United States Government Accountability Office

GAO Report to the Chairman, Committee on 

the Judiciary, House of Representatives

BORDER SECURITY

Stronger Actions 

Needed to Assess and 

Mitigate Risks of the 

Visa Waiver Program 

July 2006 

 

GAO-06-854 
What GAO Found

United States Government Accountability Office

Why GAO Did This Study

Highlights

Accountability Integrity Reliability

July 2006

BORDER SECURITY

Stronger Actions Needed to Assess and 

Mitigate Risks of the Visa Waiver 

Program 

Highlights of GAO-06-854, a report to the 

Chairman, Committee on the Judiciary, 

House of Representatives

The Visa Waiver Program enables

citizens of 27 countries to travel to 

the United States for tourism or 

business for 90 days or less without

obtaining a visa. In fiscal year

2004, more than 15 million people

entered the country under the 

program. After the September 11, 

2001, terrorist attacks, the risks 

that aliens would exploit the 

program to enter the United States

became more of a concern. In this 

report, we (1) describe the Visa 

Waiver Program’s benefits and

risks, (2) examine the U.S.

government’s process for assessing 

potential risks, and (3) assess 

actions taken to mitigate these

risks. We met with U.S. embassy 

officials in six program countries,

and reviewed relevant laws,

procedures, and reports on

participating countries. 

What GAO Recommends

GAO is making a series of

recommendations to DHS to 

strengthen its ability to assess and 

mitigate the program’s risks, such 

as providing more resources to the

program’s monitoring unit and 

issuing standards for the reporting 

of lost and stolen passport data. 

Congress should also consider

establishing a deadline for the 

mandated biennial report to 

Congress. 

DHS and State generally agreed 

with the report. DHS either agreed

with, or said that it would consider, 

all of our recommendations, but 

did not agree that Congress should

establish a deadline for the biennial 

report. 

The Visa Waiver Program has many benefits as well as some inherent risks.

It facilitates travel for millions of people and eases consular workload, but 

poses challenges to border inspectors, who, when screening visa waiver

travelers, may face language barriers or lack time to conduct in-depth 

interviews. Furthermore, stolen passports from visa waiver countries are

prized travel documents among terrorists, criminals, and immigration law 

violators, creating an additional risk. While the Department of Homeland 

Security (DHS) has intercepted many fraudulent documents at U.S. ports of 

entry, DHS officials acknowledged that an undetermined number of 

inadmissible aliens may have entered the United States using a stolen or lost 

passport from a visa waiver country. 

The U.S. government’s process for assessing the risks of the Visa Waiver 

Program has weaknesses. In 2002, Congress mandated that, every 2 years,

DHS review the effect that each country’s continued participation in the 

program has on U.S. law enforcement and security interests, but did not set 

a reporting deadline. In 2004, DHS established a unit to oversee the program 

and conduct these reviews. We identified several problems with the 2004 

review process, as key stakeholders were not consulted during portions of 

the process, preparation for the in-country site visits was not consistent, and 

the final reports were untimely. Furthermore, DHS cannot effectively 

achieve its mission to monitor and report on ongoing law enforcement and 

security concerns in visa waiver countries due to insufficient resources. 

 

DHS has taken some actions to mitigate the program’s risks; however, the 

U.S. government has faced difficulties in further mitigating these risks. In 

particular, the department has not established time frames and operating 

procedures regarding timely stolen passport reporting—a program 

requirement since 2002. Furthermore, DHS has sought to require the 

reporting of lost and stolen passport data to the United States and the 

International Criminal Police Organization (Interpol), but it has not issued 

clear reporting guidelines to participating countries. While most visa waiver 

countries participate with Interpol’s database, four do not. DHS is not using 

Interpol’s data to its full potential as a border screening tool because DHS 

does not automatically access the data at primary inspection. 

Visa Waiver Program Admissions, Fiscal Years 2002 through 2004 

Admissions in millions

Source: GAO analysis of DHS data.

12,857,131

13,318,229

15,603,400

Fiscal year

0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

2004

2003

2002

www.gao.gov/cgi-bin/getrpt?GAO-06-854.

To view the full product, including the scope 

and methodology, click on the link above. 

For more information, contact Jess Ford at 

(202) 512-4128 or fordj@gao.gov.
Contents 

Letter 1

Results in Brief 3

Background 6

Visa Waiver Program Has Benefits and Risks 9 

Process for Assessing Program Risks Has Weaknesses 16 

DHS Faces Difficulties in Mitigating Program Risks 25 

Conclusions 31

Recommendations 32

Matter for Congressional Consideration 33 

Agency Comments and Our Evaluation 33 

Appendix I Scope and Methodology 36 

Appendix II Map of Visa Waiver Program Countries 39 

Appendix III Foreign Nationals Admitted under the Visa Waiver 

Program, Fiscal Years 2002 through 2004 40 

Appendix IV Comments from the Department of Homeland 

Security 41 

Appendix V Comments from the Department of State 54 

Appendix VI Comments from the International Criminal Police

Organization 57 

Appendix VII GAO Contact and Staff Acknowledgments 60

Page i GAO-06-854 Visa Waiver Program
Table 

Table 1: Fraudulent Passport Intercepts, January through June 

2005 15 

Figures 

Figure 1: Foreign Nationals Admitted under the Visa Waiver 

Program, from Fiscal Years 2002 through 2004 8 

Figure 2: Visa Waiver Program Admissions as a Percentage of Total 

Nonimmigrant Admissions into the United States, Fiscal 

Years 2002 through 2004 10 

Figure 3: Comparison of Screening for U.S. Visas versus Arrival 

Inspection Screening at U.S. Air Ports of Entry 13 

Figure 4: Timeline of 2004-2005 Country Assessment Process and 

Other Key Milestones 22 

Figure 5: CBP’s Access to Interpol’s Lost and Stolen Travel

Document Database 30 

Abbreviations 

CBP Customs and Border Protection 

DHS Department of Homeland Security 

Interpol International Criminal Police Organization 

OIE Office of International Enforcement 

OIG Office of the Inspector General 

US-VISIT U.S. Visitor and Immigrant Status Indicator Technology 

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. It may be reproduced and distributed in its entirety without further 

permission from GAO. However, because this work may contain copyrighted images or 

other material, permission from the copyright holder may be necessary if you wish to 

reproduce this material separately. 

Page ii GAO-06-854 Visa Waiver Program
United States Government Accountability Office

Washington, DC 20548 

July 28, 2006

The Honorable Jim Sensenbrenner, Jr. 

Chairman 

Committee on the Judiciary 

House of Representatives 

The Honorable Jim Sensenbrenner, Jr. 

Chairman 

Committee on the Judiciary 

House of Representatives 

Dear Mr. Chairman: 

In fiscal year 2004, more than 15 million travelers entered the United 

States under the Visa Waiver Program. This program facilitates 

international travel and commerce, and eases consular workload at 

overseas posts, by enabling citizens of 27 participating countries to travel

to the United States for tourism or business for 90 days or less without 

first obtaining a visa1

 from U.S. embassies and consulates.2 The Visa 

Waiver Program was created as a pilot program in 1986,3

 and it became a

permanent program in 2000,4

 about 1 year prior to the terrorist attacks of 

September 11, 2001. Participating countries were selected because their 

citizens had demonstrated a pattern of compliance with U.S. immigration 

laws, and the governments of these countries granted reciprocal visa-free 

travel to U.S. citizens. After the terrorist attacks, the potential risks of the 

program became more of a concern. In particular, convicted terrorist 

Zacarias Moussaoui and “shoe-bomber” Richard Reid both boarded flights 

to the United States with passports issued by Visa Waiver Program 

countries. In May 2002, Congress mandated that the Department of 

Homeland Security (DHS) evaluate and report to Congress at least 

biennially on the effect that each country’s continued participation in the 

In fiscal year 2004, more than 15 million travelers entered the United 

States under the Visa Waiver Program. This program facilitates 

international travel and commerce, and eases consular workload at 

overseas posts, by enabling citizens of 27 participating countries to travel

to the United States for tourism or business for 90 days or less without 

first obtaining a visa

 

1

 from U.S. embassies and consulates.2 The Visa 

Waiver Program was created as a pilot program in 1986,3

 and it became a

permanent program in 2000,4

 about 1 year prior to the terrorist attacks of 

September 11, 2001. Participating countries were selected because their 

citizens had demonstrated a pattern of compliance with U.S. immigration 

laws, and the governments of these countries granted reciprocal visa-free 

travel to U.S. citizens. After the terrorist attacks, the potential risks of the 

program became more of a concern. In particular, convicted terrorist 

Zacarias Moussaoui and “shoe-bomber” Richard Reid both boarded flights 

to the United States with passports issued by Visa Waiver Program 

countries. In May 2002, Congress mandated that the Department of 

Homeland Security (DHS) evaluate and report to Congress at least 

biennially on the effect that each country’s continued participation in the 

1

The United States also issues visas to those who intend to immigrate to the United States. 

In this report, we use the term “visa” to refer to nonimmigrant visas only. 

2

The participating countries are Andorra, Australia, Austria, Belgium, Brunei, Denmark,

Finland, France, Germany, Iceland, Ireland, Italy, Japan, Liechtenstein, Luxembourg, 

Monaco, the Netherlands, New Zealand, Norway, Portugal, San Marino, Singapore,

Slovenia, Spain, Sweden, Switzerland, and the United Kingdom (see app. II for a map of these 

countries). Canada and Bermuda are not participants in the Visa Waiver Program; however,

nationals of Canada and Bermuda may, under certain circumstances, qualify for visa-free 

travel to the United States. 

3

The Immigration Reform and Control Act of 1986, P.L. 99-603. 

4

The Visa Waiver Permanent Program Act, P.L. 106-396. 

Page 1 GAO-06-854 Visa Waiver Program
program has on U.S. law enforcement and security interests.5

 Effective 

oversight of the Visa Waiver Program is essential to find the right balance 

between facilitating legitimate travel and screening for potential terrorists, 

criminals, and others that may pose law enforcement and immigration 

concerns. 

In response to your request, this report (1) describes the Visa Waiver 

Program’s benefits and potential risks; (2) examines the U.S. government’s 

process for assessing the program’s risks; and (3) assesses actions taken 

to mitigate these risks. 

To identify the benefits of the program, we reviewed relevant 

documentation, including DHS’s Office of the Inspector General (OIG) 

reports and our 2002 report on the implications of eliminating the 

program.6

 We also interviewed political, economic, consular, commercial, 

and law enforcement officials at U.S. embassies in six Visa Waiver 

Program countries. To determine the risks the Visa Waiver Program, we 

interviewed officials from DHS’s National Targeting Center, Intelligence 

and Analysis Directorate, and Forensic Document Laboratory. In addition, 

we observed fraudulent document detection training of Customs and 

Border Protection (CBP) agents at the Federal Law Enforcement Training 

Center. To evaluate the U.S. government’s efforts to assess and mitigate 

these risks, we analyzed the laws governing the program, relevant 

regulations and agency operating procedures, and OIG reports. We also 

examined 15 of the 25 completed reports from the 2004 review process 

assessing the participation of Visa Waiver Program countries.7

 As of June 

2006, the remaining 10 assessments were pending classification review. 

