United States Government Accountability Office

GAO Report to Congressional Requesters

VISA WAIVER 

PROGRAM 

Actions Are Needed to 

Improve Management 

of the Expansion 

Process, and to Assess 

and Mitigate Program 

Risks 

September 2008 

 

GAO-08-967 
What GAO Found

United States Government Accountability Office

Why GAO Did This Study

Highlights

Accountability Integrity Reliability

September 2008

VISA WAIVER PROGRAM

Actions Are Needed to Improve Management of the 

Expansion Process, and to Assess and Mitigate 

Highlights of GAO-08-967, a report to Program Risks

congressional requesters 

The Visa Waiver Program, which 

enables citizens of participating

countries to travel to the United

States without first obtaining a 

visa, has many benefits, but it also

has risks. In 2006, GAO found that 

the Department of Homeland 

Security (DHS) needed to improve 

efforts to assess and mitigate these

risks. In August 2007, Congress 

passed the 9/11 Act, which provides 

DHS with the authority to consider 

expanding the program to

countries whose short-term 

business and tourism visa refusal 

rates were between 3 and 10 

percent in the prior fiscal year. 

Countries must also meet certain 

conditions, and DHS must 

complete actions to enhance the 

program’s security. GAO has 

examined DHS’s process for 

expanding the Visa Waiver Program 

and evaluated the extent to which

DHS is assessing and mitigating

program risks. GAO reviewed 

relevant laws and procedures and

interviewed agency officials in 

Washington, D.C., and in U.S. 

embassies in eight aspiring and 

three Visa Waiver Program 

countries. 

What GAO Recommends

GAO recommends that DHS 

establish a transparent process for 

Visa Waiver Program expansion, 

and improve and monitor overstay

rates for current and aspiring 

program countries. DHS generally

agreed with GAO’s 

recommendations. The Department 

of Justice (Justice) noted the

importance of lost and stolen 

passport reporting, but did not 

comment on the recommendations. 

The executive branch is moving aggressively to expand the Visa Waiver

Program by the end of 2008, but, in doing so, DHS has not followed a 

transparent process. DHS did not follow its own November 2007 standard 

operating procedures, which set forth key milestones to be met before 

countries are admitted into the program. As a result, Departments of State 

(State) and Justice and U.S. embassy officials stated that DHS created 

confusion among interagency partners and aspiring program countries. U.S. 

embassy officials in several aspiring countries told us it had been difficult to 

explain the expansion process to foreign counterparts and manage their 

expectations. State officials said it was also difficult to explain to countries 

with fiscal year 2007 refusal rates below 10 percent that have signaled interest

in joining the program (Croatia, Israel, and Taiwan) why DHS is not 

negotiating with them, given that DHS is negotiating with several countries 

that had refusal rates above 10 percent (Hungary, Latvia, Lithuania, and 

Slovakia). Despite this confusion, DHS achieved some security enhancements

during the expansion negotiations, including agreements with several aspiring

countries on lost and stolen passport reporting. DHS, State, and Justice agreed

that a more transparent process is needed to guide future program expansion. 

DHS has not fully developed tools to assess and mitigate risks in the Visa 

Waiver Program. To designate new program countries with refusal rates 

between 3 and 10 percent, DHS must first make two certifications. First, DHS 

must certify that it can verify the departure of not less than 97 percent of 

foreign nationals who exit from U.S. airports. In February 2008, we testified 

that DHS’s plan to meet this provision will not help mitigate program risks 

because it does not account for data on those who remain in the country 

beyond their authorized period of stay (overstays). DHS has not yet finalized 

its methodology for meeting this provision. Second, DHS must certify that the 

Electronic System for Travel Authorization (ESTA) for screening visa waiver

travelers in advance of their travel is “fully operational.” While DHS has not 

announced when it plans to make this certification, it anticipates ESTA 

authorizations will be required for all visa waiver travelers after January 12,

2009. DHS determined that the law permits it to expand the program to 

countries with refusal rates between 3 and 10 percent after it makes these two 

certifications, and after the countries have met the required conditions, but 

before ESTA is mandatory for all Visa Waiver Program travelers. For DHS to 

maintain its authority to admit certain countries into the program, it must 

incorporate biometric indicators (such as fingerprints) into the air exit system 

by July 1, 2009. However, DHS is unlikely to meet this timeline due to several 

unresolved issues. In addition, DHS does not fully consider countries’ overstay 

rates when assessing illegal immigration risks in the Visa Waiver Program. 

Finally, DHS has implemented many recommendations from GAO’s 2006 

report, including screening U.S.-bound travelers against Interpol’s lost and 

stolen passport database, but has not fully implemented others. Implementing

the remaining recommendations is important as DHS moves to expand both 

the program and the department’s oversight responsibilities. 

To view the full product, including the scope 

and methodology, click on GAO-08-967. 

For more information, contact Jess T. Ford at 

(202) 512-4128 or fordj@gao.gov. 
Contents 

Letter 1

Results in Brief 3

Background 6

Executive Branch Is Moving Quickly to Expand the Visa Waiver 

Program without a Transparent Process 9 

DHS Has Not Fully Developed Tools Aimed at Assessing and 

Mitigating Risks in the Visa Waiver Program 15 

Conclusions 29

Recommendations for Executive Action 30 

Agency Comments and Our Evaluation 30 

Appendix I Objectives, Scope, and Methodology 32 

Appendix II Worldwide Refusal Rates for Short-term Business 

and Tourism Visas, Fiscal Year 2007 34 

Appendix III Key Legislative Requirements for Inclusion in the 

Visa Waiver Program 40 

Appendix IV Comments from the Department of Homeland 

Security 42 

Appendix V Comments from the Department of Justice 51 

Appendix VI GAO Contact and Staff Acknowledgments 53 

Tables 

Table 1: Status of Prior GAO Recommendations 28 

Table 2: Worldwide Refusal Rates for Short-term Business and 

Tourism Visas, Fiscal Year 2007 34 

Page i GAO-08-967 Visa Waiver Program
Figures 

Figure 1: Comparison of DHS’s Process to Expand the Visa Waiver 

Program against the Standard Operating Procedures for 

Expansion 10

Figure 2: Short-term Business and Tourism Visa Refusal Rates, by 

Country, Fiscal Year 2007 13 

Figure 3: DHS’s Current Plan to Meet Air Exit System Provision 

Omits Those Who Remain in the United States 17 

Figure 4: DHS’s Anticipated ESTA Implementation Timeline 21 

Abbreviations 

CBP Customs and Border Protection 

DHS Department of Homeland Security 

ESTA Electronic System for Travel Authorization 

ICE Immigration and Customs Enforcement 

Interpol International Criminal Police Organization 

MOU memorandum of understanding 

US-VISIT U.S. Visitor and Immigrant Status and Indicator Technology 

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately. 

Page ii GAO-08-967 Visa Waiver Program
United States Government Accountability Office

Washington, DC 20548 

September 15, 2008 

The Honorable Joseph I. Lieberman 

Chairman 

The Honorable Susan M. Collins 

Ranking Member 

Committee on Homeland Security and 

 Governmental Affairs 

United States Senate 

The Honorable Joseph I. Lieberman 

Chairman 

The Honorable Susan M. Collins 

Ranking Member 

Committee on Homeland Security and 

 Governmental Affairs 

United States Senate 

The Honorable Dianne Feinstein 

Chairman 

The Honorable Jon Kyl

Ranking Member 

Subcommittee on Terrorism, Technology, 

 and Homeland Security 

Committee on the Judiciary 

United States Senate 

The Honorable Dianne Feinstein 

Chairman 

The Honorable Jon Kyl

Ranking Member 

Subcommittee on Terrorism, Technology, 

 and Homeland Security 

Committee on the Judiciary 

United States Senate 

The Visa Waiver Program enables citizens of 27 participating countries to

travel to the United States for tourism or business for 90 days or less 

without first obtaining a visa from a U.S. embassy or consulate.1

 The 

program has many benefits, including facilitating travel for millions of 

foreign nationals seeking to visit the United States each year. However, as

we have reported,2

 the program also poses inherent security, law 

enforcement, and illegal immigration risks to the United States. In 

particular, Visa Waiver Program travelers are not subject to the same 

degree of screening as those with visas because they are not interviewed 

by a Department of State (State) consular officer before arriving at a U.S.

port of entry. During the visa issuance process, State consular officers can

determine if an individual has a criminal record or has prior immigration 

violations. On the basis of their assessments, consular officers decide 

The Visa Waiver Program enables citizens of 27 participating countries to

travel to the United States for tourism or business for 90 days or less 

without first obtaining a visa from a U.S. embassy or consulate.

 

1

 The 

program has many benefits, including facilitating travel for millions of 

foreign nationals seeking to visit the United States each year. However, as

we have reported,2

 the program also poses inherent security, law 

enforcement, and illegal immigration risks to the United States. In 

particular, Visa Waiver Program travelers are not subject to the same 

degree of screening as those with visas because they are not interviewed 

by a Department of State (State) consular officer before arriving at a U.S.

port of entry. During the visa issuance process, State consular officers can

determine if an individual has a criminal record or has prior immigration 

violations. On the basis of their assessments, consular officers decide 

1

The participating countries are Andorra, Australia, Austria, Belgium, Brunei, Denmark,

Finland, France, Germany, Iceland, Ireland, Italy, Japan, Liechtenstein, Luxembourg, 

Monaco, the Netherlands, New Zealand, Norway, Portugal, San Marino, Singapore,

Slovenia, Spain, Sweden, Switzerland, and the United Kingdom. 

2

GAO, Border Security: Stronger Actions Needed to Assess and Mitigate Risks of the Visa

Waiver Program, GAO-06-854 (Washington, D.C.: July 28, 2006). 

Page 1 GAO-08-967 Visa Waiver Program
whether to approve or deny a visa and, in doing so, help protect against 

individuals who pose a risk to the United States. Without the added 

safeguard of the visa issuance process, the Visa Waiver Program could be 

exploited to gain illegal entry into the United States. Indeed, in September 

2007, the Director of National Intelligence testified that al Qaeda is 

recruiting Europeans because most of them do not require a visa to enter

the United States. Effective oversight of the Visa Waiver Program is 

essential to finding the right balance between facilitating legitimate travel 

and screening for potential terrorists, criminals, and others who may pose 

law enforcement and illegal immigration concerns. 

The executive branch aims to expand the Visa Waiver Program to 

countries in Central and Eastern Europe, and South Korea. According to 

the Department of Homeland Security (DHS), some of these countries are 

U.S. partners in the war in Iraq and have high expectations that they will 

join the program due to their close economic, political, and military ties to 

the United States. The executive branch has supported more flexible 

criteria for admission to the program. In August 2007, Congress passed 

legislation that allows DHS to consider admitting countries that otherwise 

meet the program’s requirements but that have business and tourism visas 

refusal rates3

 between 3 percent and 10 percent, if the countries meet 

certain conditions, such as cooperating with the United States on 

counterterrorism initiatives.4

 Previously, only countries with refusal rates 

below 3 percent in the prior fiscal year qualified to be considered for 

admission. Before DHS can exercise this new authority, the legislation—

referred to as the “9/11 Act”—requires that the department complete 

certain actions aimed at enhancing the security of the Visa Waiver 

Program. 

