built to support the two programs was likely to become the 

infrastructure for future border security processes and system applications. Further, 

they identified four areas of collaboration: business cases; program management;

inventory; and people, processes, and technology. These areas were later refined 

to be 

• program management and business case coordination, which includes such

activities as creating a high-level integrated master schedule for both 

programs; sharing acquisition strategies, plans, and practices; and 

coordinating business case activities, such as OMB budget submissions and

acquisition management baselines;

• inventory, which includes identifying connections among legacy systems and 

establishing a technical requirements and architecture team to review, among 

other things, system interfaces, data formats, and system architectures; and
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 117 GAO-05-202 Homeland Security

104

Objective 3: Observations

Collaboration

• people, processes, and technology, which includes establishing a team to 

review deployment schedules and establishing a team and process to review

and normalize business requirements.

In August 2004, the US-VISIT and ACE programs tasked their respective 

contractors to form collaboration teams to address the three areas. Nine teams

have been formed:

• investment management;

• business;

• organizational change management;

• facilities;

• information and data;

• technology;

• privacy and security;

• deployment, operations, and maintenance; and

• program management.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 118 GAO-05-202 Homeland Security

105

Objective 3: Observations

Collaboration

The teams met in September 2004 to develop team charters, identify specific

collaboration opportunities, and develop time lines and next steps. In October

2004, US-VISIT and ACE contractors met US-VISIT and ACE management to 

present their preliminary results. According to a US-VISIT official, the team charters

have not yet been formally approved.

Since we recommended steps to promote close collaboration between these two 

programs, about 20 months have passed, and explicit plans have not been

developed nor actions taken to understand US-VISIT/ACE dependencies and 

relationships so that these can be exploited to optimize border operations. During 

this time and in the near future, the management of both programs have been and 

will be making and acting on decisions to further define, design, develop, and

implement their respective programs. The longer it takes for the programs to exploit 

their relationships, the more rework will be needed at a later date to integrate the 

two programs. According to the US-VISIT Program Director, the pace of 

collaboration activities has been affected by scheduling and priority conflicts, as 

well as staff availability.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 119 GAO-05-202 Homeland Security

106

Objective 3: Observations

Capacity Management

Observation 5: US-VISIT system capacity is being managed in a 

compartmentalized manner.

Capacity management is intended to ensure that systems are properly designed

and configured for efficient performance and have sufficient processing and

storage capacity for current, future, and unpredictable workload requirements.

Capacity management includes (1) demand forecasting, (2) capacity planning, and 

(3) performance management. Demand forecasting ensures that the future 

business requirement workloads are considered and planned. Capacity planning

involves determining current and future resource requirements and ensuring that 

they are acquired and implemented in a timely and cost-effective manner. 

Performance management involves monitoring the performance of system 

resources to ensure required service levels are met. 

The US-VISIT system, as noted earlier, is actually a system made up of various

pre-existing (or legacy) systems that are operated by different DHS organizational

components and that have been enhanced and interfaced.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 120 GAO-05-202 Homeland Security

107

Objective 3: Observations

Capacity Management

Currently, DHS does not have a capacity management program. Instead, the USVISIT IT Management Office relies on the performance management activities of 

the respective pre-existing DHS systems. For example:

• A quarterly report provided by the Customs and Border Protection Systems

Engineering Branch Performance Engineering Team tracks such system 

measures as transaction volume, central processing unit utilization, and 

workload growth.

• Immigration and Customs Enforcement tracks such system measures as 

hourly and daily transaction rates and response times.

According to the program office, the system-of-systems nature of US-VISIT does 

not lend itself to easily tracking systemwide performance. Nevertheless, program 

officials told us that the US-VISIT program has tasked two of its contractors with 

developing a comprehensive performance management and capacity planning

effort. Until this is developed, the program will continue to rely on component

system performance management activities to ensure that US-VISIT system

resources are sufficient to meet current US-VISIT workloads, which increases the 

risk that they may not be able to adequately support US-VISIT mission needs.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 121 GAO-05-202 Homeland Security

108

Objective 3: Observations

Cost Estimate

Observation 6:The cost estimating process used for Increment 2B did not follow

some key best practices.