We met with officials from several DHS component agencies and offices, 

the Department of State’s (State) Consular Affairs Bureau and its Europe 

and Eurasia Bureau, and the International Criminal Police Organization 

(Interpol) in Lyon, France. We also met with the Department of Justice’s 

(Justice) Interpol-U.S. National Central Bureau in Washington, D.C., which 

facilitates international law enforcement cooperation among the United 

States and Interpol and its other member countries. In addition to U.S. 

 5

Prior to this change, DHS was required to report at least once every 5 years. See the 

Enhanced Border Security and Visa Entry Reform Act, P.L 107-173. 

6

See GAO, Border Security: Implications of Eliminating the Visa Waiver Program, 

GAO-03-38 (Washington, D.C.: Nov. 22, 2002).

7

As of June 2006, the reviews of the remaining two participating countries—Italy and 

Portugal—were in process. 

Page 2 GAO-06-854 Visa Waiver Program
officials in the six Visa Waiver Program countries, we spoke with foreign 

government officials in three of these countries. We conducted our 

evaluation from September 2005 through June 2006 in accordance with 

generally accepted government auditing standards. 

The Visa Waiver Program provides many benefits to the United States; 

however, travelers attempting to enter the United States under the 

program may pose security or law enforcement risks, including 

immigration law violations, because they are not subject to the same 

degree of screening as non-visa-waiver travelers. The program was 

designed to boost international business and tourism, and allows State to 

shift its consular resources to posts with higher-risk visa applicants. 

However, travelers visiting the United States under the Visa Waiver 

Program are not subject to the same degree of screening as travelers with 

visas because they need not be interviewed by a consular officer before 

arriving at a U.S. port of entry. In addition, border inspectors at U.S. ports 

of entry are disadvantaged in screening visa waiver travelers because they

may not know the alien’s language or local fraudulent document trends in 

the alien’s home country, nor have the time to conduct an extensive 

interview. In contrast, visa-issuing officers at U.S. embassies generally 

have more time to interview applicants—often in the applicants’ native 

language—and have more country-specific knowledge of passports and 

fraud trends. Furthermore, lost and stolen passports from visa waiver 

countries are highly prized among those travelers seeking to conceal their 

true identities or nationalities, creating an additional program risk. In our 

discussions with DHS officials, they acknowledged that an undetermined 

number of inadmissible aliens may have entered the United States using a

stolen or lost passport from a visa waiver country, and, in fact, passports 

from Visa Waiver Program countries have been used illegally by travelers 

attempting to enter the United States. For example, from January through 

June 2005, at U.S. ports of entry, DHS confiscated 298 passports issued by 

Visa Waiver Program countries that travelers were attempting to use 

fraudulently for admission into the United States. Thus, there is a potential 

risk that the program could be exploited for illegal entry into the United 

States. 

Results in Brief 

DHS, in coordination with State and Justice, has developed a process for 

assessing the law enforcement and security risks of the Visa Waiver 

Program; this process has weaknesses, however. In 2002, Congress 

mandated that DHS review the security risks posed by each visa waiver 

country’s participation in the program at least every 2 years. In 2004, DHS 

established the Visa Waiver Program Oversight Unit within the Office of 

Page 3 GAO-06-854 Visa Waiver Program
International Enforcement (OIE).8

 DHS conducted its first mandated 

biennial reviews in 2004, and determined that all of the countries it 

reviewed should remain in the program.9

 In general, the reviews contained 

an analysis of issues, such as individual countries’ border controls, 

security over passports and national identity documents, and other 

matters relevant to law enforcement, immigration, and national security.

However, we identified several problems with the country review process. 

Specifically, key interagency stakeholders,10 such as embassies overseas, 

State’s regional bureaus, and forensic document analysts were left out of 

portions of the 2004 country review process; preparation for the in-country 

site visits was not always consistent; and, the review process lacked clear 

criteria and guidance to make key judgments. Also, the country 

assessments prepared by DHS were not completed in a timely fashion and 

contained some dated information that did not necessarily reflect the 

current risks posed by a country’s continued participation in the program. 

In particular, interagency teams conducted site visits as part of the country 

assessments from May through September 2004, and transmitted the final 

report to Congress more than 1 year later, in November 2005. Moreover, 

DHS has not provided sufficient resources to OIE to effectively monitor 

the risks posed by visa waiver countries on an ongoing basis. While the 

Visa Waiver Program Oversight Unit developed a strategic plan to monitor 

the program, it has been unable to implement this plan with its current 

staff of two full-time employees. In addition, DHS has not established 

points of contact within the U.S. embassies so it can communicate directly

with foreign government contacts and field officials, who are best 

positioned to monitor compliance with the program’s requirements and 

report on current events and issues of potential concern. Without this 

outreach, DHS is not able to leverage the existing resources at U.S. 

embassies in all visa waiver countries to obtain current information on 

potential risks, as well as countries’ progress in addressing these risks. 

 8

OIE is located in the Office of Policy Development under the direction of the Assistant 

Secretary of Homeland Security for Policy. 

9

DHS’s Office of Policy began this review in early 2004, several months before the Visa 

Waiver Program Oversight Unit was established in July of that year. 

10The interagency working group charged in 2004 with assessing participating countries’ 

adherence to the program’s statutory requirements comprised officials from Justice’s 

Office of International Affairs, State’s Bureau of Consular Affairs, and several components

within DHS, including the Intelligence and Analysis Directorate, CBP’s Office of Field 

Operations, and Immigration and Customs Enforcement’s Forensic Document Laboratory,

among others. Representatives from some of these agencies formed the in-country site visit 

teams. 

Page 4 GAO-06-854 Visa Waiver Program
DHS has taken some actions to mitigate the risks of the Visa Waiver 

Program, including terminating the use of the German temporary passport 

under the program; however, the department has faced difficulties in 

further mitigating the risks of the program, particularly regarding lost and 

stolen passport reporting—a key vulnerability. For example, not all 

countries have consistently reported their data to the United States on 

stolen blank passports, even though reporting such data is vital to 

mitigating program risks. In one instance, a visa waiver country reported 

to the United States the theft of nearly 300 blank passports more than 9 

years after the theft occurred. In 2002, timely reporting of such thefts 

became a statutory requirement for continued participation in the 

program, but DHS has not issued standard operating procedures for 

obtaining these data. DHS has also sought to expand this requirement to 

include the reporting of data, to the United States and Interpol,11 about lost

and stolen issued12 (as well as blank) passports; however, the United 

States lacks a centralized mechanism for foreign governments to report all 

stolen passports, and DHS has not identified the U.S. government entity to

which participating countries should report this information. While most 

visa waiver countries contribute to Interpol’s database, four do not. 

Moreover, some countries that do contribute do not do so on a regular 

basis, according to Interpol officials. In addition, Interpol’s data on lost 

and stolen travel documents is not automatically accessible to U.S. border 

inspectors at primary inspection—one reason why it is not an effective 

border screening tool, according to DHS, State, and Justice officials. 

According to the Secretary General of Interpol, until DHS can 

automatically query Interpol’s data, the United States will not have an 

effective screening tool for checking passports. However, DHS has not yet 

finalized a plan to acquire this systematic access to Interpol’s data. 

We are making a series of recommendations to DHS to strengthen its 

ability to assess the risks of the Visa Waiver Program, including a 

recommendation to create real-time monitoring mechanisms to improve 

communication between the department and overseas posts, and to 

 11Interpol is the world’s largest international police organization, with 184 member 

countries. Created in 1923, it facilitates cross-border police cooperation, and supports and 

assists all organizations, authorities, and services whose mission is to prevent or combat 

international crime. In July 2002, Interpol established a database on lost and stolen travel 

documents. As of June 2006, the database contained about 11.6 million records of lost and 

stolen passports.

12Issued passports have been officially personalized with the bearer’s biographical 

information. 

Page 5 GAO-06-854 Visa Waiver Program
provide additional resources for the Visa Waiver Program Oversight Unit. 

We are also making a series of recommendations to mitigate the program’s 

risks, including communicating clear standard operating procedures for 

the reporting of lost and stolen, blank and issued, passport data. Finally, 

we are including a matter for congressional consideration: to improve the

timeliness of DHS’s assessments of the risks of each country’s continued 

participation in the program, Congress should consider establishing a 

deadline by which the department must complete its biennial country 

assessments and report to Congress. 

We received written comments from DHS, State, and Interpol, which we 

have reprinted in appendices IV, V, and VI, respectively. DHS either 

agreed with, or stated that it is considering, all of our recommendations. 

Regarding our matter for congressional consideration, DHS did not appear

to support the establishment of a deadline for the biennial report to 

Congress. Instead, DHS suggested that Congress should require 

continuous and ongoing evaluation of the risks of each country’s 

continued participation in the program. We agree that continuous and 

ongoing evaluation is necessary, which is why we recommended that DHS 

create real-time monitoring arrangements and provide additional 

resources to the Visa Waiver Program Oversight Unit to achieve this goal. 

Regarding the mandated biennial country assessments, we believe that 

they can serve a useful purpose if they are completed in a timely fashion. 

State agreed with our report, and welcomed our recommendations calling 

for enhanced communication to and from DHS, and for the timely 

reporting of lost and stolen passport data. Interpol did not comment on 

our recommendations, but provided information about its lost and stolen 

travel document database and tools that it has developed to allow law 

enforcement officers to instantly check this database at airports and other 

border entry points. 

The Immigration Reform and Control Act of 1986 created the Visa Waiver 

Program as a pilot program.13 It was initially envisioned as an immigration 

control and economic promotion program, according to State. 

Participating countries were selected because their citizens had a 

demonstrated pattern of compliance with U.S. immigration laws, and the 

Background 

 13P.L. 99-603. 

Page 6 GAO-06-854 Visa Waiver Program
governments of these countries granted reciprocal visa-free travel to U.S.

citizens. In 2000, the program became permanent under the Visa Waiver 

Permanent Program Act.14 In 2002, we reported on the legislative 

requirements to which countries must adhere before they are eligible for 

inclusion in the Visa Waiver Program.15 In general, these are the 

requirements: 

• A low nonimmigrant visa refusal rate. To qualify for visa waiver status, a 

country must maintain a refusal rate of less than 3 percent for its citizens 

who apply for business and tourism visas. 

• A machine-readable passport program. The country must certify that it 

issues machine-readable passports to its citizens. As of June 26, 2005, all 

travelers are required to have a machine-readable passport to enter the 

United States under this program. 

• Reciprocity. The country must offer visa-free travel for U.S. citizens. 

Figure 1 shows the number of foreign nationals admitted to the United 

States under the program in recent years (see app. III for more detailed

admissions statistics). Persons entering the United States under the Visa 

Waiver Program must 

• have a valid passport issued by the participating country and be a national 

of that country; 

• be seeking entry for 90 days or less as a temporary visitor for business or 

tourism;16

• have been determined by CBP at the U.S. port of entry to represent no 

threat to the welfare, health, safety, or security of the United States; 

• have complied with conditions of any previous admission under the 

program (for example, individuals must have stayed in the United States

 14P.L. 106-396. 