At your request, this report (1) examines the process DHS is following to 

admit countries into the Visa Waiver Program and (2) evaluates actions 

taken to assess and mitigate potential risks in the program. 

Throughout the course of our work, we reviewed laws governing the Visa 

Waiver Program and its expansion, and relevant regulations and agency 

 3

The refusal rate refers only to the temporary business and tourism visa applications that 

are denied as a percentage of the total temporary business and tourism visa applications

for nationals of that country. 

4

See Implementing Recommendations of the 9/11 Commission Act of 2007, 

Pub. L. No. 110-53. 

Page 2 GAO-08-967 Visa Waiver Program
operating procedures, as well as our prior reports and testimonies. We met 

with several DHS component agencies and offices, including Customs and 

Border Protection (CBP); Immigration and Customs Enforcement (ICE); 

the U.S. Visitor and Immigrant Status and Indicator Technology (USVISIT); and the Visa Waiver Program Office,5

 which is responsible for 

oversight of Visa Waiver Program requirements. In addition, we 

interviewed officials from State’s Consular Affairs, Europe and Eurasia, 

and East Asia and Pacific Bureaus, and met with International Criminal 

Police Organization (Interpol) officials in Lyon, France, as well as officials 

from the Department of Justice’s (Justice) Interpol-U.S. National Central 

Bureau.6 We also spoke with officials at U.S. embassies in three current 

and eight aspiring Visa Waiver Program countries. Appendix I contains a 

more detailed discussion of our objectives, scope, and methodology. We 

conducted this performance audit from September 2007 to September 

2008, in accordance with generally accepted government auditing 

standards. Those standards require that we plan and perform the audit to

obtain sufficient, appropriate evidence to provide a reasonable basis for 

our findings and conclusions based on our audit objectives. We believe 

that the evidence obtained provides a reasonable basis for our findings 

and conclusions based on our audit objectives. 

The executive branch is moving aggressively to expand the Visa Waiver 

Program by the end of 2008, but, in doing so, DHS has not followed a 

transparent process. The department did not follow its own November 

2007 standard operating procedures, which set forth the key milestones 

that DHS and aspiring countries must meet before additional countries are 

admitted into the program. As a result, State, Justice, and U.S. embassy 

officials stated that DHS created confusion among its interagency partners 

and aspiring Visa Waiver Program countries. Indeed, absent clear direction 

from DHS, U.S. embassy officials in several aspiring countries told us that 

it had been difficult to explain the expansion process to their foreign 

counterparts and manage their expectations about when those countries 

might be admitted into the Visa Waiver Program. Furthermore, State 

Results in Brief 

 5

DHS’s Visa Waiver Program Office, known prior to September 2007 as the Visa Waiver 

Oversight Unit within the Office of International Enforcement, is led by a director, who

reports to the DHS Assistant Secretary for Policy Development. 

6

The U.S. National Central Bureau in Washington, D.C., facilitates international law 

enforcement cooperation among the United States and Interpol and its other member

countries. 

Page 3 GAO-08-967 Visa Waiver Program
officials said that it was difficult to explain to countries with fiscal year 

2007 refusal rates below 10 percent that have signaled interest in joining 

the program (such as Croatia, Israel, and Taiwan) why DHS is not 

negotiating with them. DHS, however, is negotiating with several countries 

that had fiscal year 2007 visa refusal rates above the 10 percent ceiling 

(Hungary, Latvia, Lithuania, and Slovakia), with the expectation that fiscal 

year 2008 rates will be below this ceiling. Nevertheless, DHS achieved 

some security enhancements to the Visa Waiver Program during expansion 

negotiations, including new agreements with several aspiring countries on

lost and stolen passport reporting. DHS, State, and Justice agreed, 

however, that a more transparent process is needed to guide any future 

consideration of program expansion. In acknowledging weaknesses in the 

expansion process, DHS’s Assistant Secretary for Policy Development said 

that DHS did not have a clear process at the outset of negotiations in late 

2007, in part because the department lacked prior experience in expanding

the Visa Waiver Program and because the program’s legislative 

requirements had changed in August of that year.

DHS has not fully developed tools to assess and mitigate risks in the Visa 

Waiver Program. Specifically, DHS has not yet met two key certification 

requirements in the 9/11 Act that would allow DHS to consider admitting 

additional countries to the program with refusal rates between 3 percent 

and 10 percent. First, DHS must certify that it can verify the departure of 

not less than 97 percent of foreign nationals who exit from U.S. airports. In 

February 2008, we testified that DHS’s plan to meet this provision will not 

demonstrate improvements in the air exit system and will not help the 

department mitigate risks of the Visa Waiver Program, because the plan

does not account for data on those who remain in the country beyond 

their authorized period of stay (referred to as “overstays”). Second, DHS 

must certify that the Electronic System for Travel Authorization (ESTA) 

for screening visa waiver travelers in advance of their travel is “fully 

operational.” DHS has not yet announced when it plans to make this 

certification; however, ESTA became available on a voluntary basis on 

August 1, 2008, and DHS anticipates that ESTA authorizations will be 

required for all visa waiver travelers after January 12, 2009.7

 DHS 

determined that the law permits it to expand the program to countries 

with refusal rates between 3 percent and 10 percent after it makes the two 

 7

According to DHS, ESTA will be implemented as a mandatory program for all visa waiver 

travelers 60 days after publication of a notice in the Federal Register. DHS anticipates 

issuing that notice in November 2008, for implementation of the mandatory ESTA 

requirements on January 12, 2009. 

Page 4 GAO-08-967 Visa Waiver Program
9/11 Act certifications, and after the countries have met certain conditions, 

but before ESTA is mandatory for all Visa Waiver Program travelers. DHS 

may face challenges in implementing ESTA, such as adequately informing 

the public and travel industry about the system. In addition, for DHS to 

maintain its authority to admit certain countries into the program, the 9/11 

Act requires that the air exit system also incorporate biometric indicators 

(such as fingerprints) by July 1, 2009. However, DHS is unlikely to meet 

this timeline due to several unresolved issues. In addition, DHS does not 

fully consider countries’ overstay rates when assessing illegal immigration 

risks in the Visa Waiver Program because the department’s overstay data

have weaknesses, according to the Visa Waiver Program Office. Finally, 

DHS has fully implemented many recommendations from our 2006 report 

aimed at improving DHS’s ability to assess and mitigate program risks, 

including screening U.S.-bound travelers against Interpol’s database of lost

and stolen passports. However, DHS has not yet fully implemented others, 

such as requiring that all Visa Waiver Program countries report the theft or

loss of blank and issued passports to the United States and Interpol. Fully 

implementing the remaining recommendations is important as DHS moves 

to expand both the Visa Waiver Program and the department’s oversight 

responsibilities. 

To improve management of the Visa Waiver Program and better assess and 

mitigate risks associated with the program, we recommend that DHS 

establish a clear process, in coordination with State and Justice, for 

program expansion that would include the criteria used to determine 

which countries will be considered for expansion and timelines for 

nominating countries, security assessments of aspiring countries, and 

negotiation of any bilateral agreements to implement the program’s 

legislative requirements. In addition, we recommend that DHS designate 

an office with responsibility for developing overstay rate information for 

the Visa Waiver Program, explore cost-effective actions to further improve 

these data’s reliability, and use these validated data to help evaluate 

whether current or aspiring Visa Waiver Program countries pose a 

potential illegal immigration risk to the United States. 

We received written comments on a draft of our report from DHS and 

Justice, which we have reprinted in appendices IV and V, respectively. 

State did not provide comments on the draft. DHS either agreed with, or 

stated that it was taking steps to implement, all of our recommendations. 

Justice did not comment on our recommendations, but provided 

additional information about the importance of monitoring countries’ 

reporting of lost and stolen passports to Interpol, and its efforts, in 

Page 5 GAO-08-967 Visa Waiver Program
collaboration with DHS, to include screening against Interpol’s lost and 

stolen passport database in ESTA. 

In 2007, almost 13 million citizens8

 from 27 countries entered the United 

States under the Visa Waiver Program.9

 The program was created to 

promote the effective use of government resources and facilitate 

international travel without jeopardizing U.S. national security. The United

States last expanded the Visa Waiver Program’s membership in 1999; since 

then, other countries have expressed a desire to become members. In 

February 2005, President Bush announced that DHS and State would 

develop a strategy, or “Road Map Initiative,” to clarify the statutory 

requirements for designation as a participating country. According to DHS, 

some of the countries seeking admission to the program are U.S. partners 

in the war in Iraq and have high expectations that they will join the 

program due to their close economic, political, and military ties to the 

United States. As we reported in July 2006, DHS and State are consulting 

with 13 “Road Map” countries seeking admission into the Visa Waiver 

Program—Bulgaria, Cyprus, Czech Republic, Estonia, Greece, Hungary, 

Latvia, Lithuania, Malta, Poland, Romania, Slovakia, and South Korea. 

Background 

Following the terrorist attacks of September 11, 2001, Congress passed 

additional laws to strengthen border security policies and procedures, and

DHS and State instituted other policy changes that have affected a 

country’s qualifications for participating in the Visa Waiver Program. In 

August 2007, Congress enacted the 9/11 Act, which provides DHS with the 

authority to consider admitting into the Visa Waiver Program countries 

that otherwise meet the program requirements, but have refusal rates 

between 3 percent and 10 percent, provided the countries meet certain 

conditions (see app. II for worldwide refusal rates for fiscal year 2007). 

Before being admitted to the program, for example, the countries must 

demonstrate a sustained reduction in refusal rates, and must be 

cooperating with the United States on counterterrorism initiatives, 

information sharing, and the prevention of terrorist travel, among other 

things. In addition, DHS must complete two actions aimed at enhancing 

the security of the program (see app. III for the key legislative 

 8

This figure does not account for multiple admissions into the United States under the Visa 

Waiver Program by the same individual. 

9

The Immigration Reform and Control Act of 1986, Pub. L. No. 99-603, created the Visa

Waiver Program as a pilot program. In 2000, the program became permanent under the Visa

Waiver Permanent Program Act, Pub. L. No. 106-396. 

Page 6 GAO-08-967 Visa Waiver Program
requirements for inclusion in the Visa Waiver Program).10 In particular, to 

consider admitting countries into the Visa Waiver Program with refusal 

rates between 3 percent and 10 percent, DHS must certify the following to 

Congress: 

• A system is in place that can verify the departure of not less than 97 

percent of foreign nationals who depart through U.S. airports. Initially, 

this system will be biographic only. Congress required the eventual 

implementation of a biometric exit system at U.S. airports. If the biometric 

air exit system is not in place by July 1, 2009, the flexibility that DHS may 

obtain to consider admitting countries with refusal rates between 3 

percent and 10 percent will be suspended until the system is in place. 

