United States Government Accountability Office

GAO Testimony 

Before the Subcommittee on Terrorism, 

Technology, and Homeland Security, 

Committee on the Judiciary, U.S. Senate

BORDER SECURITY

Stronger Actions Needed to 

Assess and Mitigate Risks of 

the Visa Waiver Program 

Statement of Jess T. Ford, Director 

International Affairs and Trade 

For Release on Delivery

Expected at 2:00 p.m. EDT

Thursday, September 7, 2006 

 

GAO-06-1090T 
What GAO Found

United States Government Accountability Office

Why GAO Did This Study

Highlights

Accountability Integrity Reliability

What GAO Found

United States Government Accountability Office

Why GAO Did This Study

Highlights

Accountability Integrity Reliability

What GAO Found

United States Government Accountability Office

Why GAO Did This Study

Highlights

Accountability Integrity Reliability

September 7, 2006

BORDER SECURITY

Stronger Actions Needed to Assess and 

Mitigate Risks of the Visa Waiver 

Program 

Highlights of GAO-06-1090T, a testimony 

before the Chairman, Subcommittee on 

Terrorism, Technology, and Homeland 

Security, Committee on the Judiciary, U.S. 

Senate 

The Visa Waiver Program enables

citizens of 27 countries to travel to 

the United States for tourism or 

business for 90 days or less without

obtaining a visa. In fiscal year 2005, 

nearly 16 million people entered 

the country under the program.

After the 9-11 terrorist attacks, the

risk that aliens would exploit the 

program to enter the United States

became more of a concern. This 

testimony discusses our recent 

report on the Visa Waiver Program.

Specifically, it (1) describes the 

Visa Waiver Program’s benefits and 

risks, (2) examines the U.S.

government’s process for assessing 

potential risks, and (3) assesses the 

actions taken to mitigate these

risks. We met with U.S. embassy 

officials in six program countries 

and reviewed relevant procedures

and reports on participating

countries. 

What GAO Recommends

In our report, we made a series of

recommendations to DHS to 

strengthen its ability to assess and 

mitigate the program’s risks, such 

as providing more resources to the

program’s monitoring unit and 

issuing standards for the reporting 

of lost and stolen passport data. We

also stated that Congress should 

consider establishing a deadline for 

the mandated biennial report to 

Congress. DHS generally agreed 

with our report and

recommendations, but did not 

agree that Congress should

establish a deadline for the biennial 

report. 

The Visa Waiver Program has many benefits as well as some inherent risks.

It facilitates travel for millions of people and eases consular workload, but 

poses challenges to border inspectors, who, when screening visa waiver

travelers, may face language barriers or lack time to conduct in-depth 

interviews. Furthermore, stolen passports from visa waiver countries are 

prized travel documents among terrorists, criminals, and immigration law 

violators, creating an additional risk. While the Department of Homeland 

Security (DHS) has intercepted many fraudulent documents at U.S. ports of 

entry, DHS officials acknowledged that an undetermined number of 

inadmissible aliens may have entered the United States using a stolen or lost 

passport from a visa waiver country.

DHS’s process for assessing the risks of the Visa Waiver Program has 

weaknesses. In 2002, Congress mandated that, every 2 years, DHS review the 

effect that each country’s continued participation in the program has on U.S. 

law enforcement and security interests, but did not set a reporting deadline. 

In 2004, DHS established a unit to oversee the program and conduct these 

reviews. We identified several problems with the 2004 review process, as key

stakeholders were not consulted during portions of the process, the review 

process lacked clear criteria and guidance to make key judgments, and the 

final reports were untimely. Furthermore, the monitoring unit cannot 

effectively achieve its mission to monitor and report on ongoing law 

enforcement and security concerns in visa waiver countries due to 

insufficient resources.

DHS has taken some actions to mitigate the program’s risks; however, the 

department has faced difficulties in further mitigating these risks. In 

particular, the department has not established time frames and operating 

procedures regarding timely stolen passport reporting—a program 

requirement since 2002. Furthermore, DHS has sought to require the 

reporting of lost and stolen passport data to the United States and the 

International Criminal Police Organization (Interpol), but it has not issued 

clear reporting guidelines to participating countries. While most visa waiver 

countries report to Interpol’s database, four do not. Further, DHS is not 

using Interpol’s data to its full potential as a border screening tool because

U.S. border inspectors do not automatically access the data at primary 

inspection. 

www.gao.gov/cgi-bin/getrpt?GAO-06-1090T.

To view the full product, including the scope 

and methodology, click on the link above. 

For more information, contact Jess Ford at 

(202) 512-4128 or fordj@gao.gov.
Mr. Chairman and Members of the Subcommittee: 

I am pleased to be here to discuss our observations on the Visa Waiver 

Program. In fiscal year 2005, nearly 16 million travelers entered the United 

States under this program, which facilitates international travel and 

commerce, and eases workload for consular officers at overseas posts, by

enabling citizens of 27 participating countries1

 to travel to the United 

States for tourism or business for 90 days or less without first obtaining a 

visa.2

 Participating countries were selected because their citizens had 

demonstrated a pattern of compliance with U.S. immigration laws, and the 

governments of these countries granted reciprocal visa-free travel to U.S.