15GAO-03-38. 

16According to State, the Visa Waiver Program is a substitute entry mechanism for

nonimmigrant, short-term, business, and tourism visas only; it does not apply to students,

temporary workers, and others who require visas to enter the United States. 

Page 7 GAO-06-854 Visa Waiver Program
for 90 days or less during prior visa waiver visits); 

• if entering by air or sea, possess a round-trip transportation ticket issued 

by a carrier that has signed an agreement with the U.S. government to 

participate in the program, and must have arrived in the United States 

aboard such a carrier; and 

• if entering by land, have proof of financial solvency and a domicile abroad 

to which they intend to return. 

Figure 1: Foreign Nationals Admitted under the Visa Waiver Program, from Fiscal 

Years 2002 through 2004 

Note: As of June 2006, CBP officials stated that admissions data from fiscal year 2005 are not yet 

available. 

Following the events of September 11, 2001, Congress passed additional 

laws to strengthen border security policies and procedures, and DHS and 

State instituted other policy changes that have affected a country’s 

qualifications for participating in the Visa Waiver Program. For example, 

all passports issued after October 26, 2005, must contain a digital 

0

2

4

6

8

10

12

14

16

2002 2003 2004 

Fiscal year 

Source: GAO analysis of DHS data.

Total nonimmigrant admissions in millions

Page 8 GAO-06-854 Visa Waiver Program
photograph printed in the document; passports issued to visa waiver 

travelers after October 26, 2006, must be electronic (e-passports).17 Epassports aim to enhance border security by making it more difficult to 

misuse the passport to gain entry into the United States. Travelers with 

passports issued after the deadline that do not meet these requirements 

must obtain a visa from a U.S. embassy or consulate overseas before 

departing for the United States. In addition, the May 2002 Enhanced 

Border Security and Visa Reform Act required that participating countries

certify that the theft of their blank passports is reported to the U.S. 

government in a timely manner. Moreover, the act increased the 

frequency—from once every 5 years to once every 2 years—of mandated 

assessments of the effect of each country’s continued participation in the 

Visa Waiver Program on U.S. security, law enforcement, and immigration 

interests. 

The Visa Waiver Program has many benefits, including facilitating 

international travel for millions of foreign citizens seeking to visit the 

United States each year, creating substantial economic benefits to the 

United States, and allowing State to allocate resources to visa-issuing 

posts in countries with higher-risk applicant pools. However, there are 

inherent security and law enforcement risks in the program that pose 

challenges to the United States. 

The Visa Waiver Program was created to facilitate international travel 

without jeopardizing the welfare or security of the United States, 

according to the program’s legislative history. In fact, visa waiver travelers 

have represented about one-half of all nonimmigrant admissions to the 

United States in recent years, as demonstrated by figure 2 below. 

According to economic and commercial officers at several of the U.S. 

embassies we visited, visa-free travel to the United States boosts 

international business travel and tourism, as well as airline revenues, and 

Visa Waiver Program 

Has Benefits and 

Risks 

Visa Waiver Program

Facilitates Travel to the 

United States 

 17In general, e-passports will contain a chip embedded in the passport that will store the

same information that is printed on the data page of the passport, such as name, date of 

birth, gender, place of birth, dates of passport issuance and expiration, place of issuance, 

passport number, and a photo image of the bearer. In addition, e-passports will hold a 

unique identification number and a digital signature to protect the stored data from

alteration. E-passports provide two key pieces of information: the digital signature and the 

digital image of the passport holder. Digital signatures provide a higher level of security for 

the passport by providing a means to electronically verify the authenticity of the data on 

the chip, including the traveler’s photograph and biographical information. 

Page 9 GAO-06-854 Visa Waiver Program
creates substantial economic benefits to the United States. In its report 

accompanying the 2000 bill to make the program permanent, the House 

Committee on the Judiciary acknowledged the program’s importance to 

the U.S. travel and tourism industry, and the benefit it provides to 

American citizens by allowing reciprocal visa-free travel to visa waiver 

countries. As we reported in 2002, any decision to eliminate the program 

could discourage some business and tourism in the United States.18 In 

addition, visa waiver countries could begin requiring visas for U.S. citizens 

traveling to the 27 participating countries for temporary business or 

tourism purposes, which would impose a burden of additional cost and 

time on U.S. travelers to these countries. 

Figure 2: Visa Waiver Program Admissions as a Percentage of Total Nonimmigrant 

Admissions into the United States, Fiscal Years 2002 through 2004 

Note: Data on total nonimmigrant admissions are derived from DHS’s 2004 Yearbook of Immigration 

Statistics. These data do not include visa-free entries by citizens of Canada or travelers entering the 

U.S. territory of Guam under its visa waiver program. 

0 

5 

10 

15 

20 

25 

30 

35 

Visa Waiver Program admissions

2002 2003 2004 

Fiscal year 

Source: GAO analysis of DHS data.

Total nonimmigrant admissions in millions

51%

48% 46%

 18GAO-03-38. 

Page 10 GAO-06-854 Visa Waiver Program
Moreover, the program allows State to allocate its resources to visaissuing posts in countries with higher-risk applicant pools. In 2002, we 

reported that eliminating the program would increase State’s resource 

requirements.19 Specifically, if the program were eliminated, we estimated 

that State’s initial costs at that time to process the additional workload 

would likely range between $739 million and $1.28 billion and that annual 

recurring costs would likely range between $522 million and $810 million. 

For example, millions of visa waiver travelers who have benefited from 

visa-free travel would need to obtain a visa to travel to the United States if 

the program did not exist. Furthermore, we reported that U.S. officials, 

including those from State as well as from some law enforcement 

agencies, said that eliminating the Visa Waiver Program could have 

negative implications for U.S. relations with governments of participating 

countries and could impair their cooperation in efforts to combat 

terrorism. 

The Visa Waiver Program can pose risks to U.S. security, law enforcement, 

and immigration interests because some foreign citizens may exploit the 

program to enter the United States. In particular, visa waiver travelers are

not subject to the same degree of screening as those travelers who must 

first obtain a visa before arriving in the United States. Furthermore, lost 

and stolen passports from visa waiver countries could be used by 

terrorists, criminals, and immigration law violators to gain entry into the 

United States. 

Since September 11, 2001, the visa issuance process has taken on greater 

significance as an antiterrorism tool, as we have previously reported.20

Those travelers who must apply for visas before traveling to the United 

States receive two levels of screening before entering the country (see fig.

3).21 However, visa waiver travelers are first screened in person by a CBP 

Visa Waiver Program Can 

Pose Risks to U.S.

Security, Law 

Enforcement, and 

Immigration Interests 

Visa Waiver Travelers and Visa 

Applicants Face Different 

Levels of Screening 

 19GAO-03-38. 

20GAO has issued a series of reports on how the visa issuance process serves as an 

antiterrorism tool, including: GAO, Border Security: Strengthened Visa Process Would

Benefit from Improvements in Staffing and Information Sharing, GAO-05-859 

(Washington, D.C.: Sept. 13, 2005); Border Security: Actions Needed to Strengthen 

Management of Department of Homeland Security’s Visa Security Program, GAO-05-801 

(Washington, D.C.: July 29, 2005); and, Border Security: Visa Process Should be 

Strengthened as an Antiterrorism Tool, GAO-03-132NI (Washington, D.C.: Oct. 21, 2002). 

21All foreign visitors, whether they have visas or are seeking to enter the United States 

under the Visa Waiver Program, undergo inspections by CBP inspectors at U.S. air, sea, and 

land ports of entry to ensure that only admissible persons enter the United States. 

Page 11 GAO-06-854 Visa Waiver Program
inspector once they arrive at the U.S. port of entry, perhaps after having

already boarded an international flight bound for the United States with a 

fraudulent travel document. For visa waiver travelers, CBP primary 

inspectors observe the applicant, examine his or her passport, collect the

applicant’s fingerprints as part of the U.S. Visitor and Immigrant Status 

Indicator Technology program (US-VISIT),22 and check his or her name 

against automated databases and watch lists, which contain information 

regarding the admissibility of aliens, including known terrorists, criminals, 

and immigration law violators. However, according to the DHS OIG, 

primary border inspectors are disadvantaged when screening Visa Waiver 

Program travelers because they may not know the alien’s language or local 

fraud trends in the alien’s home country, nor have the time to conduct an

extensive interview. In contrast, non-visa-waiver travelers, who must 

obtain a visa from a U.S. embassy or consulate, undergo an interview by 

consular officials overseas, who conduct a rigorous screening process 

when deciding to approve or deny a visa. As we have previously reported, 

State has taken a number of actions since 2002 to strengthen the visa 

issuance process as a border security tool.23 Moreover, consular officers 

have more time to interview applicants and examine the authenticity of 

their passports, and may also speak the visa applicant’s native language, 

according to consular officials. Inadmissible travelers who need visas to 

enter the United States may attempt to acquire a passport from a Visa 

Waiver Program country to avoid the visa screening process. 

 22The US-VISIT program is a government-wide program to collect, maintain, and share 

information on foreign nationals, and better control and monitor the entry, visa status, and 

exit of visitors. Under the program, foreign visitors are required to submit to fingerprint 

scans of their right and left index finger and have a digital photograph taken upon arrival at

U.S. ports of entry. 

23GAO-05-859 and GAO-03-132NI. 

Page 12 GAO-06-854 Visa Waiver Program
Figure 3: Comparison of Screening for U.S. Visas versus Arrival Inspection

Screening at U.S. Air Ports of Entry 

One of the Visa Waiver Program Oversight Unit’s primary concerns is the 

potential exploitation by terrorists, immigration law violators, and other 

criminals of a visa waiver country’s lost or stolen passports. DHS 

Sources: GAO; Nova Development (clip art).

At post, 

application 

reviewed, 

fingerprints

collected, and 

name check 

performed

Applicant 

interviewed 

and supporting 

documents

reviewed

If denied, 

cannot 

board plane

Consular officer 

reviews name 

check results and 

determines if 

additional security 

checks are 

required or 

warranted

Travelers with 

visas

Visa Waiver Program 

travelers

Pre-arrival passenger screening

Primary Inspection

Secondary Inspection

These screening steps occur for travelers

with or without visas: 

Traveler is admitted or denied entry 

into United States

• Airlines submit passenger information, including biographical data and passport numbers, to 

CBP prior to the arrival of the aircraft at a U.S. port of entry 

• CBP reviews the data and conducts queries against law enforcement and immigration 

databases, to determine whether any passengers are to be referred to secondary inspection 

• Passport data scanned or entered manually into databases

• Alien screened against watchlists

• Establish identity of the alien and inspect documents for validity and authenticity

• Identify inconsistencies between the database records and the documents presented; 

 the aliens are sent to secondary inspections for more thorough examinations, if necessary

• More in-depth, time-consuming analyses to verify the traveler's identity and documentation

• Access to National Targeting Center, Forensic Document Laboratory, and other resources

Visa denied Visa issued 

Lost and Stolen Passports from 

Visa Waiver Program Countries 

Are Highly Valued 

Page 13 GAO-06-854 Visa Waiver Program
intelligence analysts, law enforcement officials, and forensic document 

experts all acknowledge that misuse of lost and stolen passports is the 

greatest security problem posed by the Visa Waiver Program. Lost and 

stolen passports from visa waiver countries are highly prized travel 

documents, according to the Secretary General of Interpol. Moreover, Visa

Waiver Program countries that do not consistently report the losses or 

thefts of their citizens’ passports, or of blank passports, put the United 

States at greater risk of allowing inadmissible travelers to enter the 

country. 