• An electronic travel authorization system is “fully operational.” This 

system will require nationals from Visa Waiver Program countries to 

provide the United States with biographical information before boarding a 

U.S.-bound flight to determine the eligibility of, and whether there exists a 

law enforcement or security risk in permitting, the foreign national to 

travel to the United States under the program. DHS recommends that 

applicants obtain ESTA authorizations at the time of reservation or ticket

purchase, or at least 72 hours before their planned date of departure for 

the United States. The ESTA application will electronically collect 

information similar to the information collected in paper form by CBP.11 

To the extent possible, according to DHS, applicants will find out almost 

immediately whether their travel has been authorized, in which case they

are free to travel to the United States, or if their application has been 

rejected, in which case they are ineligible to travel to the United States 

under the Visa Waiver Program.12 Those found ineligible to travel under the 

 10Section 711 of the 9/11 Act specifically grants DHS the authority to waive the 3 percent

refusal rate requirement for countries—currently up to a maximum of 10 percent—

provided those countries meet other security requirements. 

11This form is CBP’s I-94W Nonimmigrant Visa Waiver Arrival/Departure Form. According

to DHS, the department is coordinating with commercial aircraft and vessel carriers on the 

development and implementation of messaging capabilities that will enable CBP to provide 

the carriers with messages pertaining to a passenger’s boarding status. Once ESTA is 

mandatory and all carriers are capable of receiving and validating messages from CBP 

pertaining to the traveler’s ESTA status as part of their boarding status, DHS plans to

eliminate the I-94W requirement. 

12ESTA authorizations will be valid for up to 2 years and will allow the individual to travel 

to the United States repeatedly within that period. In some circumstances, such as when a

passport has expired or a traveler has changed his or her name, the traveler must apply for 

a new ESTA authorization.

Page 7 GAO-08-967 Visa Waiver Program
Visa Waiver Program must apply for a visa at a U.S. embassy to travel to 

the United States.13

In addition, the 9/11 Act requires that visa waiver countries 

• enter into an agreement with the United States to report, or make available 

through Interpol or other means as designated by the Secretary of 

Homeland Security, to the U.S. government information about the theft or

loss of passports within a strict time frame; 

• enter into an agreement with the United States to share information 

regarding whether citizens and nationals of that country traveling to the 

United States represent a threat to U.S. security; and 

• accept for repatriation any citizen, former citizen, or national of the 

country against whom the United States has issued a final order of 

removal. 

When DHS exercises its authority to waive the 3 percent refusal rate 

requirement, it shall, in consultation with State, take into account other 

discretionary factors, pursuant to the 9/11 Act, including a country’s 

airport security standards; whether the country assists in the operation of 

an effective air marshal program; the standards of passports and travel 

documents issued by the country; and other security-related factors, 

including the country’s cooperation with (1) the United States’ initiatives 

toward combating terrorism and (2) the U.S. intelligence community in 

sharing information regarding terrorist threats. DHS works in consultation 

with State and Justice, as well as the intelligence community, as part of 

DHS’s assessment of countries seeking to join the Visa Waiver Program. 

 13In addition to receiving an authorization or rejection notice upon submitting an ESTA

application, the applicant may also receive a response noting that the application is 

pending. 

Page 8 GAO-08-967 Visa Waiver Program
The executive branch is moving aggressively to expand the Visa Waiver 

Program by the end of 2008, but, in doing so, DHS has not followed a 

transparent process for admitting new countries to the program—an 

approach that has created confusion among other U.S. agencies in 

Washington, D.C.; U.S. embassy officials overseas; and those countries 

that are seeking to join the Visa Waiver Program. During the expansion 

negotiations, DHS has achieved some security enhancements, such as new 

agreements that, among other things, require the reporting of lost and 

stolen blank and issued passports. 

We found that the Visa Waiver Program Office has not followed its own 

standard operating procedures, completed in November 2007, which set 

forth the key milestones that DHS and aspiring countries must meet before 

additional countries are admitted into the program.14 According to the 

standard procedures, State should submit to DHS a formal, written 

nomination for a particular country, after which DHS is to lead an 

interagency team to conduct an in-country, comprehensive review of the 

impact of the country’s admission into the Visa Waiver Program on U.S. 

security, law enforcement, and immigration interests. Figure 1 depicts the 

standard procedures that the program office established to guide 

expansion of the Visa Waiver Program compared with DHS’s actions since 

August 2007. Although State has only nominated one country—Greece—

DHS has nonetheless conducted security reviews for countries that State 

has not yet nominated—Czech Republic, Estonia, Hungary, Latvia, 

Lithuania, Slovakia, and South Korea. According to State officials, until 

DHS has implemented the required provisions of the 9/11 Act, and aspiring 

countries have met all of the Visa Waiver Program’s statutory 

requirements, State does not plan to nominate any other countries. DHS’s 

Assistant Secretary for Policy Development told us that the department 

had determined that it would not follow the standard operating 

procedures during these expansion negotiations and, thus, had to “make 

up the process as it went along,” in part because DHS had never expanded

the program before and because Congress significantly changed the 

program’s legislative requirements in August 2007. 

Executive Branch Is 

Moving Quickly to 

Expand the Visa 

Waiver Program

without a Transparent 

Process

DHS Has Not Followed a 

Transparent Process for 

Visa Waiver Program

Expansion 

 14In 2006, we reported on the executive branch’s process for admitting additional countries 

into the Visa Waiver Program. See GAO, Process for Admitting Additional Countries into 

the Visa Waiver Program, GAO-06-835R (Washington, D.C.: July 26, 2006). 

Page 9 GAO-08-967 Visa Waiver Program
Figure 1: Comparison of DHS’s Process to Expand the Visa Waiver Program against the Standard Operating Procedures for 

Expansion 

Sept.

2007 2008

Aug. Oct. Nov. Dec. Jan. Feb. Mar. Apr. May June July Aug. Sept. Oct. Nov. Dec.

Standard Visa Waiver Program Expansion Process

DHS Expansion Process

State submits a formal 

nomination of an individual 

country to DHS

DHS conducts a comprehensive review 

of the nominated country, which 

includes an in-country site visit

DHS completes comprehensive 

country review and submits it

to Congress

Sources: GAO analysis of DHS data; Art Explosion images.

Lithuania 12.9%

Visa refusal rate,

Country fiscal year 2007

Slovakia 12.0%

Latvia 11.8%

Hungary 10.3%

10 percent

Nomination

Memorandum of understanding (MOU)

DHS’s standard operating procedures do not include signing MOUs

In-country site visit

Czech

Republic 6.7%

South

Korea

4.4%

Estonia 4.0%

Malta 2.7%

Greece 1.6%

DHS goal 

to admit 

new 

countries

Page 10 GAO-08-967 Visa Waiver Program
State and Justice officials told us that the lack of a transparent timeline 

and requirements for Visa Waiver Program expansion has led to confusion 

among U.S. agencies in headquarters’ offices and at U.S. embassies 

overseas, as well as foreign governments seeking to join the program. For 

example, DHS’s standard procedures were not updated to account for the 

department’s plans to sign with each of the aspiring Visa Waiver Program 

countries separate memorandums of understanding (MOU) that lay out the 

new legislative requirements from the 9/11 Act. According to DHS, while 

not required by the act, the U.S. government is seeking to negotiate MOUs 

with current and aspiring Visa Waiver Program countries to help put the 

legislative provisions in place. Although DHS has not yet signed MOUs 

with any current program countries, the department intends to complete 

negotiations with existing program countries by October 2009. As 

indicated in figure 1, DHS signed MOUs with aspiring countries before 

conducting in-country security reviews. The MOUs are to be accompanied 

by more specific “implementing arrangements” for sharing biographic, 

biometric, and other data, as required by the 9/11 Act, within general 

parameters of what the United States is willing and able to reciprocate—

this includes sharing information on known or suspected terrorists. 

According to DHS, the type and scope of these arrangements will vary by 

country and will take into account existing bilateral information-sharing 

arrangements. As of June 2008, DHS had signed MOUs with eight Road 

Map countries and had begun negotiations on the implementing 

arrangements. However, State and Justice officials told us that DHS had 

not been clear in communicating these steps to aspiring and current 

program countries. DHS officials acknowledged that the department was 

still exploring how to best complete the implementing arrangements. U.S. 

embassy officials in several Road Map countries told us that it had been 

difficult to explain the expansion process to their foreign counterparts and 

manage their expectations about when those countries might be admitted 

into the Visa Waiver Program. Justice officials and U.S. officials in several

embassies told us that the implementing arrangements may be more 

difficult to negotiate than the nonbinding MOUs because some countries 

have expressed concerns about sharing private information on their 

citizens due to strict national privacy laws—concerns that the United 

States also has about its citizens’ information. In response to our request, 

in late April 2008, DHS provided us with an outline of the department’s 

completed and remaining actions for expanding the Visa Waiver Program 

by the end of this year. DHS officials stated that this outline could be a

first step in providing guidance for all stakeholders, should the program be 

expanded again in the future. However, the outline does not include 

criteria for selecting countries under consideration for admission into the 

program, other than the 13 Road Map countries.

Page 11 GAO-08-967 Visa Waiver Program
The U.S. government is only considering the Road Map countries for 

potential admission into the program in 2008 because the United States 

began formal discussions with these 13 countries several years ago, not 

due to the application of clearly defined requirements. DHS is negotiating 

with 4 Road Map countries with fiscal year 2007 refusal rates over 10 

percent (Hungary, Latvia, Lithuania, and Slovakia), with the expectation 

that fiscal year 2008 refusal rates for these countries will fall below 10 

percent. State officials told us that they lacked a clear rationale to explain

to other aspiring, non-Road Map countries with refusal rates under 10 

percent (Croatia, Israel, and Taiwan) that they will not be considered in 

2008 due to the executive branch’s plans to expand the program first to 

South Korea and countries in Central and Eastern Europe. In addition, on 

May 1 of each year, State must report to Congress those countries that are 

under consideration for inclusion in the Visa Waiver Program; the 

department has never submitted this report because, according to 

consular officials, no country has been under consideration for admission 

into the program since the reporting requirement was established in 2000.

15

As of late June 2008, State had not yet submitted its report for 2008. A 

State official told us that, despite the actions that DHS, State, and other 

U.S. agencies have taken to expand the Visa Waiver Program to as many as

9 countries in 2008, State was initially unclear about which countries it 

should include in this report. While only Greece has been nominated, DHS 

has made clear its goal to admit many of the Road Map countries in 2008. 

(Fig. 2 shows the fiscal year 2007 refusal rates for the 13 Road Map 

countries.) 