citizens. The Visa Waiver Program was created as a pilot program in 1986,

3

and it became permanent in 2000,4

 about 1 year prior to the 9-11 terrorist 

attacks. After the attacks, the potential risks of the program became more 

of a concern. In particular, convicted terrorist Zacarias Moussaoui and 

“shoe-bomber” Richard Reid both boarded flights to the United States with 

passports issued by Visa Waiver Program countries. Moreover, the foiled 

alleged terrorist plot to board planes at London’s Heathrow Airport and fly 

to the United States with explosive materials highlights the importance of 

having effective tools to ensure that only legitimate travelers enter the 

United States. In May 2002, Congress mandated that the Department of 

Homeland Security (DHS) evaluate and report to Congress at least every 

two years on the effect that each country’s continued participation in the 

program has on U.S. law enforcement and security interests.5

 Effective 

oversight of the Visa Waiver Program is essential to find the right balance 

between facilitating legitimate travel and preventing potential terrorists, 

 1

The participating countries are Andorra, Australia, Austria, Belgium, Brunei, Denmark,

Finland, France, Germany, Iceland, Ireland, Italy, Japan, Liechtenstein, Luxembourg, 

Monaco, the Netherlands, New Zealand, Norway, Portugal, San Marino, Singapore,

Slovenia, Spain, Sweden, Switzerland, and the United Kingdom. 

2

The United States also issues visas to those who intend to immigrate to the United States. 

In this testimony, we use the term “visa” to refer to nonimmigrant visas only. 

3

The Immigration Reform and Control Act of 1986, P.L. 99-603. 

4

The Visa Waiver Permanent Program Act, P.L. 106-396. 

5

Prior to this change, DHS was required to report at least once every 5 years. See the 

Enhanced Border Security and Visa Entry Reform Act, P.L 107-173. 

Page 1 GAO-06-1090T 
criminals, and others that may pose law enforcement and immigration 

concerns from entering the United States.6

Earlier this week, we released two reports on the Visa Waiver Program: 

the first discusses the process by which the United States assesses and 

mitigates the program’s risks,7

 and the second describes the process by 

which additional countries may be admitted into the program.8

 My 

statement will focus on the first of these reports. Specifically, I will discuss 

(1) the Visa Waiver Program’s advantages and potential risks; (2) the U.S. 

government’s process for assessing the program’s risks; and (3) the 

actions that have been taken to mitigate these risks. In addition, we have

ongoing work examining international aviation passenger prescreening, 

including DHS’s use of passport and reservation data to screen travelers 

and the pilot Immigration Advisory Program at several airports overseas, 

and expect to report on our findings later this fall. 

In conducting this work, we reviewed documentation, including the laws 

governing the program, relevant regulations and agency operating 

procedures, and DHS’s Office of the Inspector General (OIG) reports. We 

also examined 15 of the 25 completed reports from the 2004 review 

process that assessed the participation of Visa Waiver Program countries.9

Additionally, we interviewed political, economic, consular, commercial, 

and law enforcement officials at U.S. embassies in six Visa Waiver 

Program countries, as well as foreign government officials in three of 

these countries. We met with officials from several DHS component 

agencies and offices; the Department of State (State); and the International 

 6

Since September 11, 2001, the visa issuance process has taken on greater significance as

an antiterrorism tool, as we have previously reported. GAO has issued a series of reports

on the visa issuance process. See GAO, Border Security: Strengthened Visa Process Would

Benefit from Improvements in Staffing and Information Sharing, GAO-05-859 

(Washington, D.C.: Sept. 13, 2005); Border Security: Actions Needed to Strengthen 

Management of Department of Homeland Security’s Visa Security Program, GAO-05-801 

(Washington, D.C.: July 29, 2005); and, Border Security: Visa Process Should be 

Strengthened as an Antiterrorism Tool, GAO-03-132NI (Washington, D.C.: Oct. 21, 2002). 

7

GAO, Border Security: Stronger Actions Needed to Assess and Mitigate Risks of the Visa

Waiver Program, GAO-06-844 (Washington, D.C.: July 28, 2006). 

8

GAO, Process for Admitting Additional Countries into the Visa Waiver Program, 

GAO-06-835R (Washington, D.C.: July 28, 2006). 

9

As of June 2006, the remaining 10 assessments were pending classification review, and 

assessments of the remaining two participating countries—Italy and Portugal—were in 

process.

Page 2 GAO-06-1090T 
Criminal Police Organization (Interpol) in Lyon, France. We conducted our 

work in accordance with generally accepted government auditing 

standards (see app. I for a list of related GAO products and ongoing 

reviews). 

The Visa Waiver Program provides many benefits to the United States, 

including facilitating international travel for millions of foreign citizens 

seeking to visit the United States each year, creating substantial economic

benefits to our country. Visa waiver travelers have represented about onehalf of all nonimmigrant admissions to the United States in recent years. 

The program also allows State to allocate resources to visa-issuing posts in 

countries with higher-risk applicant pools. Moreover, participating visa 

waiver countries offer visa-free travel to U.S. citizens. However, travelers 

visiting the United States under the Visa Waiver Program can pose 

potential security risks because they are not interviewed by a consular 

officer prior to their travel. In addition, border inspectors at U.S. ports of 

entry may not know the visa waiver traveler’s language or local fraudulent 

document trends in the traveler’s home country, nor have the time to 

conduct an extensive interview. In contrast, visa-issuing officers at U.S. 

embassies generally have more time to interview applicants—often in the 

applicants’ native language—and have more country-specific knowledge of 

passports and fraud trends. Furthermore, lost and stolen passports from 

visa waiver countries are highly prized among travelers seeking to conceal 

their true identities or nationalities, increasing the likelihood that 

terrorists and other criminals would attempt to obtain these documents. 