Fraudulent passports from Visa Waiver Program countries have been used 

illegally by travelers seeking to disguise their true identities or 

nationalities when attempting to enter the United States. For example, 

from January through June 2005, DHS reported that it confiscated, at U.S.

ports of entry, 298 fraudulent or altered passports issued by Visa Waiver 

Program countries that travelers were attempting to use for admission into 

the United States (see table 1).24 Two more recent cases demonstrate 

continued attempts to enter the United States with fraudulent passports 

issued by visa waiver countries: 

• In December 2005, a Pakistani citizen attempted to enter the United States

under the program with a counterfeit United Kingdom passport that she 

had purchased. During secondary inspection, the CBP officer detected 

flaws in the passport. 

• In March 2006, an Albanian citizen attempted to enter the United States 

using a Belgian passport that he had purchased. The traveler confessed to

this upon questioning by CBP officers during secondary inspection. 

 24In 2005, CBP established a Fraudulent Document Analysis Unit to conduct trend analyses 

on travel documents used to enter the United States. The unit’s first statistical report

covered fraudulent document trends from January through June 2005, primarily focusing

on passport statistics. 

Page 14 GAO-06-854 Visa Waiver Program
Table 1: Fraudulent Passport Intercepts, January through June 2005 

Visa Waiver Program country of issuance Number of passports

France 67

Italy 52

United Kingdom 38

Japan 29

Singapore 24

Spain 19

Portugal 19

Slovenia 14

Netherlands 9

Germany 6

Austria 5

Belgium 5

Norway 4

Ireland 3

Sweden 2

Switzerland 2

Total 298

Source: CBP. 

In 2004, the DHS OIG reported that aliens applying for admission to the 

United States using lost or stolen passports have little reason to fear being 

caught. DHS’s OIG reported that a lack of training hampered border 

inspectors’ ability to detect passport fraud among Visa Waiver Program 

travelers, and recommended that CBP inspectors receive additional 

training in fraudulent document detection.25 At that time, the 12-week 

training course for new inspectors at the Federal Law Enforcement 

Training Center devoted 1 day to passport fraud, according to the OIG. 

Currently, CBP dedicates 16 hours out of the 16-week basic training 

program to fraudulent document detection training for new border 

inspectors, and provides additional courses for inspectors throughout 

their assignments at ports of entry. Nevertheless, training officials said 

that fraudulent and counterfeit passports are extremely difficult to detect,

 25GAO has also reported on inspections at land ports of entry. GAO, Land Border Ports of 

Entry: Vulnerabilities and Inefficiencies in the Inspections Process, GAO-03-1084R 

(Washington, D.C.: Aug. 18, 2003). 

Page 15 GAO-06-854 Visa Waiver Program
even for the most experienced border inspectors—which makes it 

imperative that lost and stolen passports are reported on a timely basis. 

Although DHS has intercepted some travelers with fraudulent passports at 

U.S. ports of entry, DHS officials acknowledged that an undetermined 

number of inadmissible aliens may have entered the United States using a

lost or stolen passport from a visa waiver country. According to State, 

these aliens may have been inadmissible because they were immigration 

law violators, criminals, or terrorists. Following are several examples: 

• In July 2005, two aliens successfully entered the United States using lost or 

stolen Austrian passports. DHS was not notified that these passports had 

been lost or stolen prior to this date; the aliens were admitted, and there is

no record of their departure, according to CBP. In October 2005, CBP 

referred this case to DHS Immigration and Customs Enforcement for 

further action. 

• In June 2005, CBP inspectors admitted into the United States two aliens 

using Italian passports that were from a batch of stolen passports. CBP 

was notified that this batch was stolen; however, the aliens altered the 

passport numbers to avoid detection by CBP officers. DHS has no record

that these individuals departed the United States.

• Also in June 2005, three aliens traveling together—all using fraudulent 

Italian passports—were interviewed at primary inspection. CBP referred 

one alien, an Albanian citizen, to secondary inspection because she was 

reluctant to answer the inspector’s questions. In secondary inspection, 

CBP determined that her passport had been altered. CBP admitted the 

other two aliens, but subsequently determined that their passports were 

part of the batch of stolen Italian passports cited in the previous example. 

In July 2004, DHS created the Visa Waiver Program Oversight Unit within 

OIE to monitor the Visa Waiver Program. Its mission is to oversee Visa 

Waiver Program activities and monitor countries’ adherence to the 

program’s statutory requirements, ensuring that the United States is 

protected from those who wish to do it harm or violate its laws, including 

immigration laws. In 2004, DHS reviewed the law enforcement and 

security risks posed by the continued participation of 25 of the 27 

countries in the program. However, we identified problems with the 

country review process by which DHS assesses these risks. For example, 

DHS did not involve key interagency stakeholders in certain portions of 

the review process, and did not establish transparent protocols for the 

Process for Assessing 

Program Risks Has 

Weaknesses 

Page 16 GAO-06-854 Visa Waiver Program
country assessments—including internal milestones or deadlines for 

completing the final country assessments, the goals of the site visits, and

an explanation of the clearance process. Furthermore, OIE is unable to 

effectively monitor the immigration, law enforcement, and security risks 

posed by visa waiver countries on a continuing basis because of 

insufficient resources. 

In April 2004, the DHS OIG identified significant areas where DHS needed

to strengthen and improve its management of the Visa Waiver Program.26

For example, the OIG found that it was unclear who was managing the 

program following the dissolution of the Immigration and Naturalization 

Service. In addition, the OIG found that a lack of funding, trained 

personnel, and other issues left DHS unable to comply with the mandated 

biennial country assessments. In response to these findings, DHS 

established OIE’s Visa Waiver Program Oversight Unit in July 2004, and 

named a director to manage the office. Since its establishment, DHS, and 

particularly OIE, has made strides to address concerns raised by the 2004

OIG review. Specifically, DHS has: 

Initial Steps Taken to 

Assess Risk of Visa Waiver 

Program 

• conducted site visits in all 27 participating countries; 

• completed comprehensive assessments of 25 participating countries, 

examining the effect of continued participation in the Visa Waiver 

Program on U.S. security and law enforcement interests, including the 

enforcement of immigration laws; 

• identified risks in some of the countries and brought the concerns to the 

attention of host-country governments in five visa waiver countries;27

• submitted a six-page report to Congress in November 2005 that 

summarized the findings from the 2004 assessments; and 

 26Prior to the establishment of DHS in 2003, Justice’s Office of the Inspector General 

examined visa waiver operations in 1999 and 2001, when the then-Immigration and 

Naturalization Service managed the program. Justice’s Inspector General identified several 

chronic and recurring problems and made a series of recommendations to strengthen

implementation of the program. 

27In this report, we do not name the specific Visa Waiver Program countries where DHS

identified security concerns because the department determined that this is sensitive 

information. 

Page 17 GAO-06-854 Visa Waiver Program
• initiated assessments for the remaining two countries in August and 

September 2005. 

In addition, in September 2005, DHS and State organized a technical 

conference in Washington, D.C., with representatives from Visa Waiver 

Program countries, to discuss the passport requirements for visa waiver 

travelers, and the October 2005 and 2006 deadlines for digital photographs 

and e-passports, respectively. Together, these actions demonstrate 

significant improvements since the April 2004 OIG report. 

Despite these steps to strengthen and improve the management of the 

program, we identified several problems with the process DHS uses to 

assess the risks posed by each of the visa waiver countries’ continued 

participation in the program—namely the mandated biennial country 

assessment process. For the 2004 assessments, we found the following: 

DHS Lacks a ClearlyDefined, Consistent, and 

Timely Process to Assess 

Risks of Visa Waiver 

Program 

• some key stakeholders were excluded from the decision-making process; 

• the reviews lacked clear criteria to make key judgments; 

• there was inconsistent preparation for the in-country site visits for the 

reviews; and

• DHS and its interagency partners neither completed the 25 country 

assessments nor issued the summary report to Congress in a timely 

manner. 

OIE has acknowledged such weaknesses and has begun to make 

adjustments; however, concerns remain. 

We found that the review process lacked clear protocols, as key 

stakeholders were left out of the report development process. Specifically, 

after conducting the site visits and contributing to the reports on the site 

visits, DHS and the interagency working group did not seek input from all 

site visit team members while drafting and clearing the final country 

assessments and subsequent report to Congress. For example, DHS’s 

forensic document analysts, who participated in the site visits in 2004, told

us that they did not see, clear, or comment on the draft country 

assessments, despite repeated attempts to obtain copies of them. Thus, 

these analysts questioned the integrity of the process because they had not 

seen how their analyses were incorporated into the final assessments. 

Additionally, State’s headquarters officers who cover diplomatic relations 

Review Process Did Not 

Involve Key Stakeholders 

Page 18 GAO-06-854 Visa Waiver Program
in Visa Waiver Program countries, as well as embassy officials in all of the 

posts we visited, stated that they were not asked to review or provide 

comments on the draft assessments, nor had they seen the final 

assessments. CBP officials also stated that they repeatedly requested 

copies of the country assessments and subsequent report to Congress, but 

did not receive them. According to State’s Bureau of Consular Affairs, DHS 

did not seek feedback from U.S. embassies and State’s regional bureaus on

the draft site visit or individual country assessments. Because these 

assessments contained classified information, OIE officials told us that 

they were not broadly distributed in draft or final form. Nevertheless, 

without this information, key stakeholders could not be effective 

advocates for U.S. concerns. 

We found that DHS did not have clear criteria when assessing each 

country’s participation in the program to determine at what point security 

concerns would trigger discussions with foreign governments about these 

concerns and an attempt to resolve them. As previously mentioned, the 

DHS-led interagency working group identified five countries from its 2004 

assessment with significant security concerns, and DHS, in coordination 

with State, discussed these concerns with government officials. 

Furthermore, U.S. embassies issued a formal diplomatic demarche to the 

five governments regarding the concerns in March 2005.28 However, while 

the working group also had concerns with a sixth country, it decided not 

to issue a demarche to this government. According to State, the working 

group determined that the concerns identified in this country were not 

directly related to the Visa Waiver Program and the country’s participation 

in the program. However, OIE officials and other working group members 

stated that they did not use any standard criteria in making this 

determination. State officials agreed that qualitative and/or quantitative

criteria would be useful when making these determinations, although DHS 

stated that the criteria should be flexible. During our visit to the U.S. 

embassy in the sixth country, which was not issued a demarche, U.S. 

officials told us they were unaware that the working group had discussed 

security concerns in the context of the country assessment. While 

embassy officials had already been addressing these issues as part of their

mission, they said that they would have likely seen greater progress made 

Review Process Lacked Clear 

Criteria to Make Key 

Judgments 

 28In coordination with DHS, U.S. embassy officials communicated these concerns through 

an official demarche to each government. A demarche presents a formal U.S. government 

position or request to a foreign government. Demarches are generally presented in writing, 

but can also be transmitted orally. According to diplomatic protocol, a demarche requires 

an official, formal response from the other government.