SEI recognizes the need for reliable cost-estimating processes in managing

software-intensive system acquisitions. To this end, SEI has issued a checklist47 to

help determine the reliability of cost estimates. Our analysis found that US-VISIT 

did not fully satisfy most of the criteria on SEI’s checklist. 

The US-VISIT Increment 2B estimate met two of the checklist items that we

evaluated, partially met six, and did not meet five. For example, US-VISIT provided 

no evidence that Increment 2B was appropriately sized. Specifically, costs related 

to development and integration tasks for the TECS, IDENT, and ADIS systems are 

specified, but estimated software lines of code to be reused, modified, added, or 

deleted are not. As another example, no one outside the US-VISIT program office 

reviewed and concurred with the cost estimating categories and methodology.

The table on the following slides summarizes our analysis of the extent to which 

US-VISIT’s cost-estimating process for Increment 2B met SEI’s criteria.

47Carnegie Mellon University Software Engineering Institute, A Manager’s Checklist for Validating Software Cost and Schedule

Estimates, CMU/SEI-95-SR-004 (January 1995).
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 122 GAO-05-202 Homeland Security

109

Objective 3: Observations

Cost Estimate

Criterion Satisfies

1. The objectives of the estimate are stated in writing. Yesa

2. The life cycle to which the estimate applies is clearly defined. Partiallyb

3. The task has been appropriately sized (e.g., software lines of code). Noc

4. The estimated cost and schedule are consistent with demonstrated

accomplishments on other projects.

Partially

5. A written summary of parameter valuesd and their rationales

accompanies the estimate.

Partially

6. Assumptions have been identified and explained. Yes

7. A structured process such as a template or format has been used to

ensure that key factors have not been overlooked.

Partially

Source: GAO.

a

US-VISIT provided substantiating evidence for the criterion.

b

US-VISIT provided partial evidence, including testimonial evidence, for the criterion.

c

No evidence was found for the criterion.

d

Parameter values are the lowest level of the cost categories used to develop the cost estimate.

Summary of US-VISIT Satisfaction of SEI Criteria
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 123 GAO-05-202 Homeland Security

110

Objective 3: Observations

Cost Estimate

Criterion Satisfies 

8. Uncertainties in parameter values have been identified and quantified. Partially

9. If a dictated schedule has been imposed, an estimate of the normal

schedule has been compared to the additional expenditures required to 

meet the dictated schedule.

No

10. If more that one cost model or estimating approach has been used, any

differences in results have been analyzed and explained.

No

11. Estimators independent of the performing organization concurred with

the reasonableness of the parameter values and estimating

methodology.

No

12. Estimates are current. Partially

13. The results of the estimate have been integrated with project planning

and tracking.

No

Source: GAO.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 124 GAO-05-202 Homeland Security

111

Objective 3: Observations

Cost Estimate

Without reliable cost estimates, the ability to make informed investment decisions

and effectively measure progress and performance is reduced.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 125 GAO-05-202 Homeland Security

112

Conclusions

The fiscal year 2005 expenditure plan (with related program office documentation

and representations) either partially satisfies or satisfies the legislative conditions

imposed by Congress. Further, steps are planned, initiated, under way, or 

completed to address all of our open recommendations. However, overall progress

in addressing the recommendations has been slow, leaving considerable work to 

be done. Given that most of these open recommendations are aimed at correcting 

fundamental limitations in DHS’s ability to manage the program in a way that

ensures the delivery of (1) mission value commensurate with costs and 

(2) promised capabilities on time and within budget, it is important that DHS

implement the recommendations quickly and completely through effective planning

and continuous monitoring and reporting. Until this occurs, the program will be at 

high risk of not meeting its stated goals on time and within budget.