DHS officials have acknowledged that an undetermined number of 

inadmissible aliens may have entered the United States using a stolen or 

lost passport from a visa waiver country. In fact, passports from Visa 

Waiver Program countries have been used illegally by hundreds of 

travelers attempting to enter the United States. For example, from January 

through June 2005, at U.S. ports of entry, DHS confiscated 298 passports 

issued by Visa Waiver Program countries that travelers were attempting to 

use fraudulently for admission into the United States. Thus, there is a risk 

that the program could be exploited for illegal entry into the United States. 

Summary 

DHS has developed a process for assessing the law enforcement and 

security risks of the Visa Waiver Program, but this process has 

weaknesses. In 2002, Congress mandated that DHS review the security 

risks posed by each visa waiver country’s participation in the program at 

Page 3 GAO-06-1090T 
least every 2 years. In 2004, DHS established the Visa Waiver Program 

Oversight Unit within the Office of International Enforcement (OIE).10 DHS 

conducted its first mandated biennial reviews that same year, and 

subsequently determined that all of the countries it reviewed should 

remain in the program.11 However, we identified several problems with the 

country review process. Specifically, key interagency stakeholders,12 such 

as embassies overseas and forensic document analysts, were left out of 

portions of the 2004 country review process, and the review process 

lacked clear criteria and guidance to make key judgments. Also, the 

country assessments prepared by DHS were not completed in a timely 

fashion and contained some dated information that did not necessarily 

reflect current risks; interagency teams conducted site visits as part of the 

country assessments from May through September 2004, and transmitted 

the final report to Congress more than 1 year later, in November 2005. The 

teams collecting information about the visa waiver countries’ risks in 2004 

used, in some cases, information that was two years old; by the time the 

summary report was issued in November 2005, some of the data was over

3 years old. Moreover, DHS has not provided sufficient resources to the 

Office of International Enforcement to effectively monitor the risks posed 

by visa waiver countries on an ongoing basis. While the Visa Waiver 

Program Oversight Unit developed a strategic plan to monitor the 

program, it has been unable to implement this plan with its current staff of 

only two full-time employees. In addition, DHS has not established Visa 

Waiver Program points of contact within the U.S. embassies so it can 

communicate directly with foreign government contacts and field officials,

who are best positioned to monitor compliance with the program’s 

requirements and report on current events and issues of potential concern. 

Without this outreach, DHS is not able to leverage the existing resources 

at U.S. embassies in all visa waiver countries to obtain current information 

on potential risks, as well as countries’ progress in addressing these risks. 

 10OIE is located in the Office of Policy Development under the direction of the Assistant 

Secretary of Homeland Security for Policy. 

11DHS’s Office of Policy began this review in early 2004, several months before the Visa 

Waiver Program Oversight Unit was established in July of that year. 

12The interagency working group charged in 2004 with assessing participating countries’ 

adherence to the program’s statutory requirements comprised officials from Justice’s 

Office of International Affairs, State’s Bureau of Consular Affairs, and several components

within DHS, including the Intelligence and Analysis Directorate, Custom and Border 

Protection’s Office of Field Operations, and Immigration and Customs Enforcement’s 

Forensic Document Laboratory, among others. Representatives from some of these 

agencies formed the in-country site visit teams. 

Page 4 GAO-06-1090T 
DHS has taken some actions to mitigate the risks of the Visa Waiver 

Program. Specifically, DHS identified security concerns in several 

participating countries during the 2004 assessment process, and, for 

example, terminated the use of the German temporary passport under the 

program. However, the department has faced difficulties in further 

mitigating program risks, particularly regarding lost and stolen passport 

reporting—a key vulnerability. For example, not all countries have 

consistently reported their data to the United States on stolen blank 

passports, even though reporting such data is vital to mitigating program 

risks. In one instance, a visa waiver country reported to the United States 

the theft of nearly 300 blank passports more than 9 years after the theft 

occurred. In 2002, timely reporting of such thefts became a statutory 

requirement for continued participation in the program, but DHS has not 

issued standard operating procedures for countries to report these data.

DHS has also sought to expand this requirement to include the reporting 

of data, to the United States and Interpol,13 about lost and stolen issued14

(as well as blank) passports; however, the United States lacks a 

centralized mechanism for foreign governments to report all stolen 

passports, and DHS has not identified the U.S. government entity to which

participating countries should report this information. While most visa 

waiver countries contribute to Interpol’s database, four do not. Moreover, 

some countries that do contribute do not do so on a regular basis, 

according to Interpol officials. In addition, Interpol’s data on lost and 

stolen travel documents is not automatically accessible to U.S. border 

inspectors at primary inspection—one reason why it is not an effective 

border screening tool, according to DHS, State, and Justice officials. 

According to the Secretary General of Interpol, until DHS can 

automatically query Interpol’s data, the United States will not have an 

effective screening tool for checking passports. However, DHS has not yet 

finalized a plan to obtain this systematic access to Interpol’s data. 

In our report, we made several recommendations to DHS to strengthen its 

ability to assess the risks of the Visa Waiver Program, including a 

 13Interpol is the world’s largest international police organization, with 184 member 

countries. Created in 1923, it facilitates cross-border police cooperation, and supports and 

assists all organizations, authorities, and services whose mission is to prevent or combat 

international crime. In July 2002, Interpol established a database on lost and stolen travel 

documents. As of June 2006, the database contained about 11.6 million records of lost and 

stolen passports.

14Issued passports have been officially personalized with the bearer’s biographical 

information. 