 15State must report to the appropriate congressional committees on the total number of 

nationals of that country who applied for U.S. visas in that country during the previous

calendar year; the total number of such nationals who received U.S. visas during the 

previous calendar year; the total number of such nationals who were refused U.S. visas

during the previous calendar year, and, specifically, under which provision of the

Immigration and Nationality Act they were refused; and the number of such nationals who 

were refused visas under section 214(b)of the Immigration and Nationality Act as a 

percentage of the visas that were issued to such nationals. In addition, not later than May 1

of each year, the U.S. chief of mission (acting or permanent) to each country under 

consideration for inclusion in the Visa Waiver Program, must certify to the appropriate 

congressional committees that the information described in the report is accurate, and

must provide a copy of the certification to the congressional committees. 

Page 12 GAO-08-967 Visa Waiver Program
Figure 2: Short-term Business and Tourism Visa Refusal Rates, by Country, Fiscal Year 2007 

0

10

20

30

40

Greece 1.6%

Cyprus 1.8%

Angola

Antigua/Barbuda

Azerbaijan

Bosnia-Herzegovina

Botswana

Bulgaria – 14.3%

Hungary – 10.3%

Kazakhstan

Kiribati

Argentina

Barbados

Brazil

Chile

Taiwan

Croatia

Algeria

Belarus

Belize

Bolivia

Central African Republic

Chad

China

Colombia

Comoros

Romania – 37.7%

Percentage

40 percent

30 percent

20 percent

10 percent

3 percent

Malta 2.7%

Bahrain

Hong Kong

Israel

Qatar

Czech Republic – 6.7%

Estonia – 4%

Kuwait

Macau

Malaysia

Namibia

Oman

Marshall Islands

Sao Tome and Principe

Saudi Arabia

Solomon Islands

South Africa

South Korea – 4.4%

The Bahamas

Latvia – 11.8%

Lithuania – 12.9%

Madagascar

Mauritius

Mozambique

Papua New Guinea

Paraguay

North Korea

Russia

Seychelles

Slovakia – 12%

Suriname

Swaziland

Thailand

Turkey

Tuvalu

Uruguay

Venezuela

Costa Rica

Djibouti

Dominica

Ecuador

Equatorial Guinea

Gabon

Grenada

India

Kyrgyzstan

Lebanon

Libya

Maldives

Morocco

Panama

Poland – 25.2%

Samoa

Serbia and Montenegro

Sri Lanka

St. Kitts and Nevis

St. Lucia

St. Vincent and the Grenadines

Tanzania

Tunisia

Vanuatu

Source: GAO analysis of Department of State data.

“Road Map” initiative countries

Note: DHS may consider adding to the Visa Waiver Program aspiring countries with refusal rates 

below 3 percent in the prior fiscal year, without meeting the two certification requirements in the 9/11 

Act. 

Page 13 GAO-08-967 Visa Waiver Program
According to DHS, it could not wait until all statutory requirements were 

officially met before beginning bilateral negotiations with Road Map 

countries, because doing so would not allow sufficient time to add the 

countries by the end of 2008. DHS plans to complete the security reviews 

and sign MOUs and implementing arrangements with Road Map countries

by the fall of 2008. If these and all other statutory provisions are 

completed—including countries’ achievement of refusal rates below 10 

percent—State indicated that it will then formally nominate the countries. 

However, DHS has acknowledged that if it and the aspiring countries 

cannot meet all of the program’s statutory requirements, the United States 

will not admit additional countries into the program. In such an event, the 

U.S. government could face political and diplomatic repercussions, given 

the expectations raised that many of the Road Map countries will be 

admitted in 2008. DHS, State, and Justice officials acknowledged that 

following a more transparent process would be useful in the future as 

additional countries seek to join the program. 

DHS Has Achieved Some 

Results in Visa Waiver 

Program Expansion 

Negotiations 

DHS’s expansion negotiations with current and aspiring Visa Waiver 

Program countries have led to commitments from countries to improve 

information sharing processes with the United States. For example, by 

signing MOUs, eight aspiring countries have signaled their intent to 

comply with the program’s statutory provision to report to the United 

States or Interpol in a timely manner the loss or theft of passports—a key 

vulnerability in the Visa Waiver Program, as we have previously reported.16

In addition, as a result of ongoing visa waiver negotiations with the South 

Korean government, in January 2008, DHS initiated the Immigration 

Advisory Program at Incheon International Airport in South Korea to help

prevent terrorists and other high-risk travelers from boarding commercial 

aircraft bound for the United States.17 Furthermore, a senior consular 

official testified that the executive branch’s dialogue on Visa Waiver 

 16GAO-06-854. 

17According to CBP, the Immigration Advisory Program aims to enhance the safety of air

travel by, among other things, reducing the number of improperly documented passengers 

traveling from or through a country to the United States. As of August 2008, the program 

operates in airports in Amsterdam, the Netherlands; Frankfurt, Germany; London, England 

(Heathrow Airport and Gatwick Airport); Manchester, England; Madrid, Spain; Seoul, 

South Korea; Tokyo, Japan; and Warsaw, Poland. 

Page 14 GAO-08-967 Visa Waiver Program
Program expansion is helping to stimulate U.S. negotiations on other 

terrorist watch-list- sharing arrangements with Road Map countries.18

As of early September 2008, DHS had not yet met two key certification 

requirements in the 9/11 Act that are necessary to allow the department to 

consider expanding the Visa Waiver Program to countries with refusal 

rates between 3 percent and 10 percent. In addition, the Visa Waiver 

Program Office does not fully consider data on overstay rates for current 

and aspiring Visa Waiver Program countries, even though doing so is 

integral to meeting a statutory requirement for continued eligibility in the 

Visa Waiver Program. Finally, in reviewing recommendations from our 

2006 report aimed at improving efforts to assess and mitigate program 

risks, we found that DHS has implemented many of our prior 

recommendations, but some are only partially implemented. 

On February 28, 2008, we testified that DHS’s plan for certifying that it can 

verify the departure of 97 percent of foreign nationals from U.S. airports 

will not help the department mitigate risks of the Visa Waiver Program.19

Furthermore, DHS will face a number of challenges in implementing ESTA 

by January 2009. Finally, it is unlikely that DHS will implement a biometric 

air exit system before July 2009, due to opposition from the airline 

industry. 

As we have previously mentioned, the 9/11 Act requires that DHS certify 

that a system is in place that can verify the departure of not less than 97 

percent of foreign nationals who depart through U.S. airports. In 

December 2007, DHS reported to us that it will match records, reported by

DHS Has Not Fully 

Developed Tools 

Aimed at Assessing 

and Mitigating Risks 

in the Visa Waiver 

Program 

DHS Has Not yet 

Implemented Key Security 

Provisions of 9/11 Act That 

Are Necessary to Admit 

Certain Countries into the 

Visa Waiver Program

Plan to Verify the Air Departure 

of Foreign Nationals Will Not 

Help DHS Mitigate Program 

Risks 

 18Homeland Security Presidential Directive-6 required the Secretary of State to develop a

proposal for the President’s approval for enhancing cooperation with certain foreign 

governments—beginning with those countries for which the United States has waived visa 

requirements—to establish appropriate access to the participating governments’ terrorism 

screening information. State determined that the most effective way to obtain this 

information was to seek bilateral agreements to share information on a reciprocal basis. In

May 2008, the Deputy Assistant Secretary of State for Visa Services testified that State 

anticipates completing these agreements with all of the Road Map countries by the end of 

September 2008. See, The White House, Homeland Security Presidential Directive/HSPD6, Subject: Integration and Use of Screening Information (Washington, D.C.: Sept. 16, 

2003). 

19GAO, Visa Waiver Program: Limitations with Department of Homeland Security’s Plan

to Verify Departure of Foreign Nationals, GAO-08-458T (Washington, D.C.: Feb. 28, 2008).

Page 15 GAO-08-967 Visa Waiver Program
airlines,20 of visitors departing the country to the department’s existing 

records of any prior arrivals, immigration status changes,21 or prior 

departures from the United States. At the time of our February 2008 

testimony, DHS had confirmed that it planned to employ a methodology 

that begins with departure records. During the hearing, we also testified 

that this methodology will not demonstrate improvements in the air exit 

system and will not help the department mitigate risks of the Visa Waiver 

Program. We identified a number of weaknesses with this approach, as 

follows: 

• First, DHS’s methodology will not inform overall or country-specific 

overstay rates, which are key factors in determining illegal immigration 

risks in the Visa Waiver Program. In particular, DHS’s methodology does 

not begin with arrival records to determine if those foreign nationals 

departed or remained in the United States beyond their authorized periods 

of admission—useful data for oversight of the Visa Waiver Program and its 

expansion. As we previously testified, an alternate approach would be to 

track air arrivals from a given point in time and determine whether those 

foreign nationals have potentially overstayed.22 Figure 3 compares DHS’s 

plan to match visitor records using departure data as a starting point with 

a methodology that would use arrival data as a starting point.

 20Air carriers transmit visitor manifest information, which is obtained directly from

government-issued passports, to CBP through the Advanced Passenger Information 

System. This system includes arrival and departure manifest information, such as name, 

date of birth, travel document issuing country, gender, U.S. destination address, entry date, 

and departure date. As of February 19, 2008, commercial carriers are required to transmit 

manifest information to be vetted by DHS prior to departure of the aircraft. 

21This includes changes and extensions of the visits of lawfully admitted, nonimmigrant 

foreign nationals. 

22This could include foreign nationals who departed after their authorized period of 

admission expired, as well as those foreign nationals who may have remained in the 

country as overstays.

Page 16 GAO-08-967 Visa Waiver Program
Figure 3: DHS’s Current Plan to Meet Air Exit System Provision Omits Those Who 

Remain in the United States 

• Second, for purposes of this provision and Visa Waiver Program 

expansion, we do not see the value in verifying that a foreign national 

leaving the United States had also departed at a prior point in time23—in 

other words, matching a new departure record back to a previous 

 23According to ICE officials at DHS, this type of information provides a more complete 

history of an alien and is useful for law enforcement purposes, such as criminal 

prosecution and documenting activities. 

Page 17 GAO-08-967 Visa Waiver Program

ch

status ange

departure

arriv s

als

manifest

Sources: GAO analysis of Department of Homeland Security data; Map Resources (maps); Nova Development and Ingram 

Publishing (clip art).

DHS’s plan uses

departure data as starting point

Alternative approach uses

arrival data as starting point

• Who has departed by air

• Who has potentially overstayed

Arrival data matched against subsequent 

records of those foreign nationals, which 

will inform DHS of:

Foreign nationals arrive

Using air departure manifest 

records, DHS reports that it can 

match not less than 97 percent of 

departure records to records of 

prior:

• Arrivals

• Departures

• Change of status

Foreign nationals depart by air
departure record from the country.24 DHS’s Assistant Secretary for Policy 

Development told us in January 2008 that the department chose to include

previous departures and changes of immigration status records because 

this method allowed the department to achieve a match rate of 97 percent 

or greater. 