To its credit, the program office now has its prime contractor on board to support

both near-term increments and to plan for and deliver the yet-to-be-defined USVISIT strategic solution. However, it is important to recognize that this 

accomplishment is a beginning and not an end. The challenge for DHS is now to 

effectively and efficiently work with the prime contractor in achieving desired

mission outcomes.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 126 GAO-05-202 Homeland Security

113

Conclusions

To accomplish this, it is important that DHS move swiftly in building its program

management capacity, which is not yet in place, as shown by the status of our

open recommendations and our recent observations about (1) economic

justification of US-VISIT Increment 2B, (2) completion of the exit pilot evaluation,

(3) collaboration with a closely related import/export processing and border security

program, (4) system capacity management activities, and (5) cost-estimating

practices. Moreover, it is important that DHS improve its measurement and 

disclosure to its Appropriations Subcommittees of its progress against 

commitments made in prior expenditure plans, so that the Subcommittees’ ability to 

effectively oversee US-VISIT’s plans and progress is not unnecessarily

constrained.

Nevertheless, the fact remains that the program continues to invest hundreds of 

millions of dollars for a mission-critical capability under circumstances that 

introduce considerable risk that cost-effective mission outcomes will not be

realized. At a minimum, it is incumbent upon DHS to fully disclose these risks,

along with associated mitigation steps, to executive and congressional leaders so 

that timely and informed decisions about the program can be made.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 127 GAO-05-202 Homeland Security

114

Recommendations for Executive Action

To better ensure that the US-VISIT program is worthy of investment and is 

managed effectively, we reiterate our prior recommendations and further 

recommend that the Secretary of DHS direct the Under Secretary for Border and 

Transportation Security to ensure that the US-VISIT program director takes the 

following actions:

• Fully and explicitly disclose in all future expenditure plans how well DHS is

progressing against the commitments that it made in prior expenditure plans.

• Reassess its plans for deploying an exit capability to ensure that the scope of 

the exit pilot provides for adequate evaluation of alternative solutions, and

better ensures that the exit solution selected is in the best interest of the 

program.

• Develop and implement processes for managing the capacity of the US-VISIT

system.

• Follow effective practices for estimating the costs of future increments.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 128 GAO-05-202 Homeland Security

115

Recommendations for Executive Action

• Make understanding the relationships and dependencies between the USVISIT and ACE programs a priority matter, and report periodically to the Under

Secretary on progress in doing so. 
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 129 GAO-05-202 Homeland Security

116

Agency Comments

We provided this briefing to, and discussed its contents with, US-VISIT program 

officials, including the Program Director. These officials stated that they generally

agreed with our findings, conclusions, and recommendations. They also provided

technical comments on the briefing, which we have incorporated into the briefing,

as appropriate.

With respect to the program accomplishments during fiscal year 2004, the Program 

Director also stated that US-VISIT has continued to operate as intended every day 

at air and sea POEs, and it has produced such accomplishments as making the 

country more secure while expanding its coverage to include visitors from visa 

waiver countries. The director further stated that while the program’s management

capability is not yet mature and has much to accomplish, progress to date has

been limited by a shortage of staff.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 130 GAO-05-202 Homeland Security

117

Attachment 1

Scope and Methodology

To accomplish our objectives, we performed the following tasks:

• We analyzed the expenditure plan against legislative conditions and other

relevant federal requirements, guidance, and best practices to determine the

extent to which the conditions were met.

• We analyzed key acquisition management controls documentation and

interviewed program officials to determine the status of our open 

recommendations.

• We analyzed supporting documentation and interviewed DHS and US-VISIT 

program officials to determine capabilities in key program management areas,

such as enterprise architecture and capacity management.

• We analyzed Increment 2B systems and software testing documentation and

compared them with relevant guidance to determine completeness.

• We attended program working group meetings.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 131 GAO-05-202 Homeland Security

118

Attachment 1

Scope and Methodology

• We assessed the reliability of US-VISIT’s Increment 2B cost estimate by 

selecting 13 criteria from the SEI checklist48 that, in our professional judgment,

represent the minimum set of criteria necessary to develop a reliable cost 

estimate. We analyzed the Increment 2B cost-benefit analysis and supporting

documentation and interviewed program officials to determine how the

estimate was derived. We then assessed each of the criteria as satisfied (USVISIT provided substantiating evidence for the criterion), partially satisfied (USVISIT provided partial evidence, including testimonial evidence, for the 

criterion), and not satisfied (no evidence was found for the criterion).