Page 5 GAO-06-1090T 
recommendation to create real-time monitoring mechanisms to improve 

communication between the department and overseas posts, and to 

provide additional resources for the Visa Waiver Program Oversight Unit. 

We also made a series of recommendations to mitigate the program’s risks, 

including communicating clear standard operating procedures for the 

reporting of lost and stolen, blank and issued, passport data. Finally, we 

included a matter for congressional consideration: to improve the 

timeliness of DHS’s assessments of the risks of each country’s continued 

participation in the program, Congress should consider establishing a 

deadline by which the department must complete its biennial country 

assessments and report to Congress. DHS either agreed with, or stated 

that it is considering, all of our recommendations. Regarding our matter 

for congressional consideration, DHS did not support the establishment of 

a deadline for the biennial report to Congress. Instead, DHS suggested that

Congress should require continuous and ongoing evaluation of the risks of 

each country’s continued participation in the program. 

The Immigration Reform and Control Act of 1986 created the Visa Waiver 

Program as a pilot program.15 It was initially envisioned as an immigration 

control and economic promotion program, according to State. 

Participating countries were selected because their citizens had a 

demonstrated pattern of compliance with U.S. immigration laws, and the 

governments of these countries granted reciprocal visa-free travel to U.S.

citizens. In recent years, visa waiver travelers have represented about onehalf of all nonimmigrant admissions to the United States. In 2002, we 

reported on the legislative requirements to which countries must adhere 

before they are eligible for inclusion in the Visa Waiver Program.16 In 

general, to qualify for visa waiver status, a country must: 

Background 

• maintain a nonimmigrant refusal rate of less than 3 percent for its citizens 

who apply for business and tourism visas. 

• certify that it issues machine-readable passports to its citizens; and 

• offer visa-free travel for U.S. citizens. 

 15P.L. 99-603. 

16See GAO, Border Security: Implications of Eliminating the Visa Waiver Program, 

GAO-03-38 (Washington, D.C.: Nov. 22, 2002).

Page 6 GAO-06-1090T 
Following the 9-11 attacks, Congress passed additional laws to strengthen 

border security policies and procedures, and DHS and State instituted 

other policy changes that have affected the qualifications for countries to 

participate in the Visa Waiver Program. For example, all passports issued 

after October 26, 2005, must contain a digital photograph printed in the 

document, and passports issued to visa waiver travelers after October 26, 

2006, must be electronic (e-passports).17 In addition, the May 2002 

Enhanced Border Security and Visa Reform Act required that participating 

countries certify that the theft of their blank passports is reported to the 

U.S. government in a timely manner. 

The Visa Waiver Program has many benefits. The program was created to

facilitate international travel without jeopardizing the welfare or security 

of the United States, according to the program’s legislative history. 

According to economic and commercial officers at several of the U.S. 

embassies we visited, visa-free travel to the United States boosts 

international business travel and tourism, as well as airline revenues, and 

creates substantial economic benefits to the United States. Moreover, the 

program allows State to allocate its resources to visa-issuing posts in 

countries with higher-risk applicant pools. In 2002, we reported that 

eliminating the program would increase State’s resource requirements as 

millions of visa waiver travelers who have benefited from visa-free travel 

would need to obtain a visa to travel to the United States if the program 

did not exist.

18 Specifically, if the program were eliminated, we estimated 

that State’s initial costs at that time to process the additional workload 

would likely range between $739 million and $1.28 billion and that annual 

recurring costs would likely range between $522 million and $810 million. 

In addition, visa waiver countries could begin requiring visas for U.S. 

citizens traveling to the 27 participating countries for temporary business 

or tourism purposes, which would impose a burden of additional cost and 

time on U.S. travelers to these countries. 

Visa Waiver Program 

Has Benefits and 

Risks 

 17Travelers with passports issued after the deadline that do not meet these requirements 

must obtain a visa from a U.S. embassy or consulate overseas before departing for the

United States. In general, e-passports will contain a chip embedded in the passport that will 

store the same information that is printed on the data page of the passport, such as name,

date of birth, gender, place of birth, dates of passport issuance and expiration, place of 

issuance, passport number, and a photo image of the bearer.

18GAO-03-38. 

Page 7 GAO-06-1090T 
The Visa Waiver Program, however, can also pose risks to U.S. security, 

law enforcement, and immigration interests because some foreign citizens 

may exploit the program to enter the United States. First, visa waiver 

travelers are not subject to the same degree of screening as travelers who 

must first obtain a visa before arriving in the United States (see fig. 1). Visa

waiver travelers are first screened in person by a DHS Customs and 

Border Protection (CBP) inspector once they arrive at the U.S. port of 

entry, perhaps after having already boarded an international flight bound 

for the United States with a fraudulent travel document. According to the 

DHS OIG, primary border inspectors are at a disadvantage when screening

Visa Waiver Program travelers because they may not know the alien’s 

language or local fraud trends in the alien’s home country, nor have the 

time to conduct an extensive interview. In contrast, non-visa-waiver 

travelers, who must obtain a visa from a U.S. embassy or consulate, 

receive two levels of screening before entering the country—in addition to

the inspection at the U.S. port of entry, these travelers undergo an 

interview by consular officials overseas, who conduct a rigorous screening 

process when deciding to approve or deny a visa. As we have previously 

reported, State has taken a number of actions since 2002 to strengthen the 

visa issuance process as a border security tool.19 Moreover, consular 

officers have more time to interview applicants and examine the 

authenticity of their passports, and may also speak the visa applicant’s 

native language, according to consular officials. Therefore, inadmissible 

travelers who need visas to enter the United States may attempt to acquire

a passport from a Visa Waiver Program country to avoid the visa screening 

process. 