Page 19 GAO-06-854 Visa Waiver Program
in discussions with foreign government officials if all parties had known 

that there was a potential link between these security concerns and visa 

waiver requirements. 

The site visits associated with each country review were not always wellprepared and lacked a consistent approach, according to the site visit 

team members. Several team members representing different agencies 

stated that they did not receive adequate information and guidance prior 

to conducting the site visits and, thus, were not well-prepared to conduct 

the visits. DHS did not brief or train the site visit team members prior to 

conducting the 2004 reviews, and many said that the goals of the incountry visits were not clear. One team member stated that the site visits 

were largely “fact-finding trips,” as opposed to a targeted analysis of law 

enforcement and security concerns. Moreover, prior to conducting the site 

visits, DHS sent each country a background questionnaire; however, OIE 

and team members stated that some countries did not provide responses 

to the questionnaire prior to the site visit, which would have been useful 

for preparation. Furthermore, senior U.S. officials in each of the embassies 

we visited stated that the goals and priorities of the 2004 DHS-led site visit

teams were not clear to them. Consular officials at half of the posts we 

visited also said that the site visit teams arrived on short notice and did not 

give them adequate time to prepare. As a result, the teams may not have 

made the most efficient use of their time in-country, and may not have 

gathered their information on a consistent basis. 

DHS did not issue, in a timely manner, the summary report to Congress 

that generally described the overall findings from the 25 country 

assessments. Although DHS is mandated to conduct the country 

assessments every 2 years, Congress did not establish a deadline by which

the assessments must be completed or the summary report issued. OIE, 

State, and Justice officials acknowledged that the assessments took too 

long to complete. The interagency teams conducted site visits as part of 

the country assessments from May through September 2004, and 

transmitted the final summary report to Congress more than 1 year later, 

in November 2005. The report to Congress was a six-page summary that 

did not include detailed descriptions of the law enforcement and security 

risks identified during the review process, which were discussed at length

in the individual country assessments. According to interagency working 

group members, DHS did not establish internal milestones or deadlines for 

completing the final country assessments. OIE officials attributed the 

lengthiness of the assessment process to the multiple rounds of clearances 

for each of the 25 assessments and the summary report. 

Inconsistent Preparation for 

Site Visits 

Reporting Untimely

Page 20 GAO-06-854 Visa Waiver Program
While the country assessments were awaiting clearance, there were 

missed opportunities to capture more recent developments, and the final 

assessments contained dated information or were incomplete. For 

example, in May 2005, a post in one visa waiver country was notified there 

had been a large-scale, high-profile theft of blank passports. While the U.S. 

government was aware of this theft, this information was not captured in 

that country’s assessment as it was being cleared. Moreover, the teams 

collecting information about the visa waiver countries’ risks in 2004 used, 

in some cases, information from 2 years prior; by the time the summary 

report was issued in November 2005, some of the data was over 3 years 

old. As a result of this lengthy process, the final report presented to 

Congress did not necessarily reflect the current law enforcement and 

security risks posed by each country, or the positive steps that countries 

had made to address these risks (see fig. 4). 

Page 21 GAO-06-854 Visa Waiver Program
Figure 4: Timeline of 2004-2005 Country Assessment Process and Other Key Milestones 

2004 2005

Source: GAO.

J JJ FMA A N M S O J JJ D FMA A N M S O D

March 2005 – 

Demarches issued to five 

countries of concern

March 2004 – 

Interagency working 

group began gathering 

information for 2004 

assessments

August/September 2005 –

DHS-led teams conducted 

two remaining country site 

July 2004 – visits

Visa Waiver Program 

Oversight Unit established 

within OIE

November 2005 – 

Summary report of 

2004 reviews

issued to Congress

May-September 2004 – 

DHS-led teams conducted 

25 of 27 country site visits

December 2004 –

OIG reported on vulnerabilities

of stolen passports from visa

waiver countries

OIE officials acknowledged weaknesses in the 2004 reviews, and made 

some adjustments for the 2005 country assessments for Italy and Portugal, 

the two remaining countries. For the 2005 reviews, DHS conducted a 1-day 

training seminar to explain the objectives of the visit and share 

information about the countries to the site visit teams, including findings 

from prior country assessments. Additionally, the team members met prior 

to conducting the site visits, and reconvened upon returning to

Washington, D.C., to ensure consensus on their report on the site visit. 

However, the 2005 country review process still lacked consistency and 

transparency. In particular, DHS has not finalized its operating procedures 

for site visits. The site visit teams traveled to the remaining two countries 

in August and September 2005; however, as of June 2006, DHS had neither 

updated the interagency working group team members on the status of the 

reviews of Italy and Portugal, nor provided them with a timeline for 

Despite Adjustments to 

Process, Weaknesses Remain 

Page 22 GAO-06-854 Visa Waiver Program
proceeding with the review. Furthermore, stakeholders continued to 

express concern about DHS’s lack of communication about the process 

and the findings, and no changes have been made to the review process 

that would make the final report to Congress timely. Therefore, there are 

no assurances that the next biennial assessment round will proceed more 

quickly than the previous round. 

DHS Cannot Effectively 

Monitor Ongoing Concerns

in Visa Waiver Countries 

DHS cannot effectively monitor the law enforcement and security risks 

posed by visa waiver countries on a consistent, ongoing basis because it

has not provided OIE with adequate staffing and resources. Furthermore, 

we found weaknesses in communication between DHS and overseas posts 

and other agencies. 

OIE is limited in its ability to achieve its mission because of insufficient 

staffing and funding. The office has numerous responsibilities, including 

Lack of Staffing and Funding 

Impedes Ability to Assess Risks 

• conducting the mandated biennial country reviews; 

• monitoring law enforcement, security, and immigration concerns in visa 

waiver countries on an ongoing basis; 

• working with countries seeking to become members of the Visa Waiver 

Program;29 and 

• briefing foreign government representatives from participating visa waiver 

countries, as well as those countries that are seeking admission into the 

program, on issues related to program membership. 

In 2004, the DHS OIG found that OIE’s lack of resources directly undercut 

its ability to assess a security problem inherent in the program—lost and 

stolen passports. The office received funding to conduct the country 

reviews in 2004 and 2005; however, OIE officials indicated that a lack of 

funding and full-time staff has made it extremely difficult to conduct 

additional overseas fieldwork, as well as track ongoing issues of concern 

in the 27 visa waiver countries—a key limitation in DHS’s ability to assess 

and mitigate the program’s risks. According to OIE officials, the unit 

developed a strategic plan to monitor the program, but has been unable to

 29See GAO, Process for Admitting Additional Countries into the Visa Waiver Program, 

GAO-06-835R (Washington, D.C.: July 28, 2006). 

Page 23 GAO-06-854 Visa Waiver Program
implement its plan with its current staffing. As of June 2006, the office was 

staffed with two full-time employees, as well as one temporary employee 

from another DHS component. Moreover, OIE does not have a separate 

budget, but must request funds (for example, to conduct travel related to

the Visa Waiver Program) from the Office of Policy Development. In 

addition, program officials stated that they have paid for their own office 

supplies using their personal savings due to funding constraints. Without 

adequate resources, OIE is unable to monitor and assess participating 

countries’ compliance with the Visa Waiver Program’s statutory 

requirements. 

DHS has not clearly communicated its mission to stakeholders at overseas

posts, nor identified points of contact within U.S. embassies, so it can 

communicate directly with field officials positioned to monitor countries’ 

compliance with Visa Waiver Program requirements and report on current 

events and issues of potential concern. In particular, within DHS’s various 

components, we found that OIE is largely an unknown entity and, 

therefore, is unable to leverage the expertise of DHS officials overseas. 

Specifically, only 3 of the 15 DHS field officials with whom we spoke in the 

six visa waiver countries we visited were aware of the Visa Waiver 

Program Oversight Unit and its mission. A senior DHS representative at 

one post showed us that her organizational directory did not contain 

contact information for OIE. In addition, an official from the Immigration 

and Customs Enforcement’s Office of International Affairs acknowledged

that DHS needs a better communication plan for the Visa Waiver Program. 

He stated that DHS had not prioritized the workload for all its officials 

overseas, including their role in overseeing the Visa Waiver Program; he 

also told us that OIE had not yet articulated what information it needed, 

designated a mechanism to share that information, or gained agency-wide 

acceptance of procedures for monitoring the compliance of visa waiver 

countries. In fact, a senior DHS official in Washington, D.C., told us that he

may find out about developments—either routine or emergent—in visa 

waiver countries by “happenstance.” Without an outreach strategy, DHS is 

not able to leverage its existing resources at U.S. embassies in all visa 

waiver countries. 

Furthermore, key stakeholders, who are in a position to influence and 

monitor visa waiver countries’ compliance with the program’s 

requirements, were not informed of the major findings of the country 

assessments. In fact, at the time of our visits, ambassadors or deputy 

chiefs of mission in each of the six posts told us that they were not fully 

aware of the extent to which the country assessments discussed law 

enforcement and security concerns posed by the continued participation 

Gaps in DHS’s Communications 

with its Overseas Posts and 

Other Agencies 

Page 24 GAO-06-854 Visa Waiver Program
of the country in the program. The Deputy Chief of Mission at one post 

stated that without the appropriate information, such as was contained in

the assessments, embassy officials could not be effective agents for the 

U.S. government with regard to these issues. Bureau of Consular Affairs 

officials in Washington, D.C., agreed that any concerns identified in the

assessments should be brought to the attention of the embassy, so that the 

posts can address the concerns accordingly. Due to the lack of outreach 

and clear communication about its mission, OIE is limited in its ability to

monitor the day-to-day law enforcement and security concerns posed by 

the Visa Waiver Program, and the U.S. government is limited in its ability 

to influence visa waiver countries’ progress in meeting requirements. 

We also found gaps in interagency communication. According to OIE, 

State plays a significant role in conveying information relevant to the Visa 

Waiver Program to U.S. embassy officials and their host government 

counterparts. Therefore, it is important that State and DHS have clear lines 

of communication. For example, in October 2005, one government 

expressed willingness to share data on lost and stolen issued passports 

with the United States, and asked for technical specifications on how to do 

so. However, at the time of our February 2006 visit, the post in that 

country had not received direction from headquarters on how this 

passport information should be shared. Moreover, OIE officials told us 

that they were unaware that this country was willing to share this data 

until we brought it to their attention in early March 2006. As a result, the 

United States missed opportunities to potentially deter the fraudulent use 

of passports from this country, which in fact has the highest rate of misuse 

among all visa waiver countries, according to DHS. Additionally, a senior 

consular official in another participating country expressed frustration 

that DHS had not fully explained to embassy officials why visa waiver 

countries needed to report lost and stolen passport information directly to

the United States and Interpol, which maintains a global database of lost 

and stolen travel documents. Several other senior consular officials also 

expressed the need for more information about OIE’s mission and goals, 

as well as the desired role for overseas posts. 