• We did not review the State Department’s implementation of machinereadable, tamper-resistant visas that use biometrics.

For DHS-provided data that our reporting commitments did not permit us to 

substantiate, we have made appropriate attribution indicating the data’s source.

48Carnegie Mellon University Software Engineering Institute, A Manager’s Checklist for Validating Software Cost and

Schedule Estimates, CMU/SEI-95-SR-004 (January 1995).
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 132 GAO-05-202 Homeland Security

119

Attachment 1

Scope and Methodology

We conducted our work at US-VISIT program offices in Rosslyn, Virginia, from 

June 2004 through November 2004, in accordance with generally accepted

government auditing standards.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 133 GAO-05-202 Homeland Security

120

Attachment 2

Recent US-VISIT Studies

Recent Studies of US-VISIT

• Border Security: State Department Rollout of Biometric Visas on Schedule, but 

Guidance Is Lagging. GAO-04-1001. Washington, D.C.: September 9, 2004.

• Border Security: Joint, Coordinated Actions by State and DHS Needed to 

Guide Biometric Visas and Related Programs. GAO-04-1080T. Washington,

D.C.: September 9, 2004.

• Homeland Security: First Phase of Visitor and Immigration Status Program

Operating, but Improvements Needed. GAO-04-586. Washington, D.C.: May 

11, 2004. 

• DHS Office of Inspector General. An Evaluation of the Security Implications of 

the Visa Waiver Program. OIG-04-26. Washington, D.C.: April 2004.

• Homeland Security: Risks Facing Key Border and Transportation Security 

Program Need to Be Addressed. GAO-04-569T. Washington, D.C.: March 18,

2004.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 134 GAO-05-202 Homeland Security

121

Attachment 2

Recent US-VISIT Studies

Recent Studies of US-VISIT

• Homeland Security: Risks Facing Key Border and Transportation Security 

Program Need to Be Addressed. GAO-03-1083. Washington, D.C.: September 

19, 2003.

• Information Technology: Homeland Security Needs to Improve Entry Exit

System Expenditure Planning. GAO-03-563. Washington, D.C.: June 9, 2003.
Page 135 GAO-05-202 Homeland Security

Appendix II

Comments from the Department of Homeland 

Security ApendxiI
Appendix II

Comments from the Department of Homeland 

Security

Page 136 GAO-05-202 Homeland Security
Page 137 GAO-05-202 Homeland Security

Appendix III

GAO Contact and Staff Acknowledgments ApendxiI

GAO Contact Deborah Davis, (202) 512-6261

Staff 

Acknowledgments

In addition to the individual named above, Barbara Collier, Neil Doherty, 

David Hinchman, James Houtz, Carolyn Ikeda, Anh Le, John Mortin, David 

Noone, Karen Richey, Karl Seifert, and Randolph Tekeley made key 

contributions to this report.

(310296)
GAO’s Mission The Government Accountability Office, the audit, evaluation and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help 

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability.

Obtaining Copies of 

GAO Reports and 

Testimony

The fastest and easiest way to obtain copies of GAO documents at no cost 

is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts 

newly released reports, testimony, and correspondence on its Web site. To 

have GAO e-mail you a list of newly posted products every afternoon, go to 

www.gao.gov and select “Subscribe to Updates.”

Order by Mail or Phone The first copy of each printed report is free. Additional copies are $2 each. 

A check or money order should be made out to the Superintendent of 

Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 

more copies mailed to a single address are discounted 25 percent. Orders 

should be sent to:

U.S. Government Accountability Office

441 G Street NW, Room LM

Washington, D.C. 20548

To order by Phone: Voice: (202) 512-6000 

TDD: (202) 512-2537 

Fax: (202) 512-6061

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Contact:

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Congressional 

Relations

Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, D.C. 20548

Public Affairs Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, D.C. 20548