Visa Waiver Program Can 

Pose Risks to U.S.

Security, Law 

Enforcement, and 

Immigration Interests 

 19GAO-05-859 and GAO-03-132NI. 

Page 8 GAO-06-1090T 
Figure 1: Comparison of Screening for U.S. Visas versus Arrival Inspection

Screening at U.S. Air Port of Entry 

Another risk inherent in the program is the potential exploitation by 

terrorists, immigration law violators, and other criminals of a visa waiver 

country’s lost or stolen passports. DHS intelligence analysts, law 

enforcement officials, and forensic document experts all acknowledge that 

Page 9 GAO-06-1090T 
misuse of lost and stolen passports is the greatest security problem posed 

by the Visa Waiver Program. Lost and stolen passports from visa waiver 

countries are highly prized travel documents, according to the Secretary 

General of Interpol. Moreover, Visa Waiver Program countries that do not 

consistently report the losses or thefts of their citizens’ passports, or of 

blank passports, put the United States at greater risk of allowing 

inadmissible travelers to enter the country. 

Fraudulent passports from Visa Waiver Program countries have been used 

illegally by travelers seeking to disguise their true identities or 

nationalities when attempting to enter the United States. For example, 

from January through June 2005, DHS reported that it confiscated, at U.S.

ports of entry, 298 fraudulent or altered passports issued by Visa Waiver 

Program countries that travelers were attempting to use for admission into 

the United States. Although DHS has intercepted some travelers with 

fraudulent passports at U.S. ports of entry, DHS officials acknowledged 

that an undetermined number of inadmissible aliens may have entered the 

United States using a lost or stolen passport from a visa waiver country. 

According to State, these aliens may have been inadmissible because they

were immigration law violators, criminals, or terrorists. For example: 

• In July 2005, two aliens successfully entered the United States using lost or 

stolen Austrian passports. DHS was not notified that these passports had 

been lost or stolen prior to this date; the aliens were admitted, and there is

no record of their departure, according to CBP. In October 2005, CBP 

referred this case to DHS’s Immigration and Customs Enforcement for 

further action. 

• In June 2005, CBP inspectors admitted into the United States two aliens 

using Italian passports that were from a batch of stolen passports. CBP 

was notified that this batch was stolen; however, the aliens altered the 

passport numbers to avoid detection by CBP officers. DHS has no record

that these individuals departed the United States.

DHS has taken several steps to assess the risks of the Visa Waiver 

Program. However, we identified problems with the country review 

process by which DHS assesses these risks, namely a lack of 

inclusiveness, transparency, and timeliness. Furthermore, OIE is unable to

effectively monitor the immigration, law enforcement, and security risks 

posed by visa waiver countries on a continuing basis because of 

insufficient resources. 

Process for Assessing 

Program Risks Has 

Weaknesses 

Page 10 GAO-06-1090T 
In April 2004, the DHS OIG identified significant areas where DHS needed

to strengthen and improve its management of the Visa Waiver Program. 

For example, the OIG found that a lack of funding, trained personnel, and

other issues left DHS unable to comply with the mandated biennial 

country assessments. In response to these findings, DHS established OIE’s 

Visa Waiver Program Oversight Unit in July 2004, and named a director to

manage the office. The unit’s mission is to oversee Visa Waiver Program 

activities and monitor countries’ adherence to the program’s statutory 

requirements, ensuring that the United States is protected from those who 

wish to do it harm or violate its laws, including immigration laws. Since 

the unit’s establishment, DHS, and particularly OIE, has made strides to 

address concerns raised by the 2004 OIG review. For example, DHS 

completed comprehensive assessments of 25 of the 27 participating 

countries and submitted a six-page report to Congress in November 2005 

that summarized the findings from the 2004 assessments. 

Despite these steps to strengthen and improve the management of the 

program, we identified several problems with the mandated biennial 

country assessment process, by which DHS assesses the risks posed by 

each of the visa waiver countries’ continued participation in the program. 

For the 2004 assessments, we found the following: 

Initial Steps Taken To

Assess Risk of Visa Waiver 

Program 

DHS Lacks a ClearlyDefined, Consistent, and 

Timely Process to Assess 

Risks of Visa Waiver 

Program 

• Some key stakeholders were excluded from the process. After conducting

the site visits and contributing to the reports on the site visits, DHS and 

the interagency working group did not seek input from all site visit team 

members while drafting and clearing the final country assessments and 

subsequent report to Congress. For example, DHS’s forensic document 

analysts, who participated in the site visits in 2004, told us that they did 

not see, clear, or comment on the draft country assessments, despite 

repeated attempts to obtain copies of them. Additionally, at the time of our 

visits, ambassadors or deputy chiefs of mission in each of the six posts 

told us that they were not fully aware of the extent to which assessments 

for the country where they were posted discussed law enforcement and 

security concerns posed by the continued participation of the country in 

the program. Without this information, key stakeholders could not be 

effective advocates for U.S. concerns. 

• The reviews lacked clear criteria to make key judgments. We found that 

DHS did not have clear criteria to determine at what point security 

concerns uncovered during their review would trigger discussions with 

foreign governments about these concerns and an attempt to resolve them.

State officials agreed that qualitative and/or quantitative criteria would be 

Page 11 GAO-06-1090T 
useful when making these determinations, although DHS stated that the

criteria should be flexible. 