• Third, DHS’s methodology does not address the accuracy of airlines’ 

transmissions of departure records, and DHS acknowledges that there are 

weaknesses in the departure data. Foreign nationals who enter the United 

States by air are inspected by DHS officers—a process that provides 

information that can be used to verify arrival manifest data—and, since 

2004, DHS has implemented the US-VISIT program to collect biometric 

information on foreign nationals arriving in the United States.25 However, 

the department has not completed the exit portion of this tracking system; 

thus, there is no corresponding check on the accuracy and completeness 

of the departure manifest information supplied by the airlines.26 According 

to DHS, it works with air carriers to try to improve both the timeliness and 

comprehensiveness of manifest records, and fines carriers that provide 

incomplete or inaccurate information. If DHS could evaluate these data,

and validate the extent to which they are accurate and complete, the 

department would be able to identify problems and work with the airlines 

to further improve the data. 

An air exit system that facilitates the development of overstay rate data is

important to managing potential risks in expanding the Visa Waiver 

 24A DHS official told us that the system functions by matching the departure record with an

alien’s “account,” which may contain numerous prior arrivals, departures, and immigration

benefit transaction records. The official also stated that a specific departure record match

may not fall chronologically in the alien’s account after an arrival; it may fall, for example,

after a record that an immigrant benefit was granted to extend the alien’s stay for an 

additional 6 months. 

25DHS’s US-VISIT program collects, maintains, and shares data, including biometric 

identifiers like digital fingerprints, on selected foreign nationals entering the United States 

to verify their identities as they arrive at U.S. air, sea, and land ports of entry. DHS 

currently operates the entry portion of the US-VISIT program at more than 300 U.S. air, sea, 

and land ports of entry. When fully implemented, US-VISIT is also intended to capture the 

same information from foreign nationals as they depart the country. The program aims to, 

among other things, identify foreign nationals who have overstayed or violated the terms of

their visit. 

26DHS has not implemented long-standing GAO recommendations to collect departure

information and make new estimates of overstays by air. See GAO, Illegal Immigration:

INS Overstay Estimation Methods Need Improvement, GAO/PEMD-95-20 (Washington,

D.C.: Sept. 26, 1995); and Illegal Aliens: Despite Data Limitations, Current Methods 

Provide Better Population Estimates, GAO/PEMD-93-25 (Washington, D.C.: Aug. 3, 1993). 

Page 18 GAO-08-967 Visa Waiver Program
Program. We found that DHS’s planned methodology for meeting the “97 

percent provision” so it can move forward with program expansion will 

not demonstrate improvements in the air exit system or help the 

department identify overstays or develop overstay rates. As of early 

September 2008, DHS had not yet certified this provision, nor had it 

finalized a methodology to meet the provision. 

In June 2008, DHS announced in the Federal Register that it anticipates 

that all visa waiver travelers will be required to obtain ESTA authorization 

for visa waiver travel to the United States after January 12, 2009. However, 

we identified four potential challenges that DHS may face in implementing 

ESTA, including a limited time frame to adequately inform U.S. embassies 

and the public and the significant impact that ESTA will have on the airline 

and travel industry. 

We have previously reported that visa waiver travelers pose inherent 

security and illegal immigration risks to the United States, since they 

(1) are not subject to the same degree of screening as travelers with visas 

and (2) are not interviewed by a consular officer before arriving at a U.S.

port of entry.27 In the 9/11 Act conference report,28 Congress agreed on the 

need for significant security enhancements to the Visa Waiver Program 

and to the implementation of ESTA prior to permitting DHS to admit new 

countries into the program with refusal rates between 3 percent and 10 

percent. According to DHS, ESTA will allow DHS to identify potential 

ineligible visa waiver travelers before they embark on a U.S.-bound carrier. 

DHS also stated that by recommending that travelers submit ESTA 

applications 72 hours in advance of their departure, CBP will have 

additional time to screen visa waiver travelers destined for the United 

States. 

DHS must follow several steps in implementing ESTA (see fig. 4). First, the 

9/11 Act requires that DHS must certify both the 97 percent air exit system

and ESTA as fully operational before the department can consider 

expanding the Visa Waiver Program to countries with refusal rates 

between 3 percent and 10 percent. DHS has not announced when it plans 

to make this certification. DHS attorneys told us that the department could 

admit additional countries to the program once it provides this

DHS’s Planned Implementation 

of ESTA by January 2009 Will 

Face Challenges 

 27GAO-06-854. 

28Conference Report on H.R. 1, Implementing Recommendations of the 9/11 Commission 

Act of 2007 (July 25, 2007). 

Page 19 GAO-08-967 Visa Waiver Program
certification. In addition, according to DHS, the act provides that 60 days 

after the Secretary of Homeland Security publishes a final notice in the 

Federal Register of the ESTA requirement, each alien traveling under the 

Visa Waiver Program must use ESTA to electronically provide DHS with 

biographic and other such information as DHS deems necessary to 

determine, in advance of travel, the eligibility of, and whether there exists 

a law enforcement or security risk in permitting, the alien to travel to the

United States.

29 DHS stated that it expects to issue this final notice in early 

November 2008, and, as of January 12, 2009, all visa waiver travelers would

be required to obtain authorization through ESTA prior to boarding a U.S.-

bound flight or cruise vessel. DHS stated that if, after certifying ESTA as 

fully operational, it admits an additional country prior to January 12, 2009, 

it will require that visa waiver travelers from that country obtain ESTA 

authorizations immediately. For example, if Estonia were admitted into 

the Visa Waiver Program on October 10, 2008, citizens of that country 

traveling to the United States under the program would be required to 

begin using ESTA on that date; however, visa waiver travelers from 

existing program countries would not be required to obtain approval 

through ESTA until January 12, 2009, more than 3 months later. 

 29DHS attorneys stated that the department also hopes to certify ESTA as fully operational 

in early November. In addition, as we have previously mentioned, to consider admitting 

countries into the program with refusal rates between 3 percent and 10 percent, DHS must 

also certify that the air exit system is in place. 

Page 20 GAO-08-967 Visa Waiver Program
Figure 4: DHS’s Anticipated ESTA Implementation Timeline 

June July Aug. Sept. Nov. Oct. Dec. Jan.

August 1, 2008:

ESTA operational in 

English

June 9, 2008:

DHS announced 

plans for the 

Electronic System 

for Travel 

Authorization 

(ESTA) in the 

Federal Register

October 15, 2008:

ESTA operational 

in additional 

languages

End of 2008:

DHS anticipates

expanding the Visa

Waiver Program

Source: GAO.

Early October 2008:

Fiscal year 2008 

refusal rate data

available

Early November 2008:

DHS anticipates

publishing final notice 

for ESTA in the Federal 

Register 

January 12, 2009:

DHS anticipates

ESTA authorization 

to be mandatory for 

all visa waiver 

travelers

We identified four potential challenges to DHS’s planned implementation 

of ESTA by January 12, 2009. It is difficult to predict the extent to which 

DHS will address these challenges due to the short time frame in which 

the department is implementing the system. These challenges include the

following: 

• DHS has a limited time frame to adequately inform U.S. embassies in 

Visa Waiver Program countries and the public about ESTA. U.S. embassy 

officials in current and aspiring Visa Waiver Program countries told us that 

the United States will need to ensure that there is sufficient time to inform 

travelers, airlines, and the travel industry of ESTA requirements and 

implementation timelines. U.S. commercial and consular officials at a U.S. 

embassy in a current Visa Waiver Program country told us that they would 

ideally like 1 year’s advance notice before ESTA is implemented to allow 

sufficient time to inform and train the public and the travel industry of the 

new requirement. However, DHS’s announcement in June 2008 accelerated

the timeline for ESTA implementation in current visa waiver countries. 

During our site visits in March 2008, U.S. embassy officials in a visa waiver

country told us that they had been informed by DHS officials that the 

department did not plan to require ESTA authorization for travelers from 

that country until the summer of 2009 or later. According to a senior U.S.

official at one embassy, DHS had confirmed this plan with host country 

government officials in early May 2008. Following the June 2008 

announcement, a senior U.S. embassy official in another country told us 

Page 21 GAO-08-967 Visa Waiver Program
that DHS did not give the embassy adequate advance notice—to prepare 

translated materials, brief journalists from the major media, prepare the 

embassy Web site, or set up a meeting with travel and tourism 

professionals to discuss the implications of ESTA requirements—before 

publishing the interim final rule. DHS officials told us that the department

is currently working on an outreach strategy to ensure that travelers are 

aware of the ESTA requirement. 

• Impact on air and sea carriers could be significant. DHS estimates that 8 

U.S.-based air carriers and 11 sea carriers, as well as 35 foreign-based air 

carriers and 5 sea carriers, will be affected by ESTA requirements for visa 

waiver travelers. In addition, DHS stated that it did not know how many 

passengers annually would request that their carrier apply for ESTA 

authorization on their behalf to travel under the Visa Waiver Program or 

how much it will cost carriers to modify their existing systems to 

accommodate such requests. Thus, in the short term, DHS expects that the 

carriers could face a notable burden if most of their non-U.S. passengers 

request that their carriers submit ESTA applications. On the basis of DHS’s 

analysis, ESTA could cost the carriers about $137 million to $1.1 billion 

over the next 10 years, depending on how the carriers decide to assist the 

passengers. DHS has noted that these costs to carriers are not compulsory 

because the carriers are not required to apply for an ESTA authorization 

on behalf of their visa waiver travelers. DHS is developing a separate 

system, independent from ESTA, which will enable the travel industry to 

voluntarily submit an ESTA application on behalf of a potential Visa 

Waiver Program traveler. As of early August 2008, DHS had analyzed the 

role that transportation carriers could play in applying for and submitting 

ESTA applications on behalf of their customers when they arrive at an air 

or sea port. However, CBP stated that there had been no further 

development on this issue. 

• ESTA could increase consular workload. In May 2008, we reported that 

State officials and officials at U.S. embassies in current Visa Waiver 

Program countries are concerned with how ESTA implementation will 

affect consular workload.30 Consular officers are concerned that more 

travelers will apply for visas at consular posts if their ESTA applications 

are rejected or because they may choose to apply for a visa that has a 

longer validity period (10 years) than an ESTA authorization. We reported

that if 1 percent to 3 percent of current Visa Waiver Program travelers 

 30GAO, Border Security: State Department Should Plan for Potentially Significant 

Staffing and Facilities Shortfalls Caused by Changes in the Visa Waiver Program, 

GAO-08-623 (Washington, D.C.: May 22, 2008). 

Page 22 GAO-08-967 Visa Waiver Program
came to U.S. embassies for visas, it could greatly increase visa demand at

some locations, which could significantly disrupt visa operations and 

possibly overwhelm current staffing and facilities.31 DHS officials told us 

that the department is aware of concerns regarding rejection rates and has 

been working with State to create a system that mitigates these concerns. 