DHS has taken some actions to mitigate the risks of the Visa Waiver 

Program, such as terminating the use of the German temporary passport 

for travel under the program. Since 2002, the law has required the timely 

reporting of passport thefts for continued participating in the Visa Waiver

Program, but DHS has not established and communicated time frames and 

operating procedures to participating countries. In addition, DHS has 

sought to expand this requirement to include the reporting of data, to the 

DHS Faces 

Difficulties in 

Mitigating Program 

Risks 

Page 25 GAO-06-854 Visa Waiver Program
United States and Interpol, on lost and stolen issued passports; however, 

participating countries are resisting these requirements, and DHS has not 

yet issued guidance on what information must be shared, with whom, and 

within what time frame. Furthermore, U.S. border inspectors are unable to 

automatically access Interpol’s data on reported lost and stolen passports, 

which makes it more difficult to detect reported lost or stolen passports at 

U.S. ports of entry. 

As previously mentioned, during the 2004 assessment process, the working 

group identified security concerns in several participating countries, and 

DHS took actions to mitigate some of these risks. For example, DHS 

determined that several thousand blank German temporary passports30 had 

been lost or stolen, and that Germany had not reported some of this 

information to the United States. In March 2005, at the working group’s 

request, the U.S. embassy in Berlin conveyed these concerns to the 

German government to seek a solution. In March 2006, DHS determined 

that sufficient progress had not been made to address the concern over 

German temporary passports, and, as of May 1, 2006, German temporary 

passport holders are not allowed to travel to the United States under the 

Visa Waiver Program without a visa. 

DHS has also made some progress in enforcing new passport security 

measures. For example, DHS has enforced an October 26, 2005, deadline 

requiring travelers under the Visa Waiver Program to have digital 

photographs in their passports. Specifically, Italian and French citizens 

with noncompliant passports issued after October 26, 2005, must first 

obtain a visa before traveling to the United States because these countries 

did not meet the deadline. Furthermore, as previously mentioned, by 

October 26, 2006, visa waiver travelers must have e-passports for travel 

under the program. E-passports aim to enhance the security of travel 

documents, making it more difficult for imposters or inadmissible aliens to

misuse the passport to gain entry into the United States. DHS and State

officials told us that nearly all 27 participating countries report that they 

are on schedule to meet this deadline.31 According to US-VISIT, DHS will 

DHS Has Taken Some 

Actions to Mitigate Risks 

of the Visa Waiver Program 

 30German temporary passports are valid for one year, and are less expensive than standard

German passports. In addition, they are issued at more than 6,000 locations across 

Germany, whereas the Ministry of Interior issues the standard passports centrally. 

31According to a US-VISIT official, as of June 2006, it had verified e-passports from 12 of 27 

visa waiver countries. 

Page 26 GAO-06-854 Visa Waiver Program
deploy machines to read the e-passports at 33 airports by the October 2006 

deadline, covering about 98 percent of all visa waiver travelers. While USVISIT intends to deploy e-passport readers to all ports of entry in the 

future, it has not articulated clear timeframes to do so.32 Therefore, until 

this is achieved, it will not be possible for DHS to read the information on 

the chips embedded in the passports for the remaining ports of entry. 

A key risk in the Visa Waiver Program is stolen blank passports from visa 

waiver countries, because detecting these passports at U.S. ports of entry 

is extremely difficult, according to DHS. Some thefts of blank passports 

have not been reported to the United States until years after the fact, 

according to DHS intelligence reports. For example, in 2004, a visa waiver 

country reported the theft of nearly 300 stolen blank passports to the 

United States—more than 9 years after the theft occurred. In addition, in 

2004, a visa waiver country reported the theft of 270 blank passports more 

than 8 months after the theft occurred. The 2002 Enhanced Security and

Visa Entry Reform Act provides that the Secretary of Homeland Security 

must terminate a country from the Visa Waiver Program if he and the 

Secretary of State jointly determine that the country is not reporting the 

theft of its blank passports to the United States on a timely basis. DHS and 

State have chosen not to terminate from the program countries that have 

failed to report these incidents. 

DHS officials told us that the inherent political, economic, and diplomatic 

implications associated with removing a country from the Visa Waiver 

Program make it difficult to enforce the statutory requirement in the 

broadest terms. Moreover, DHS has not established time frames or 

operating procedures to enforce this requirement. In April 2004, the DHS 

OIG recommended that the then-Under Secretary for Border and 

Transportation Security, in coordination with State, develop standard 

operating procedures for the routine and proactive collection of stolen 

DHS Lacks Standard 

Procedures for Obtaining 

Stolen Blank Passport 

Data 

 32In May 2006, a US-VISIT official stated that DHS had not yet decided from which company 

the department would procure the e-passport readers. DHS still needs to decide how it will 

use the digital image from the e-passport, including whether the image will be displayed on 

the US-VISIT screen during inspection, and if so, whether it will be displayed in place of or 

in addition to the photo already stored in US-VISIT. Furthermore, countries have the option 

to store other biometric information, such as fingerprints or iris images, on the chip, and 

DHS will need to make decisions about whether it will use such information, if available,

during inspections. According to US-VISIT, it will deploy e-passport readers to the 

remaining ports of entry at a future date to take advantage of anticipated improved reader

technology, while minimizing procurement and training costs.

Page 27 GAO-06-854 Visa Waiver Program
passport information from host governments for dissemination to U.S. 

agencies. While the statute requires visa waiver countries to certify that 

they report information on the theft of their blank passports to the United 

States on a timely basis, as of June 2006, DHS has not defined what 

constitutes “timely.” Moreover, the United States lacks a centralized 

mechanism for foreign governments to report all stolen passports. In 

particular, DHS has not defined to whom in the U.S. government 

participating countries should report this information. 

In addition to blank passports, lost or stolen issued passports also pose a 

risk because they can be altered. In June 2005, DHS issued guidance to

participating Visa Waiver Program countries requiring that they certify 

their intent to report lost and stolen passport data on issued passports by 

August 2005. However, DHS has not yet issued guidance on what 

information must be shared, with whom, and within what time frame. 

Some visa waiver countries have not yet agreed to provide this

information to the United States, due in part to concerns over the privacy 

of their citizens’ biographical information. In addition, several consular 

officials expressed confusion about the current and impending 

requirements about sharing this data, and felt they were unable to 

adequately explain the requirements to their foreign counterparts. 

In June 2005, the U.S. government also announced its intention to require 

visa waiver countries to certify their intent to report information on both 

lost and stolen blank and issued passports to Interpol. In 2002, Interpol 

developed a database of lost and stolen travel documents to which its 

member countries may contribute on a voluntary basis. The United States 

has endorsed Interpol’s database, and, since May 2004, State has been 

contributing U.S. data from lost and stolen blank passports to it. In 2005, 

State reported to Congress that it also instructed all U.S. embassies and 

consulates to take every opportunity to persuade host governments to 

share this data with Interpol. While most visa waiver countries use and 

contribute to Interpol’s database, four do not. Moreover, some countries 

that do contribute do not do so on a regular basis, according to Interpol 

officials. Interpol stated that it continues to encourage countries to send 

this information more systematically. In addition, participating countries 

have expressed concerns about reporting this information, citing privacy 

issues; however, Interpol’s database on lost and stolen travel documents 

does not include the passport bearers’ biographical information, such as 

Some Participating Visa 

Waiver Program Countries 

Are Resisting Additional 

Reporting to United States 

and Interpol 

Page 28 GAO-06-854 Visa Waiver Program
name and date of birth.33 According to the Secretary General of Interpol, in 

light of the high value associated with passports from visa waiver 

countries, it is a priority for his agency to encourage these countries to 

contribute to the database. 

Though information from Interpol’s database could potentially stop 

inadmissible travelers from entering the United States, CBP’s border 

inspectors do not have automatic access to the database at primary 

inspection at U.S. ports of entry—the first line of defense against those 

who might exploit the Visa Waiver Program to enter the United States. The 

inspection process at U.S. ports of entry can include two stages—a 

primary and secondary inspection. If, during the primary inspection, the 

inspector suspects that the traveler is inadmissible either because of a 

fraudulent passport or other reason, the inspector refers the traveler to 

secondary inspection. At secondary inspection, border inspectors can 

contact officials at the National Targeting Center, who can query Interpol’s

stolen-travel-document database to determine if the traveler is attempting 

to enter the United States with a passport that had been previously 

reported lost or stolen, but is not yet on CBP’s watch list (see fig. 5).34

However, Interpol’s data on lost and stolen travel documents is not 

automatically accessible to border inspectors at primary inspection—one

reason why it is not currently an effective border screening tool, according 

to DHS, State, and Justice officials. According to the Secretary General of 

Interpol, until DHS can automatically query Interpol’s data, the United 

States will not have an effective screening tool for checking passports. 

Inefficient Access to 

Interpol’s Database on Lost 

and Stolen Passports 

 33Interpol’s database includes the passport’s identity number, the country of issuance, and 

the country where the loss or theft occurred. According to officials from Justice’s InterpolU.S. National Central Bureau, it is particularly important that countries report this

information, as well as the date of the theft and the issuance date. 

34Interpol’s data on lost and stolen passports are not available when border inspectors 

screen travelers against US-VISIT or the Treasury Enforcement Communications System 

(TECS), unless Interpol has shared this information with the United States in separate

reports and it has been manually entered into TECS by DHS. TECS maintains watch list 

data, interfaces with other agencies’ databases, and is used by inspectors at ports of entry 

to verify traveler information and update traveler data. TECS’s watch list data sources 

include DHS’ CBP and Immigration and Customs Enforcement; the Federal Bureau of

Investigation (FBI); State; and the Drug Enforcement Agency, among others. 

Page 29 GAO-06-854 Visa Waiver Program
Figure 5: CBP’s Access to Interpol’s Lost and Stolen Travel Document Database 

Sources: GAO (data and photos); Nova Development (clip art).

Primary inspection Secondary inspection

Inspectors do not have access to Interpol’s database Inspectors can request a query of Interpol’s database

Primary inspection Secondary inspection 

Inspectors have automatic access to Interpol database Interpol database utilized at primary inspection

Interpol 

database

Current process Interpol available at secondary inspection

Proposed process Interpol automatically accessed at primary inspection

Page 30 GAO-06-854 Visa Waiver Program
According to Interpol officials, the United States is working actively with 

Interpol on a potential pilot project that would allow for an automatic 

query of aliens’ passport data against Interpol’s database at primary 

inspection at U.S. ports of entry. However, DHS has not yet finalized a plan 

to do so. In December 2005, Interpol began a similar program at all border 

stations in Switzerland. Through this program, Swiss border agents query

Interpol’s database as soon as travelers appear at a border station. 