• DHS and its interagency partners neither completed the 25 country 

assessments nor issued the summary report to Congress in a timely 

manner. The interagency teams conducted site visits as part of the country 

assessments from May through September 2004, and transmitted the final 

summary report to Congress more than 1 year later, in November 2005. 

OIE, State, and Justice officials acknowledged that the assessments took 

too long to complete. The teams collecting information about the visa 

waiver countries’ risks in 2004 used, in some cases, information that was 

two years old; by the time the summary report was issued in November 

2005, some of the data was over 3 years old. As a result of this lengthy 

process, the final report presented to Congress did not necessarily reflect 

the current law enforcement and security risks posed by each country, or 

the positive steps that countries had made to address these risks. 

OIE is limited in its ability to achieve its mission because of insufficient 

staffing. The office has numerous responsibilities, including conducting 

the mandated biennial country reviews; monitoring law enforcement, 

security, and immigration concerns in visa waiver countries on an ongoing 

basis; and working with countries seeking to become members of the Visa 

Waiver Program. In 2004, the DHS OIG found that OIE’s lack of resources 

directly undercut its ability to assess a security problem inherent in the 

program—lost and stolen passports. The office received funding to 

conduct the country reviews in 2004 and 2005; however, OIE officials 

indicated that a lack of funding and full-time staff has made it extremely 

difficult to conduct additional overseas fieldwork, as well as track ongoing

issues of concern in the 27 visa waiver countries—a key limitation in 

DHS’s ability to assess and mitigate the program’s risks. According to OIE 

officials, the unit developed a strategic plan to monitor the program, but 

has been unable to implement its plan with its current staffing of two fulltime employees, as well as one temporary employee from another DHS 

component. Without adequate resources, OIE is unable to monitor and 

assess participating countries’ compliance with the Visa Waiver Program’s 

statutory requirements. 

In addition to resource constraints, DHS has not clearly communicated its 

mission to stakeholders at overseas posts, nor identified points of contact

within U.S. embassies, so it can communicate directly with field officials 

positioned to monitor countries’ compliance with Visa Waiver Program 

requirements and report on current events and issues of potential concern. 

DHS Cannot Effectively 

Monitor Ongoing Concerns

in Visa Waiver Countries 

Page 12 GAO-06-1090T 
In particular, within DHS’s various components, we found that OIE is 

largely an unknown entity and, therefore, is unable to leverage the 

expertise of DHS officials overseas. A senior DHS representative at one 

post showed us that her organizational directory did not contain contact 

information for OIE. Additionally, a senior DHS official in Washington, 

D.C., told us that he may find out about developments—either routine or 

emergent—in visa waiver countries by “happenstance.” Due to the lack of

outreach and clear communication about its mission, OIE is limited in its 

ability to monitor the day-to-day law enforcement and security concerns 

posed by the Visa Waiver Program, and the U.S. government is limited in 

its ability to influence visa waiver countries’ progress in meeting 

requirements. 

DHS has taken some actions to mitigate the risks of the Visa Waiver 

Program. However, though the law has required the timely reporting of 

blank passport thefts for continued participation in the Visa Waiver 

Program since 2002, DHS has not established and communicated time 

frames and operating procedures to participating countries. In addition, 

DHS has sought to expand this requirement to include the reporting of 

data, to the United States and Interpol, on lost and stolen issued passports; 

however, participating countries are resisting these requirements, and 

DHS has not yet issued guidance on what information must be shared, 

with whom, and within what time frame. Furthermore, U.S. border 

inspectors are unable to automatically access Interpol’s data on reported 

lost and stolen passports, which makes detection of these documents at 

U.S. ports of entry more difficult. 

As previously mentioned, during the 2004 assessment process, the working 

group identified security concerns in several participating countries, and 

DHS took actions to mitigate some of these risks. Specifically, DHS 

determined that several thousand blank German temporary passports20 had 

been lost or stolen, and that Germany had not reported some of this 

information to the United States. As a result, as of May 1, 2006, German 

temporary passport holders are not allowed to travel to the United States 

under the Visa Waiver Program without a visa. In addition, DHS has 

DHS Faces 

Difficulties in 

Mitigating Program 

Risks 

DHS Has Taken Some 

Actions to Mitigate Risks 

of the Visa Waiver Program 

 20German temporary passports are valid for one year, and are less expensive than standard

German passports. In addition, they are issued at more than 6,000 locations across 

Germany, whereas the Ministry of Interior issues the standard passports centrally. 

Page 13 GAO-06-1090T 
enforced an October 26, 2005, deadline requiring travelers under the Visa 

Waiver Program to have digital photographs in their passports. 

A key risk in the Visa Waiver Program is stolen blank passports from visa 

waiver countries, because detecting these passports at U.S. ports of entry 

is extremely difficult, according to DHS. Some thefts of blank passports 

have not been reported to the United States until years after the fact, 

according to DHS intelligence reports. For example, in 2004, a visa waiver 

country reported the theft of nearly 300 stolen blank passports to the 

United States more than 9 years after the theft occurred. The 2002

Enhanced Security and Visa Entry Reform Act provides that the Secretary

of Homeland Security must terminate a country from the Visa Waiver 

Program if he and the Secretary of State jointly determine that the country

is not reporting the theft of its blank passports to the United States on a 

timely basis. However, DHS has not established time frames or operating 

procedures to enforce this requirement. While the statute requires visa 

waiver countries to certify that they report information on the theft of 

their blank passports to the United States on a timely basis, as of June 

2006, DHS has not defined what constitutes “timely” reporting. Moreover,

the United States lacks a centralized mechanism for foreign governments 

to report all stolen passports. In particular, DHS has not defined to whom 

in the U.S. government participating countries should report this 

information. 