• Developing a user-friendly ESTA could be difficult. According to DHS, 

the ESTA Web site will initially be operational in English; additional 

languages will be available by October 15, 2008. Even when the Web site is

operational in additional languages, ESTA will only allow travelers to fill 

out the application in English, as with CBP’s paper-based form. In 

addition, during our site visits, embassy officials expressed concerns that

some Visa Waiver Program travelers do not have Internet access and, thus, 

will face difficulties in submitting their information to ESTA.32 

Implementing a user-friendly ESTA is essential, especially for those 

travelers who do not have Internet access or are not familiar with 

submitting forms online. 

A third provision of the 9/11 Act requires that DHS implement a biometric 

air exit system before July 1, 2009, or else the department’s authority to 

waive the 3 percent refusal rate requirement—and thereby consider 

admitting countries with refusal rates between 3 percent and 10 percent—

will be suspended until this system is in place. In March 2008, DHS 

testified that US-VISIT will begin deploying biometric exit procedures in 

fiscal year 2009. DHS released a proposed rule for the biometric exit 

system in April 2008, and the department plans to issue a final rule before

the end of 2008. According to the proposed rule, air and sea carriers are to 

collect, store, and transmit to DHS travelers’ biometrics. During the public

comment period on the proposed rule, airlines, Members of Congress, and 

other stakeholders have raised concerns about DHS’s proposal, and 

resolving these concerns could take considerable time. For example, the 

airline industry strongly opposes DHS’s plans to require airline personnel 

to collect digital fingerprints of travelers departing the United States 

Implementation of Biometric 

Air Exit System before July 

2009 Will Be Difficult 

 31As of May 2008, DHS had provided State with preliminary data that suggest how many 

names might be rejected by ESTA, on the basis of rejection rates from CBP’s Advance

Passenger Information System; however, we found that DHS had not developed any 

estimates of the number of people who would choose to proactively apply for visas rather

than submit an application to ESTA. According to consular officials, the percentage of 

travelers who choose to obtain a visa could exceed potential ESTA rejection rates of 1 

percent to 3 percent. See GAO-08-623. 

32According to DHS, ESTA is designed to allow third parties to file applications on behalf of 

other persons.

Page 23 GAO-08-967 Visa Waiver Program
because it believes it is a public sector function. We have issued a series of 

reports on the US-VISIT program indicating that there is no clear schedule 

for implementation of the exit portion of the system, and that DHS will 

encounter difficulties in implementing the system by July 2009.33 Although 

DHS program officials stated that DHS is on track to implement the 

biometric exit system by July 2009, it is unlikely that DHS will meet this 

timeline. We are currently reviewing DHS’s proposed rule and plan to 

report later this year on our findings. 

Some DHS components have expanded efforts to identify citizens who 

enter the United States under the Visa Waiver Program and then overstay

their authorized period of admission. In 2004, US-VISIT established the 

Data Integrity Group, which develops data on potential overstays by 

comparing foreign nationals’ arrival records with departure records from 

U.S. airports and sea ports. US-VISIT provides data on potential overstays 

to ICE, CBP, and U.S. Citizenship and Immigration Services, as well as to 

State’s consular officers to aid in visa adjudication. For example, US-VISIT

sends regular reports to ICE’s Compliance Enforcement Unit on potential 

overstays, and ICE officials told us they use these data regularly during 

investigations. In fiscal year 2007, ICE’s Compliance Enforcement Unit 

received more than 12,300 overstay leads from the Data Integrity Group.34 

As an example of one of these leads, on November 27, 2007, ICE agents in

Ventura, California, arrested and processed for removal from the United 

States an Irish citizen whose term of admission expired in September 2006. 

On the basis of concerns that Visa Waiver Program travelers could be 

overstaying, ICE has requested that US-VISIT place additional emphasis on 

identifying potential overstays from program countries. In turn, ICE has 

received funding to establish a Visa Waiver Enforcement Program within 

the Compliance Enforcement Unit to investigate the additional leads from 

US-VISIT. As part of this funding, ICE plans to hire 46 additional 

employees to help the unit increase its focus on identifying individuals 

DHS Does Not Fully 

Consider Overstay Rates to 

Assess the Illegal 

Immigration Risks of the 

Visa Waiver Program

 33GAO, Homeland Security: Prospects For Biometric US-VISIT Exit Capability Remain 

Unclear, GAO-07-1044T (Washington, D.C.: June 28, 2007); Border Security: US-VISIT

Program Faces Strategic, Operational, and Technological Challenges at Land Ports of 

Entry, GAO-07-248 (Washington, D.C.: Dec. 6, 2006). 

34In June 2003, ICE’s Office of Investigations established the Compliance Enforcement Unit, 

which focuses on preventing criminals and terrorists from exploiting the nation’s

immigration system by developing cases for investigation on the basis of information

provided from other DHS components, including US-VISIT. 

Page 24 GAO-08-967 Visa Waiver Program
who traveled to the United States under the Visa Waiver Program and 

potentially overstayed. 

However, DHS is not fully monitoring compliance with a legislative 

provision that requires a disqualification rate (this calculation includes 

overstays) of less than 3.5 percent for a country to participate in the Visa 

Waiver Program.35 Monitoring these data is a long-standing statutory 

requirement for the program. We have testified that the inability of the U.S. 

government to track the status of visitors in the country, identify those 

who overstay their authorized period of visit, and use these data to 

compute overstay rates has been a long-standing weakness in the 

oversight of the Visa Waiver Program.36 DHS’s Visa Waiver Program Office 

reported that it does not monitor country overstay rates as part of its 

mandated, biennial assessment process for current visa waiver countries 

because of weaknesses in US-VISIT’s data.37

Since 2004, however, the Data Integrity Group has worked to improve the 

accuracy of US-VISIT’s overstay data and can undertake additional 

analyses to further validate these data. For example, using available 

resources, the group conducts analyses, by hand, of computer-generated 

overstay records to determine whether individuals identified as overstays 

by the computer matches are indeed overstays. In addition, US-VISIT 

analysts can search up to 12 additional law enforcement and immigration 

databases to verify whether a potential overstay may, in fact, be in the 

country illegally. While it receives periodic reporting on potential 

 35The disqualification rate is the total for a given fiscal year of (1) those nationals of the

country who were admitted as nonimmigrants and violated the terms of their admission—

this would include overstays—and (2) the number of foreign nationals who were denied

admission upon arrival in the United States, compared with the total number of nationals of 

that country who applied for admission as nonimmigrant visitors during the same period.

According to the visa waiver statute, the country must be terminated at the beginning of 

the 2d fiscal year following the fiscal year in which the determination of the disqualification 

rate was made. See 8 U.S.C. § 1187(f). 

36For more than 10 years, we have recommended the collection of departure information 

and the development of estimates of overstays by air. See GAO/PEMD-93-25 and 

GAO/PEMD-95-20. 

37According to DHS officials, the mandated country assessments include a placeholder for

data on overstay rates, but these data are not included in the 2003-2004 or 2005-2006 

assessments. The May 2002 Enhanced Border Security and Visa Entry Reform Act

increased the frequency—from once every 5 years to once every 2 years—of mandated 

assessments of the effect of each country’s continued participation in the Visa Waiver 

Program on U.S. security, law enforcement, and immigration interests. See

Pub. L. No. 107-173. 

Page 25 GAO-08-967 Visa Waiver Program
overstays from US-VISIT, the Visa Waiver Program Office has not 

requested that the Data Integrity Group provide validated overstay rate 

estimates from visa waiver or Road Map countries since 2005. Although 

DHS has not designated an office with the responsibility of developing 

such data for the purposes of the Visa Waiver Program, US-VISIT officials

told us that, with the appropriate resources, they could provide more 

reliable overstay data and estimated rates, by country, to the Visa Waiver

Program Office, with support from other DHS components, such as the 

Office of Immigration Statistics. For example, the Visa Waiver Program 

Office could request additional analysis for countries where the 

preliminary, computer-generated overstay rates raised concerns about 

illegal immigration risks in the program. These resulting estimates would 

be substantially more accurate than the computer-generated overstay 

rates. However, the resulting estimates would not include data on 

departures at land ports of entry. In addition, as we have previously 

mentioned, airline departure data have weaknesses.38 DHS has asserted 

that overstay data will continue to improve with the implementation of the 

biometric US-VISIT exit program. 

In addition to US-VISIT, State’s overseas consular sections develop data on

overstay rates that might be useful for assessing potential illegal 

immigration risks of the Visa Waiver Program. Specifically, some consular 

sections have conducted validation studies to determine what percentage 

of visa holders travel to the United States and potentially overstay. For 

example, at the U.S. embassy in Estonia, consular officials conducted a 

validation study in the summer of 2006 that concluded that 2.0 percent to

2.7 percent of Estonian visa holders traveling to the United States in 2005 

had potentially overstayed.39 US-VISIT overstay data, after appropriate 

analysis and in conjunction with other available data, such as validation 

studies, would provide DHS with key information to help evaluate the 

 38Due to limitations in DHS’s data, U.S. VISIT officials also noted that some individuals who 

appear in DHS’s systems as being in-country legally may actually be overstays, and that

country-specific information is not available for about 2 percent of records. 

39Validation studies are traditionally conducted over the telephone, with the embassy

contacting nationals who traveled to the United States. According to a State consular 

official, 200 posts have access to DHS’s Automated Departure Information System 

database. This database contains records of foreign nationals’ arrival and departure data

received from air and sea carrier manifests. DHS’s data will assist embassies in conducting 

validation studies and may preclude the need for telephone calls to foreign nationals, while 

also improving the accuracy of departure data assessed for these studies. Access to these 

records will allow consular posts to more accurately determine whether a foreign national 

departed the United States. 

Page 26 GAO-08-967 Visa Waiver Program
illegal immigration risks of maintaining a country’s membership or 

admitting additional countries into the Visa Waiver Program. 

In July 2006, we reported that the process for assessing and mitigating 

risks in the Visa Waiver Program had weaknesses, and that DHS was not 

equipped with sufficient resources to effectively monitor the program’s 

risks.40 For example, at the time of our report, DHS had only two full-time 

staff charged with monitoring countries’ compliance with the program’s 

requirements and working with countries seeking to join the program. We 

identified several problems with the process by which DHS was 

monitoring countries’ adherence to the program requirements, including a 

lack of consultation with key interagency stakeholders. In addition, we 

reported that DHS needed to improve its communication with officials at 

U.S. embassies so it could communicate directly with officials best 

positioned to monitor compliance with the program’s requirements, and 

report on current events and issues of potential concern in each of the 

participating countries. Also, at the time of our 2006 report, the law 

required the timely reporting of passport thefts for continued participation 

in the Visa Waiver Program, but DHS had not established or 

communicated these time frames and operating procedures to 

participating countries. In addition, DHS had not yet issued guidance on 

what information must be shared, with whom, and within what time frame. 

To address these weaknesses, we recommended that DHS take a number

of actions to better assess and mitigate risks in the Visa Waiver Program. 