According to the Secretary General of Interpol, in a 2-month period, 

Switzerland encountered 282 potential instances of travelers attempting to 

enter the country with a previously reported lost or stolen passport. In 

addition, during this time frame, Swiss border agents queried Interpol’s 

database more than all other member countries combined because it was 

the only country accessing the database automatically. 

In commenting on a draft of this report, Justice’s Interpol-U.S. National 

Central Bureau stated that from April through June 2006, Justice, CBP’s 

National Targeting Center, and Interpol compared records from certain 

passengers arriving in the United States against Interpol’s lost and stolen 

travel document database. According to the National Central Bureau, the 

test’s objectives were to simulate an automatic query of passenger records 

against Interpol’s database and analyze discrepancies between that 

database and U.S. watch lists. The National Central Bureau stated that, by

early August 2006, it and the National Targeting Center will finalize a 

report on this test to help facilitate a pilot program for real-time, 

systematic queries of passenger records against Interpol’s data at U.S. 

ports of entry. 

The Visa Waiver Program aims to facilitate international travel for millions 

of people each year and promote the effective use of government 

resources. Effective oversight of the program entails balancing these 

benefits against the program’s potential risks. To find this balance, the U.S. 

government needs to fully identify the vulnerabilities posed by visa waiver

travelers, and be in a position to mitigate them. However, we found 

weaknesses in the process by which the U.S. government assesses these 

risks, and DHS’s Visa Waiver Program Oversight Unit is not able to manage 

the program with its current resource levels. Moreover, DHS has not 

communicated clear reporting requirements for lost and stolen 

passports—a key risk—nor can it automatically access all stolen passport 

information when it is most needed—namely, at the primary inspection 

point at U.S. points of entry. It is imperative that DHS commit to 

strengthen its ability to promptly identify and mitigate risks to ensure that 

the Visa Waiver Program does not jeopardize U.S. security interests. 

Conclusions 

Page 31 GAO-06-854 Visa Waiver Program
To improve the U.S. government’s process for assessing risks in the Visa 

Waiver Program, we recommend that the Secretary of Homeland Security, 

in coordination with State and other appropriate agencies, take the 

following five actions: 

Recommendations 

• Provide additional resources to strengthen OIE’s visa waiver monitoring 

unit. 

• Finalize clear, consistent, and transparent protocols for the biennial 

country assessments and provide these protocols to stakeholders at 

relevant agencies at headquarters and overseas. These protocols should 

provide timelines for the entire assessment process, including the role of a 

site visit, an explanation of the clearance process, and deadlines for 

completion. 

• Create real-time monitoring arrangements, including the identification of 

visa-waiver points of contact at U.S. embassies, for all 27 participating 

countries; and establish protocols, in coordination with appropriate 

headquarters offices, for direct communication between points of contact 

at overseas posts and OIE’s Visa Waiver Program Oversight Unit. 

• Require periodic updates from points of contact at posts in countries 

where there are law enforcement or security concerns relevant to the Visa 

Waiver Program. 

• Provide complete copies of the most recent country assessments to 

relevant stakeholders in headquarters and overseas posts. 

To improve the U.S. government’s process for mitigating the risks in the 

Visa Waiver Program, we recommend that the Secretary of Homeland 

Security, in coordination with State and other appropriate agencies, take

the following three actions: 

• Require that all visa waiver countries provide the United States and 

Interpol with non-biographical data from lost or stolen issued passports, 

as well as from blank passports. 

• Develop and communicate clear standard operating procedures for the 

reporting of lost and stolen blank and issued passport data, including a 

definition of timely reporting and to whom in the U.S. government 

countries should report. 

Page 32 GAO-06-854 Visa Waiver Program
• Develop and implement a plan to make Interpol’s stolen travel document 

database automatically available during primary inspection at U.S. ports of 

entry. 

The May 2002 Enhanced Border Security and Visa Entry Reform Act 

mandated DHS to conduct country assessments of the effect on U.S. law 

enforcement and security interests of each country’s continued 

participation in the Visa Waiver Program at least every 2 years. Given the

lengthy time it took for DHS to issue the November 2005 summary report 

to Congress, and to ensure future reports contain timely information when 

issued, Congress should consider establishing a biennial deadline by 

which DHS must complete the country assessments and report to 

Congress. 

DHS, State, and Interpol provided written comments on a draft of this 

report (see apps. IV, V, and VI). DHS, State, Interpol, and Justice’s InterpolU.S. National Central Bureau provided technical comments, which we 

incorporated into the report, as appropriate. 

DHS either agreed with, or stated that it is considering, all of our 

recommendations. Regarding our matter for congressional consideration, 

DHS did not appear to support the establishment of a deadline for the 

biennial report to Congress. Instead, DHS suggested that Congress should 

require continuous and ongoing evaluation. With continuous review, DHS 

stated that it would be able to constantly evaluate U.S. interests and report 

to Congress on the current 2-year reporting cycle on targeted issues of 

concern, rather than providing a historical evaluation. We agree that 

continuous and ongoing evaluation is necessary, and that is why we 

recommended that DHS create real-time monitoring arrangements and 

provide additional resources to the Visa Waiver Program Oversight Unit to 

achieve this goal. Regarding the mandated biennial country assessments, 

we believe that they can serve a useful purpose if they are completed in a

timely fashion. In addition, DHS provided information on actions that it

has taken to improve the management of the biennial country assessment 

process. 

State agreed that efforts by U.S. embassies and consulates to monitor and 

assess the Visa Waiver Program would benefit from enhanced 

communication to and from DHS, and endorsed our recommendation that 

DHS provide more information to these stakeholders on Visa Waiver 

Program issues. In addition, State acknowledged the risk of misuse of 

Matter for 

Congressional 

Consideration 

Agency Comments 

and Our Evaluation 

Page 33 GAO-06-854 Visa Waiver Program
previously lost or stolen passports, particularly by persons who are not 

eligible for a visa. With regard to timely reporting on lost and stolen 

passports, State welcomed our recommendation calling for clear 

guidelines and reporting mechanisms to achieve this goal. 

Interpol provided information about its lost and stolen travel document 

database and tools that it has developed to allow law enforcement officers 

to instantly check this database at airports and other border entry points. 

In addition, Interpol noted that many developing countries lack the 

resources necessary to implement these tools. Therefore, Interpol urged 

the United States and other countries to provide funding to facilitate 

access for all countries to its lost and stolen travel document database. It 

also provided its views on the risks associated with lost and stolen 

passports. 

As agreed with your office, unless you publicly announce the contents of

this report earlier, we plan no further distribution until 30 days from the 

report date. At that time, we will provide copies of this report to the 

Secretaries of State and Homeland Security, as well as the Attorney 

General and the Secretary General of Interpol. We will also make copies 

available to others upon request. 

Page 34 GAO-06-854 Visa Waiver Program
In addition, this report will be available at no charge on the GAO Web site 

at http://www.gao.gov. If you or your staff have any questions about this 

report, please contact me at (202) 512-4128 or fordj@gao.gov. Contact 

points for our Offices of Congressional Relations and Public Affairs may 

be found on the last page of this report. GAO staff who made major 

contributions to this report are listed in appendix VII. 

Sincerely yours, 

Jess T. Ford

Director, International Affairs and Trade 

Page 35 GAO-06-854 Visa Waiver Program
Appendix I: Scope and Methodology Appendix I: Scope and Methodology 

To describe the benefits of the Visa Waiver Program, we reviewed relevant 

documentation, including Office of Inspector General (OIG) reports and 

our 2002 report on the implications of eliminating the program.1

 We also 

interviewed political, economic, consular, commercial, and law 

enforcement officials at U.S. embassies overseas to discuss the advantages

of the program for U.S. business and tourism. To describe the risks in the 

Visa Waiver Program, we examined documentation on the screening 

process at U.S. ports of entry for travelers from Visa Waiver Program 

countries. In addition, we analyzed data from Customs and Border 

Protection (CBP) on interceptions of fraudulent, lost, or stolen passports 

from participating countries. We also observed fraudulent document 

detection training of CBP agents at the Federal Law Enforcement Training 

Center and spoke with training officials regarding the difficulty in 

detecting fraudulent passports. We also interviewed officials from the 

Department of Homeland Security’s (DHS) National Targeting Center, 

Intelligence and Analysis Directorate, and Forensic Document Laboratory 

on the risks posed by Visa Waiver Program travelers. 

In particular, we analyzed data on the number of nonimmigrants that 

entered the United States under the Visa Waiver Program from fiscal years 

2002 though 2004. While we did not fully assess the reliability of these 

statistics because we used them for background purposes, we conducted

interviews and obtained other corroborating evidence that confirmed the 

importance of the Visa Waiver Program in terms of the broad numbers of 

admissions to the United States in recent years. 

Regarding DHS’s data on fraudulent passports, DHS reported that these 

data are limited to those cases in which the fraudulent document from the 

Visa Waiver Program country was intercepted at a port of entry, and do 

not include instances when fraudulent passports were used to enter the 

United States but were not detected. While we could not fully assess the 

reliability of the data, we found them sufficiently reliable to establish that 

hundreds of fraudulent documents from a broad range of Visa Waiver 

Program countries were intercepted in 2005. In addition, the number of 

documents that DHS reports by country is not necessarily indicative of the 

extent of the problem in that country, as these data only cover instances 

when fraudulent documents were intercepted. 

 1

See GAO, Border Security: Implications of Eliminating the Visa Waiver Program, 

GAO-03-38 (Washington, D.C., Nov. 22, 2002).

Page 36 GAO-06-854 Visa Waiver Program
Appendix I: Scope and Methodology 

To evaluate the U.S. government’s efforts to assess and mitigate these 

risks, we analyzed the laws governing the program, relevant agency

operating procedures, and DHS OIG reports. We also examined 15 of the 

25 completed reports assessing the participation of Visa Waiver Program 

countries.2

 As of June 2006, the remaining 10 assessments were pending

classification review by DHS’s Office of International Enforcement. These 

assessments contained, among other things, detailed analyses of an 

individual country’s 

• political, social, and economic conditions; 

• security over its passport and national identity documents; 

• border controls; 

• immigration and nationality laws, law enforcement policies and practices, 

and other matters relevant to law enforcement, immigration, and national

security; 

• patterns of passport fraud, visa fraud, and visa abuse; 

• assessments of terrorism, by the country’s nationals, within or outside the 

country, and;

• evaluations of the impact of the country’s participation in the Visa Waiver 

Program on U.S. national security and law enforcement. 

To discuss these assessments and actions taken in response to their 

findings, we met with officials from several DHS component agencies and 

offices, the Department of State’s Bureau of Consular Affairs and its 

Europe and Eurasia Bureau, and the International Criminal Police 

Organization (Interpol) in Lyon, France. In addition, we met with officials 

from the Department of Justice’s U.S. National Central Bureau in 

Washington, D.C., which facilitates international law enforcement 

cooperation among the United States and Interpol and its other member 

countries. We also spoke with U.S. Embassy officials in six Visa Waiver 

Program countries, as well as foreign government officials in three of 

these countries. During these visits, we observed visa operations and 

interviewed embassy management, consular staff, and representatives 

 2

As of June 2006, the reviews of the remaining two participating countries—Italy and 

Portugal—were in process. 