In addition to blank passports, lost or stolen issued passports also pose a 

risk because they can be altered. In June 2005, DHS issued guidance to

participating Visa Waiver Program countries requiring that they certify 

their intent to report lost and stolen passport data on issued passports by 

August 2005. However, DHS has not yet issued guidance on what 

information must be shared, with whom, and within what time frame. 

Moreover, some visa waiver countries have not yet agreed to provide this

information to the United States, due in part to concerns over the privacy 

of their citizens’ biographical information. In addition, several consular 

officials expressed confusion about the current and impending 

requirements about sharing this data, and felt they were unable to 

adequately explain the requirements to their foreign counterparts. 

In June 2005, the U.S. government also announced its intention to require 

visa waiver countries to certify their intent to report information on both 

lost and stolen blank and issued passports to Interpol. In 2002, Interpol 

developed a database of lost and stolen travel documents to which its 

DHS Lacks Standard 

Procedures for Obtaining 

Stolen Blank Passport 

Data 

Some Participating Visa 

Waiver Program Countries 

are Resisting Additional 

Reporting to United States 

and Interpol 

Page 14 GAO-06-1090T 
member countries may contribute on a voluntary basis. While most visa 

waiver countries use and contribute to Interpol’s database, four do not. 

Moreover, some countries that do contribute do not do so on a regular 

basis, according to Interpol officials. Participating countries have 

expressed concerns about reporting this information, citing privacy issues; 

however, Interpol’s database on lost and stolen travel documents does not 

include the passport bearers’ biographical information, such as name and 

date of birth.

21 According to the Secretary General of Interpol, in light of 

the high value associated with passports from visa waiver countries, it is a 

priority for his agency to encourage countries to contribute regularly to

the database. 

Though information from Interpol’s database could potentially stop 

inadmissible travelers from entering the United States, CBP’s border 

inspectors do not have automatic access to the database at the primary 

inspection point at U.S. ports of entry—the first line of defense against 

those who might exploit the Visa Waiver Program to enter the United 

States. The inspection process at U.S. ports of entry can include two 

stages—a primary and secondary inspection. If, during the primary 

inspection, the inspector suspects that the traveler is inadmissible either 

because of a fraudulent passport or other reason, the inspector refers the 

traveler to secondary inspection. At secondary inspection, border 

inspectors can contact officials at the National Targeting Center, who can

query Interpol’s stolen-travel-document database to determine if the 

traveler’s passport had been previously reported lost or stolen, but is not 

yet on CBP’s watch list.22 However, according to DHS, State, and Justice 

officials, because Interpol’s data on lost and stolen travel documents is not 

automatically accessible to border inspectors at primary inspection, it is 

not currently an effective border screening tool. Moreover, according to 

the Secretary General of Interpol, until DHS can automatically query 

Interpol’s data, the United States will not have an effective screening tool

for checking passports. According to Interpol officials, the United States is 

Inefficient Access to 

Interpol’s Database on Lost 

and Stolen Passports 

 21Interpol’s database includes the passport’s identity number, the country of issuance, and 

the country where the loss or theft occurred. According to officials from Justice’s InterpolU.S. National Central Bureau, it is particularly important that countries report this

information, as well as the date of the theft and the issuance date. 

22Interpol’s data on lost and stolen passports are not available when border inspectors 

screen travelers’ passports at primary inspection unless Interpol has shared this 

information with the United States in separate reports and it has been manually entered 

into DHS watch lists. 

Page 15 GAO-06-1090T 
working actively with Interpol on a potential pilot project that would allow 

for an automatic query of aliens’ passport data against Interpol’s database 

at primary inspection at U.S. ports of entry. However, DHS has not yet 

finalized a plan to do so.

In our report, we made a series of recommendations to improve the U.S. 

government’s process for assessing the risks in the Visa Waiver Program, 

including recommending that DHS provide additional resources to 

strengthen OIE’s visa waiver monitoring unit; finalize clear, consistent, and 

transparent protocols for the biennial country assessments and provide 

these protocols to stakeholders at relevant agencies at headquarters and 

overseas; create real-time monitoring arrangements for all 27 participating 

countries; and establish protocols for direct communication between 

overseas posts and OIE’s Visa Waiver Program Oversight Unit. In addition, 

we made recommendations to improve U.S. efforts to mitigate program 

risks, including requiring that all visa waiver countries provide the United 

States and Interpol with non-biographical data from lost or stolen issued 

passports, as well as from blank passports; developing clear standard 

operating procedures for the reporting of lost and stolen blank and issued

passport data; and developing and implementing a plan to make Interpol’s 

stolen travel document database automatically available during primary 

inspection at U.S. ports of entry. Given the lengthy time it took for DHS to 

issue the November 2005 summary report to Congress, and to ensure 

future reports contain timely information when issued, we also proposed 

that Congress establish a biennial deadline by which DHS must complete 

the country assessments and report to Congress. 

DHS either agreed with, or stated that it is considering, all of our 

recommendations. Regarding our matter for congressional consideration, 

DHS did not support the establishment of a deadline for the biennial 

report to Congress. Instead, DHS suggested that Congress should require 

continuous and ongoing evaluation. With continuous review, DHS stated 

that it would be able to constantly evaluate U.S. interests and report to 

Congress on the current 2-year reporting cycle on targeted issues of 

concern, rather than providing a historical evaluation. We agree that 

continuous and ongoing evaluation is necessary, and that is why we 

recommended that DHS create real-time monitoring arrangements and 

provide additional resources to the Visa Waiver Program Oversight Unit to 

achieve this goal. Regarding the mandated biennial country assessments, 

we believe that they can serve a useful purpose if they are completed in a

timely fashion. 