As we note in table 1, DHS has taken actions to implement some of our 

recommendations, but still needs to fully implement others. In particular, 

DHS has provided the Visa Waiver Program Office with additional 

resources since our 2006 report. As of April 2008, the office had five 

additional full-time employees, and two other staff from the Office of 

Policy that devote at least 50 percent of their time to Visa Waiver Program 

tasks. In addition, staff from several other DHS components assists the 

office on a regular basis, as well as during the in-country security 

assessments for Road Map and current program countries. In response to 

our recommendation to finalize clear, consistent, and transparent 

protocols for the biennial country assessment, the Visa Waiver Program 

Office drafted standard operating procedures in November 2007 for 

conducting reviews of nominated and participating visa waiver countries. 

DHS Has Implemented 

Many of GAO’s Prior 

Recommendations Aimed 

at Improving Efforts to 

Assess and Mitigate Risks 

in the Visa Waiver Program 

 40GAO-06-854. 

Page 27 GAO-08-967 Visa Waiver Program
In addition, DHS now provides relevant stakeholders with copies of the 

most current mandated, biennial country assessments; during our visits in 

early 2008, U.S. embassy officials confirmed that the assessments are now 

accessible. Furthermore, regarding our recommendation to develop and 

communicate clear, standard operating procedures for the reporting of 

lost and stolen blank and issued passports, DHS established criteria for the 

reporting of lost and stolen passport data—including a definition of 

“timely reporting” and an explanation of to whom in the U.S. government 

countries should report—as part of the MOUs it is negotiating with 

participating and Road Map countries. 

Table 1: Status of Prior GAO Recommendations

Recommendation 

Not 

implemented

Partially 

implemented Implemented

Provide additional resources to strengthen the Visa Waiver Program Office. X 

Finalize clear, consistent, and transparent protocols for the biennial country 

assessments and provide these protocols to stakeholders at relevant 

agencies at headquarters and overseas. These protocols should provide 

timelines for the entire assessment process, including the role of a site visit, 

an explanation of the clearance process, and deadlines for completion. 

X

Create real-time monitoring arrangements, including the identification of 

visa-waiver points of contact at U.S. embassies, for all 27 participating 

countries; and establish protocols, in coordination with the appropriate 

headquarters offices, for direct communication between points of contact at 

overseas posts and DHS’s Visa Waiver Program Office. 

X

Require periodic updates from points of contact at posts in countries where

there are law enforcement or security concerns relevant to the Visa Waiver

Program. 

X

Provide complete copies of the most recent country assessments to 

relevant stakeholders in headquarters and overseas posts. 

X

Require that all Visa Waiver Program countries provide the United States 

and Interpol with nonbiographical data from lost or stolen blank and issued

passports. 

X

Develop and communicate clear standard operating procedures for the 

reporting of lost and stolen blank and issued passports, including a 

definition of “timely reporting” and to whom in the U.S. government 

countries should report. 

X

Develop and implement a plan to make Interpol’s stolen travel document 

database automatically available during primary inspection at U.S. ports of 

entry. 

X

Sources: GAO analysis of DHS data and GAO, Border Security: Stronger Actions Needed to Assess and Mitigate Risks of the Visa

Waiver Program, GAO-06-854 (Washington, D.C.: July 28, 2006).

Page 28 GAO-08-967 Visa Waiver Program
Furthermore, DHS, in coordination with the U.S. National Central Bureau, 

has initiated a system that allows DHS to screen foreign nationals arriving 

at all U.S. international airports against Interpol’s database of lost and 

stolen travel documents before the foreign nationals arrive in the country. 

Results to date indicate that the system identifies two to three instances of 

fraudulent passports per month. According to the National Central Bureau, 

Interpol’s database has intercepted passports that were not identified by 

DHS’s other screening systems. For example, on February 18, 2008, the 

Interpol database identified a Nigerian national traveling on a 

counterfeited British passport who attempted to enter the United States at 

Newark International Airport. Upon arrival, the individual was referred to 

secondary inspection and determined to be inadmissible to the United 

States. 

While DHS has taken action on many of our recommendations, it has not 

fully implemented others. We recommended that DHS require that all Visa 

Waiver Program countries provide the United States and Interpol with 

nonbiographical data from lost or stolen blank and issued passports. 

According to DHS, all current and aspiring visa waiver countries report 

lost and stolen passport information to Interpol, and many report such 

information to the United States. The 9/11 Act requires agreements 

between the United States and Visa Waiver Program countries on the 

reporting of lost and stolen passports within strict time limits; however, 

none of the current visa waiver countries have yet to formally establish 

lost and stolen passport reporting agreements by signing MOUs with DHS. 

DHS also still needs to fully implement our recommendations to create 

real-time monitoring arrangements, establish protocols for direct 

communication with contacts at overseas posts, and require periodic 

updates from these contacts. For example, while the Visa Waiver Program 

Office has recently begun communicating and disseminating relevant

program information regularly with U.S. embassy points of contact at Visa

Waiver Program posts, officials at some of the posts we visited in early 

2008 reported that they had little contact with the office and were not 

regularly informed of security concerns or developments surrounding the 

program. 

The executive branch is moving aggressively to expand the Visa Waiver 

Program in 2008 to allies in Central and Eastern Europe and South Korea, 

after the countries have met certain requirements and DHS has completed 

and certified key security requirements in the 9/11 Act. However, DHS has 

not followed a transparent process for expanding the program, thereby 

causing confusion among other U.S. agencies and embassies overseas. The 

Conclusions 

Page 29 GAO-08-967 Visa Waiver Program
lack of a clear process could bring about political repercussions if 

countries are not admitted to the program in 2008, as expected. In 

addition, DHS is not fully assessing a critical illegal immigration risk of the 

Visa Waiver Program and its expansion since it does not consider overstay 

data in its security assessments of current and aspiring countries. DHS 

should determine what additional data and refinements of that data are 

necessary to ensure that it can assess and mitigate this potential risk to the 

United States. Finally, DHS still needs to take actions to fully implement 

our prior recommendations in light of plans to expand the program. 

To improve management of the Visa Waiver Program and better assess and 

mitigate risks associated with it, we are recommending that the Secretary 

of Homeland Security take the following four actions: 

• establish a clear process, in coordination with the Departments of State 

and Justice, for program expansion that would include the criteria used to

determine which countries will be considered for expansion and timelines 

for nominating countries, security assessments of aspiring countries, and 

negotiation of any bilateral agreements to implement the program’s 

legislative requirements; 

• designate an office with responsibility for developing overstay rate 

information for the purposes of monitoring countries’ compliance with the 

statutory requirements of the Visa Waiver Program; 

• direct that established office and other appropriate DHS components to 

explore cost-effective actions necessary to further improve, validate, and 

test the reliability of overstay data; and 

• direct the Visa Waiver Program Office to request an updated, validated 

study of estimated overstay rates for current and aspiring Visa Waiver 

Program countries, and determine the extent to which additional research 

and validation of these data are required to help evaluate whether 

particular countries pose a potential illegal immigration risk to the United 

States. 

We provided a draft of this report to DHS, State, and Justice for review and 

comment. DHS provided written comments, which are reproduced in 

appendix IV, and technical comments, which we incorporated into the 

report, as appropriate. Justice also provided written comments, which are 

Recommendations for 

Executive Action 

Agency Comments 

and Our Evaluation 

Page 30 GAO-08-967 Visa Waiver Program
reprinted in appendix V. State did not provide comments on the draft 

report. 

DHS either agreed with, or stated that it was taking steps to implement, all 

of our recommendations. For example, DHS indicated that it is working 

with State to create procedures so that future Visa Waiver Program 

candidate countries are selected and designated in as transparent and 

uniform a manner as possible. In addition, DHS noted that it is taking steps 

to improve the accuracy and reliability of the department’s overstay data. 

DHS also provided additional details about its continued outreach efforts 

to the department’s interagency partners and foreign counterparts on the 

expansion process for the Visa Waiver Program. Justice did not comment 

on our recommendations, but provided additional information about the 

importance of monitoring countries’ reporting of lost and stolen passport 

data to Interpol. In addition, Justice discussed its efforts, in collaboration 

with DHS, to include screening against Interpol’s lost and stolen passport 

database as part of ESTA. Justice noted that use of Interpol’s database 

continues to demonstrate significant results in preventing the misuse of 

passports to fraudulently enter the United States. 

We are sending copies of this report to interested congressional 

committees, the Secretaries of Homeland Security and State, and the U.S. 

Attorney General. Copies of this report will be made available to others 

upon request. In addition, this report is available at no charge on the GAO 

Web site at http://www.gao.gov. 

If you or your staffs have any questions about this report, please contact 

Jess T. Ford, Director, International Affairs and Trade, at (202) 512-4128 or 

fordj@gao.gov. Contact points for our Offices of Congressional Relations 

and Public Affairs may be found on the last page of this report. Key 

contributors to this report are listed in appendix VI. 

Jess T. Ford

Director, International Affairs and Trade 

Page 31 GAO-08-967 Visa Waiver Program
Appendix I: Objectives, Scope, and Appendix I: Objectives, Scope, and Methodology 

Methodology 

To describe the process that the Department of Homeland Security (DHS) 

is following to admit countries into the Visa Waiver Program, we reviewed 

laws governing the program and its expansion, and relevant regulations 

and agency operating procedures, as well as our prior reports and 

testimonies. In particular, we reviewed DHS’s standard operating 

procedures for oversight and expansion of the Visa Waiver Program. We 

spoke with officials from the Visa Waiver Program Office, which is 

responsible for oversight of Visa Waiver Program requirements, as well as 

representatives from the Department of State’s (State) Consular Affairs, 

Europe and Eurasia, and East Asia and Pacific Bureaus. In addition, we 

visited U.S. embassies in three current visa waiver countries—France, 

Japan, and the United Kingdom—whose nationals comprise a large 

percentage annually of visa waiver travelers to the United States. We also

visited U.S. embassies in four countries—Czech Republic, Estonia, Greece, 

and South Korea—with which DHS is negotiating visa waiver status. 

During these visits, we interviewed political, economic, consular, 

commercial, and law enforcement officials regarding oversight of the Visa

Waiver Program and its expansion. We also conducted telephone 

interviews with consular officials in four additional countries—Hungary, 

Latvia, Lithuania, and Slovakia—that DHS also aims to admit into the Visa

Waiver Program in 2008. We did not interview officials in Bulgaria, Poland, 

or Romania because DHS told us that it does not anticipate that these 

countries will be admitted into the program in 2008. We did not interview 

officials in Malta because of the country’s relatively small number of 

annual Visa Waiver Program travelers to the United States. 

To assess actions taken to mitigate potential risks in the Visa Waiver 

Program, we focused on DHS’s efforts to implement the new security 

enhancements required by the 9/11 Act, as well as the recommendations 

from our July 2006 report.1

 First, to review the department’s plans for air 

exit system implementation, we collected and analyzed documentation 

and interviewed officials from DHS’s Office of Policy, Customs and Border 

Protection (CBP), and the U.S. Visitor and Immigrant Status and Indicator

Technology (US-VISIT) Program Office. We also reviewed prior GAO 

reports on immigrant and visitor entry and exit tracking systems. 