Page 37 GAO-06-854 Visa Waiver Program
Appendix I: Scope and Methodology 

from law enforcement agencies regarding their roles and responsibilities 

in overseeing the Visa Waiver Program. 

We conducted our evaluation from September 2005 through June 2006 in 

accordance with generally accepted government auditing standards. 

Page 38 GAO-06-854 Visa Waiver Program
Appendix II: M

C

ap of Visa Waiver Program 

ountries 

Page 39 GAO-06-854

Appendix II: Map of Visa Waiver Program 

Countries 

Finland Singapore

Austria

Italy

Spain

Sweden

Norway

Germany

France

Portugal

Denmark

The

Netherlands

Belgium Ireland

Luxembourg

Switzerland

Monaco

Liechtenstein

Iceland

Brunei

Japan

Australia

New Zealand

United

Kingdom

Slovenia

Andorra

San Marino

Sources: GAO; MapArt (image).

Visa Waiver Program
Appendix III: Foreign Nationals Admitted 

under the Visa Waiver Program, Fiscal Years Appendix III: Foreign Nationals Admitted 2002 through 2004

under the Visa Waiver Program, Fiscal Years 

2002 through 2004 

 Fiscal year 

Country of citizenship 2002 2003 2004

Andorra 386 478 654

Australia 445,242 484,086 577,161

Austria 107,636 115,164 136,050

Belgium 166,286 155,693 185,836

Brunei 303 323 404

Denmark 124,819 141,880 165,190

Finland 71,338 73,585 89,190

France 932,847 920,774 1,121,824

Germany 1,208,121 1,254,490 1,446,806

Iceland 17,733 19,810 26,727

Ireland 297,496 328,769 392,938

Italy 515,126 576,346 693,628

Japan 3,347,900 3,303,878 4,044,284

Liechtenstein 996 995 1,182

Luxembourg 6,001 6,447 7,287

Monaco 377 432 614

Netherlands 486,672 498,528 560,403

New Zealand 187,235 180,572 202,904

Norway 110,713 119,846 140,015

Portugal 57,245 64,330 82,089

San Marino 279 300 375

Singapore 49,713 54,539 71,579

Slovenia 6,951 9,703 11,643

Spain 350,044 375,021 487,715

Sweden 198,532 220,577 273,007

Switzerland 228,298 221,757 244,921

United Kingdom 3,938,842 4,189,906 4,639,055

Total 12,857,131 13,318,229 15,603,400

Source: CBP. 

Page 40 GAO-06-854 Visa Waiver Program
Appendix IV: Comments from the Department Appendix IV of Homeland Security : Comments from the 

Department of Homeland Security 

Note: GAO comments 

supplementing those in 

the report text appear at 

the end of this appendix. 

See comment 1. 

Page 41 GAO-06-854 Visa Waiver Program
Appendix IV: Comments from the Department 

of Homeland Security

See comment 2. 

Page 42 GAO-06-854 Visa Waiver Program
Appendix IV: Comments from the Department 

of Homeland Security

See comment 6. 

Page 43 GAO-06-854 Visa Waiver Program
Appendix IV: Comments from the Department 

of Homeland Security

See comment 3. 

See comment 4. 

Page 44 GAO-06-854 Visa Waiver Program
Appendix IV: Comments from the Department 

of Homeland Security

See comment 6. 

Page 45 GAO-06-854 Visa Waiver Program
Appendix IV: Comments from the Department 

of Homeland Security

See comment 5. 

Page 46 GAO-06-854 Visa Waiver Program
Appendix IV: Comments from the Department 

of Homeland Security

See comment 6. 

Page 47 GAO-06-854 Visa Waiver Program
Appendix IV: Comments from the Department 

of Homeland Security

See comment 7. 

Page 48 GAO-06-854 Visa Waiver Program
Appendix IV: Comments from the Department 

of Homeland Security

Page 49 GAO-06-854 Visa Waiver Program
Appendix IV: Comments from the Department 

of Homeland Security

Page 50 GAO-06-854 Visa Waiver Program
Appendix IV: Comments from the Department 

of Homeland Security

1. We understand that DHS’s organizational structure changed during the 

2004 review process. To avoid confusion regarding the DHS units that 

had some involvement in this process, we have replaced references to 

the Office of International Enforcement (OIE) with DHS, as 

appropriate. 

GAO Comments 

2. Our review focused on the 2004 biennial review process for 25 of the

27 Visa Waiver Program countries. We agree that DHS has taken some 

steps to improve the 2005 process for Italy and Portugal, whose 

reviews are still in process, and we discuss these improvements in our 

report. However, we disagree that DHS has corrected most of the 

problems associated with the 2004 review process. As we note in our 

report, as of June 2006, DHS had neither updated the interagency 

working group team members on the status of the reviews of Italy and

Portugal, nor provided them with a timeline for proceeding with the 

review. Furthermore, stakeholders continued to express concern 

about DHS’s lack of communication about the process and the 

findings. Therefore, we recommended that DHS finalize clear, 

consistent, and transparent protocols for biennial country assessments 

and provide these protocols to stakeholders at relevant agencies at 

headquarters and overseas. 

3. We did not intend to suggest that the evaluation of U.S. security and 

law enforcement interests needed to be conducted or finalized during 

the in-country site visits. Our point is that important events may take

place while the country assessments are in the clearance process. We 

believe that DHS should update the country assessments to reflect 

these events, such as large scale thefts of blank passports like the May 

2005 theft that we noted in our report, to ensure that Congress has a 

comprehensive analysis of the current law enforcement and security 

risks posed by each country. 

4. We agree that DHS cannot continue to incorporate data indefinitely 

into the country assessments. However, as we reported, the teams 

collecting information about the visa waiver countries’ risks in 2004 

used, in some cases, information from 2 years prior; by the time the 

summary report was issued in November 2005, some of the data was 

more than 3 years old. Indeed, as DHS noted elsewhere, the 2004 

country assessments provided a “rearview mirror” and “backwardlooking” evaluation. Thus, the assessments may not necessarily have 

contained the best information available at the time the assessments 

were finalized. Given the lengthy time it took for DHS to issue the 

November 2005 summary report to Congress, and to ensure future 

reports contain timely information when issued, we believe that 

Page 51 GAO-06-854 Visa Waiver Program
Appendix IV: Comments from the Department 

of Homeland Security

Congress should consider establishing a biennial deadline by which 

DHS must complete the country assessments and report to Congress. 

5. We agree that continuous and ongoing evaluations of Visa Waiver 

Program countries are needed and recommended that DHS create realtime monitoring arrangements and provide additional resources to the 

Visa Waiver Program Oversight Unit to achieve this goal. However, as 

long as DHS is required to report biennially to Congress, DHS should 

ensure that future reviews are conducted in a timely fashion. Based on 

our review of the 2004 country assessment process, the assessments 

may not necessarily have contained the best information available at 

the time the assessments were finalized given the lengthy time it took 

for DHS to finalize its reviews. 

6. We agree that it is in the U.S. government’s best interest to engage with 

countries on global concerns identified during the course of the 

country assessment process. It is not our intention to inhibit this kind 

of consultation. Furthermore, we acknowledge that a consultative 

process may involve tradeoffs between timely reporting and complete 

information gathering and analysis. Our concern is that key 

stakeholders in headquarters and at overseas posts, as well as 

members of the in-country site visit teams, expressed concerns about 

their roles in the 2004 country assessment process, and stated that 

they had not received enough detail from DHS about the process and 

the findings. Thus, we recommended that DHS provide transparent 

protocols to all stakeholders that provide timelines for the entire 

assessment process, including the role of a site visit, an explanation of 

the clearance process, and deadlines for completion. We believe it is 

important that DHS finalize its standard operating procedures, and 

share these procedures with relevant stakeholders at headquarters and 

overseas. As we noted in our report, due to the lack of outreach and 

clear communication about its mission, OIE is limited in its ability to 

monitor the day-to-day law enforcement and security concerns posed 

by the Visa Waiver Program, and the U.S. government is limited in its 

ability to influence visa waiver countries’ progress in meeting 

requirements. 

7. We strongly agree that classified and sensitive information should be 

protected. However, we also believe that cleared U.S. officials at 

overseas posts in Visa Waiver Program countries, including 

ambassadors and deputy chiefs of mission, have a need to know the 

extent to which law enforcement and security concerns were 

identified during the mandated biennial reviews, and should receive 

copies of the final country assessments. Without the appropriate 

Page 52 GAO-06-854 Visa Waiver Program
Appendix IV: Comments from the Department 

of Homeland Security

information, such as was contained in the assessments, embassy 

officials can not be effective agents for the U.S. government with 

regard to these issues. We believe that the establishment of a classified 

sharing system that allows U.S. government agencies to access the 

country assessments is a positive step. 

Page 53 GAO-06-854 Visa Waiver Program
Appendix V: Comments from the Department Appendix V of State : Comments from the Department 

of State 

Page 54 GAO-06-854 Visa Waiver Program
Appendix V: Comments from the Department 

of State 

Page 55 GAO-06-854 Visa Waiver Program
Appendix V: Comments from the Department 

of State 

Page 56 GAO-06-854 Visa Waiver Program
Appendix VI: Comments from the Appendix VI: Comments from the International Criminal Police Organization

International Criminal Police Organization 

Page 57 GAO-06-854 Visa Waiver Program
Appendix VI: Comments from the 

International Criminal Police Organization

Page 58 GAO-06-854 Visa Waiver Program
Appendix VI: Comments from the 

International Criminal Police Organization

Page 59 GAO-06-854 Visa Waiver Program
Appendix VII: 

A

GAO Contact and Staff 

cknowledgments 

Page 60 GAO-06-854

Appendix VII: GAO Contact and Staff 

Acknowledgments 

Jess T. Ford, (202) 512-4128 or fordj@gao.gov. 

In addition to the contact named above, John Brummet, Assistant 

Director; Kathryn H. Bernet, Joseph C. Brown, Joseph Carney, Richard 

Hung, Jane S. Kim, Mary Moutsos, and Jena Sinkfield made key 

contributions to this report. 

Visa Waiver Program

GAO Contact 

Staff 

Acknowledgments 

(320389) 
GAO’s Mission The Government Accountability Office, the audit, evaluation and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost

is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts 

newly released reports, testimony, and correspondence on its Web site. To

have GAO e-mail you a list of newly posted products every afternoon, go 

to www.gao.gov and select “Subscribe to Updates.” 

The first copy of each printed report is free. Additional copies are $2 each. 

A check or money order should be made out to the Superintendent of 

Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 

more copies mailed to a single address are discounted 25 percent. Orders 

should be sent to: 

U.S. Government Accountability Office 

441 G Street NW, Room LM 

Washington, D.C. 20548 

To order by Phone: Voice: (202) 512-6000 

TDD: (202) 512-2537 

Fax: (202) 512-6061 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470 

Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400 

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, D.C. 20548 

Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, D.C. 20548 

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Mail or Phone 

To Report Fraud,

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Public Affairs 

PRINTED ON RECYCLED PAPER