Recommendations to 

Improve Program 

Oversight and DHS’s 

Response 

Page 16 GAO-06-1090T 
In closing, the Visa Waiver Program aims to facilitate international travel

for millions of people each year and promote the effective use of 

government resources. Effective oversight of the program entails 

balancing these benefits against the program’s potential risks. To find this 

balance, the U.S. government needs to fully identify the vulnerabilities 

posed by visa waiver travelers, and be in a position to mitigate them. It is 

imperative that DHS commit to strengthen its ability to promptly identify 

and mitigate risks to ensure that the Visa Waiver Program does not 

jeopardize U.S. security interests. This is particularly important given that 

many countries are actively seeking to join the program. 

Mr. Chairman, this concludes my prepared statement. I will be happy to 

answer any questions you or Members of the Subcommittee may have. 

For questions regarding this testimony, please call Jess T. Ford, (202) 512-

4128 or fordj@gao.gov. Individuals making key contributions to this 

statement include John Brummet, Assistant Director, and Kathryn H. 

Bernet, Joseph Carney, and Jane S. Kim. 

Contacts and Staff 

Acknowledgments 

Page 17 GAO-06-1090T 
Related GAO Products and Ongoing Reviews 

Border Security: More Emphasis on State’s Consular Safeguards Could 

Mitigate Visa Malfeasance Risks. GAO-06-115. October 6, 2005

Border Security: Strengthened Visa Process Would Benefit From 

Improvements in Staffing and Information Sharing. GAO-05-859. 

September 13, 2005 

Border Security: Actions Needed to Strengthen Management of 

Department of Homeland Security’s Visa Security Program. GAO-05-801. 

July 29, 2005.

Border Security: Streamlined Visas Mantis Program Has Lowered 

Burden on Foreign Science Students and Scholars, but Further 

Refinements Needed. GAO-05-198. February 18, 2005. 

Border Security: State Department Rollout of Biometric Visas on 

Schedule, but Guidance Is Lagging. GAO-04-1001. September 9, 2004. 

Border Security: Additional Actions Needed to Eliminate Weaknesses in 

the Visa Revocation Process. GAO-04-795. July 13, 2004. 

Border Security: Improvements Needed to Reduce Time Taken to 

Adjudicate Visas for Science Students and Scholars. GAO-04-371. 

February 25, 2004. 

Border Security: New Policies and Procedures Are Needed to Fill Gaps in 

the Visa Revocation Process. GAO-03-798. June 18, 2003. 

Border Security: Implications of Eliminating the Visa Waiver Program. 

GAO-03-38. November 22, 2002. 

Technology Assessment: Using Biometrics for Border Security. GAO-03-

174. November 15, 2002.

Border Security: Visa Process Should Be Strengthened as an

Antiterrorism Tool. GAO-03-132NI. October 21, 2002. 

Review of International Aviation Passenger Prescreening. Requested by 

the Chairman and Ranking Member, Committee on the Judiciary, and the

Ranking Member, Committee on Homeland Security, House of 

Representatives. Report expected in the fall of 1006. 

Issued Reports 

Ongoing Reviews 

Page 18 GAO-06-1090T 
Review of the Department of State’s Measures to Ensure the Integrity of 

Travel Documents. Requested by the Chairman, Committee on the 

Judiciary, House of Representatives; Chairman John N. Hostettler and 

member Darrell E. Issa, Subcommittee on Immigration, Border Security 

and Claims, Committee on the Judiciary, House of Representatives; and,

Chairman Lamar S. Smith, Subcommittee on Courts, the Internet, and 

Intellectual Property, Committee on the Judiciary, House of 

Representatives. Report expected in the spring of 2007. 

Review of the Department of State’s Effort to Address Delays in Visa 

Issuance. Requested by the Chairman and Ranking Member of the 

Committee on Government Reform, House of Representatives. Report 

expected in the spring of 2007. 

Review of Immigrant Visa Processing. Requested by the Ranking Member, 

Committee on Homeland Security, House of Representatives. Report 

expected in mid-2007. 

Page 19 GAO-06-1090T (320455) 
This is a work of the U.S. government and is not subject to copyright protection in the 

United States. It may be reproduced and distributed in its entirety without further 

permission from GAO. However, because this work may contain copyrighted images or 

other material, permission from the copyright holder may be necessary if you wish to 

reproduce this material separately. 
GAO’s Mission The Government Accountability Office, the audit, evaluation and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost

is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts 

newly released reports, testimony, and correspondence on its Web site. To

have GAO e-mail you a list of newly posted products every afternoon, go 

to www.gao.gov and select “Subscribe to Updates.” 

The first copy of each printed report is free. Additional copies are $2 each. 

A check or money order should be made out to the Superintendent of 

Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 

more copies mailed to a single address are discounted 25 percent. Orders 

should be sent to: 

U.S. Government Accountability Office 

441 G Street NW, Room LM 

Washington, D.C. 20548 

To order by Phone: Voice: (202) 512-6000 

TDD: (202) 512-2537 

Fax: (202) 512-6061 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470 

Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400 

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, D.C. 20548 

Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, D.C. 20548 

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Mail or Phone 

To Report Fraud,

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Public Affairs 

PRINTED ON RECYCLED PAPER