Second, to analyze plans for the implementation of the Electronic System 

for Travel Authorization (ESTA), we collected and analyzed

 1

GAO, Border Security: Stronger Actions Needed to Assess and Mitigate Risks of the Visa

Waiver Program, GAO-06-854 (Washington, D.C.: July 28, 2006). 

Page 32 GAO-08-967 Visa Waiver Program
Appendix I: Objectives, Scope, and 

Methodology 

documentation and interviewed officials from DHS’s Offices of Policy, 

Screening Coordination, and General Counsel, as well as CBP officials 

who are implementing the Web-based program. In addition, to understand 

DHS’s legal position regarding the statutory requirements for ESTA 

implementation, on May 5, 2008, we requested, in writing, DHS’s legal 

position on certain ESTA statutory requirements, which the department 

provided to us on June 6, 2008. 

Third, regarding DHS’s efforts to monitor citizens who enter the United 

States under the Visa Waiver Program and then overstay their authorized 

period of admission (referred to as “overstays”), we assessed the reliability 

of the US-VISIT data on potential overstays, which are based on air and 

sea carriers’ arrival and departure data. We reviewed documentation and

interviewed cognizant U.S. VISIT officials about how data on potential 

overstays are generated and validated. As we have previously mentioned, 

we determined that data on potential overstays that are generated 

automatically by US-VISIT’s systems have major limitations; however, 

many of these limitations could be overcome by a series of manual checks 

and validations that US-VISIT can perform, upon request. 

Fourth, to determine the status of our prior recommendations to DHS on 

oversight of the Visa Waiver Program, we developed a scale to classify 

them as (1) implemented, (2) partially implemented, or (3) not 

implemented. We collected and analyzed documentation and interviewed

officials from DHS’s Visa Waiver Program Office on the actions that office 

has taken since July 2006 to respond to our recommendations. In addition, 

we met with International Criminal Police Organization (Interpol) officials 

in Lyon, France, as well as officials from the Department of Justice’s 

Interpol-U.S. National Central Bureau to discuss the status of DHS’s access 

to Interpol’s database of lost and stolen travel documents. We concluded

that a recommendation was (1) “implemented,” if the evidence indicated 

that DHS had taken a series of actions addressing the recommendation; 

(2) “partially implemented,” if the evidence indicated that DHS had taken 

some action toward implementation; and (3) “not implemented,” if the 

evidence indicated that DHS had not taken any action. 

We conducted this performance audit from September 2007 to September 

2008 in accordance with generally accepted government auditing 

standards. Those standards require that we plan and perform the audit to

obtain sufficient, appropriate evidence to provide a reasonable basis for 

our findings and conclusions based on our audit objectives. We believe 

that the evidence obtained provides a reasonable basis for our findings 

and conclusions based on our audit objectives. 

Page 33 GAO-08-967 Visa Waiver Program
Appendix II: Worldwide Refusal Rates for 

Short-term Business and Tourism Visas, Fiscal 

Year 2007 

The Visa Waiver Program nonimmigrant visa refusal rate is based on the 

number of visitor visa applications submitted, worldwide, by nationals of 

that country. Visitor visas are issued for short-term business or pleasure 

travel to the United States. The adjusted refusal rate is calculated by first 

subtracting from the number of visas that were initially refused (referred 

to as “refusals”), the number of visas that were subsequently issued after 

further administrative consideration (referred to as “overcomes”)—or, in 

short, refusals minus overcomes (see table 2). This resulting number is 

then divided by the number of visa issuances plus refusals minus 

overcomes—that is, refusals minus overcomes divided by issuances plus

refusals minus overcomes. Adjusted visa refusal rates for nationals of Visa 

Waiver Program countries reflect only visa applications submitted at U.S. 

embassies and consulates abroad. These rates do not take into account

persons who, under the Visa Waiver Program, travel to the United States 

without visas. Visa Waiver Program country refusal rates, therefore, tend 

to be higher than they would be if the Visa Waiver Program travelers were

included in the calculation, since such travelers in all likelihood would 

have been issued visas had they applied, according to State. We are 

presenting these data to show that the countries under consideration for 

Visa Waiver Program admission do not all have refusal rates of less than 10 

percent; we did not assess the reliability of these data. 

Table 2: Worldwide Refusal Rates for Short-term Business and Tourism Visas, 

Fiscal Year 2007 

Country Adjusted refusal rate

Afghanistan 38%

Albania 50

Algeria 23

Andorra 9

Angola 13

Antigua and Barbuda 15

Argentina 4

Armenia 61

Australia 17

Austria 16

Azerbaijan 15

Bahrain 2

Bangladesh 50

Barbados 6

Belarus 26

Appendix II: Worldwide Refusal Rates for 

Short-term Business and Tourism Visas, 

Fiscal Year 2007 

Page 34 GAO-08-967 Visa Waiver Program
Appendix II: Worldwide Refusal Rates for 

Short-term Business and Tourism Visas, Fiscal 

Year 2007 

Country Adjusted refusal rate

Belgium 13

Belize 27

Benin 37

Bhutan 44

Bolivia 29

Bosnia-Herzegovina 19

Botswana 16

Brazil 10

Brunei 2

Bulgaria 14

Burkina Faso 43

Burma 50

Burundi 56

Cambodia 53

Cameroon 43

Canada 37

Cape Verde 40

Central African Republic 29

Chad 29

Chile 7

China - Mainland 21

China - Taiwan 5

Colombia 29

Comoros 25

Congo (Brazzaville) 32

Congo (Kinshasa) 35

Costa Rica 22

Cote D`Ivoire 46

Croatia 5

Cuba 53

Cyprus 2

Czech Republic 7

Denmark 11

Djibouti 22

Dominica 29

Dominican Republic 41

Ecuador 28

Page 35 GAO-08-967 Visa Waiver Program
Appendix II: Worldwide Refusal Rates for 

Short-term Business and Tourism Visas, Fiscal 

Year 2007 

Country Adjusted refusal rate

Egypt 34

El Salvador 50

Equatorial Guinea 24

Eritrea 49

Estonia 4

Ethiopia 46

Federated States of Micronesia 0

Fiji 33

Finland 16

France 8

Gabon 23

Georgia 55

Germany 10

Ghana 55

Great Britain and Northern Ireland 21

Greece 2

Grenada 27

Guatemala 54

Guinea 58

Guinea - Bissau 55

Guyana 62

Haiti 44

Honduras 38

Hong Kong (BNO HK passport) 2

Hong Kong S. A. R. 3

Hungary 10

Iceland 9

India 22

Indonesia 40

Iran 45

Iraq 45

Ireland 24

Israel 3

Italy 7

Jamaica 38

Japan 12

Jordan 39

Page 36 GAO-08-967 Visa Waiver Program
Appendix II: Worldwide Refusal Rates for 

Short-term Business and Tourism Visas, Fiscal 

Year 2007 

Country Adjusted refusal rate

Kazakhstan 12

Kenya 34

Kiribati 20

Kuwait 4

Kyrgyzstan 30

Laos 73

Latvia 12

Lebanon 25

Lesotho 40

Liberia 51

Libya 25

Liechtenstein 7

Lithuania 13

Luxembourg 6

Macau S.A.R. 10

Macedonia 36

Madagascar 14

Malawi 37

Malaysia 8

Maldives 22

Mali 56

Malta 3

Mauritania 59

Mauritius 13

Mexicoa 33

Moldova 36

Monaco 38

Mongolia 61

Morocco 24

Mozambique 18

Namibia 5

Nauru 0

Nepal 55

Netherlands 12

New Zealand 8

Nicaragua 46

Niger 53

Page 37 GAO-08-967 Visa Waiver Program
Appendix II: Worldwide Refusal Rates for 

Short-term Business and Tourism Visas, Fiscal 

Year 2007 

Country Adjusted refusal rate

Nigeria 32

Norway 9

Oman 4

Pakistan 40

Palestinian Authority 56

Panama 26

Papua New Guinea 12

Paraguay 18

Peoples Republic of Korea - North Korea 14

Peru 44

Philippines 32

Poland 25

Portugal 8

Qatar 2

Republic of Palau 0

Republic of the Marshall Islands 3

Romania 38

Russia 12

Rwanda 47

Samoa 29

San Marino 40

Sao Tome and Principe 10

Saudi Arabia 6

Senegal 61

Serbia 64

Serbia and Montenegro 23

Seychelles 19

Sierra Leone 43

Singapore 9

Slovakia 12

Slovenia 7

Solomon Islands 5

Somalia 52

South Africa 6

South Korea 4

Spain 7

Sri Lanka 28

Page 38 GAO-08-967 Visa Waiver Program
Appendix II: Worldwide Refusal Rates for 

Short-term Business and Tourism Visas, Fiscal 

Year 2007 

Country Adjusted refusal rate

St. Kitts and Nevis 21

St. Lucia 27

St. Vincent and The Grenadines 23

Sudan 34

Suriname 11

Swaziland 19

Sweden 8

Switzerland 7

Syria 36

Tajikistan 30

Tanzania 21

Thailand 17

The Bahamas 5

The Gambia 57

Timor-Leste 0

Togo 48

Tonga 45

Trinidad and Tobago 20

Tunisia 24

Turkey 15

Turkmenistan 49

Tuvalu 12

Uganda 43

Ukraine 38

United Arab Emirates 5

Unknown place of birth or stateless 42

Uruguay 12

Uzbekistan 71

Vanuatu 25

Vatican City 0

Venezuela 19

Vietnam 36

Yemen 64

Zambia 46

Zimbabwe 32

Source: Department of State. 

a

Includes applications for both B visas and combination B-1/B-2/Mexican Border Crossing Cards. 

Page 39 GAO-08-967 Visa Waiver Program
Appendix III: Key Legislative Requirements Appendix III: Key Legislative Requirements for Inclusion in the Visa Waiver Program 

for Inclusion in the Visa Waiver Program 

The Immigration Reform and Control Act of 1986 created the Visa Waiver 

Program as a pilot program.1 In 2000, the program became permanent 

under the Visa Waiver Permanent Program Act.2 In 2002, we reported on 

the legislative requirements to which countries must adhere before they 

are eligible for inclusion in the Visa Waiver Program.3

 In general, the 

requirements are as follows: 

• A low nonimmigrant visa refusal rate. To qualify for visa waiver status, a 

country must maintain a refusal rate of less than 3 percent for its citizens 

who apply for business and tourism visas. If DHS certifies that it has met 

certain requirements under the 9/11 Act, it will have the authority to waive 

the 3 percent refusal rate requirement—currently up to a maximum of 10 

percent—provided that the country meets other security requirements. 

• A machine-readable passport program. The country must certify that it 

issues machine-readable passports to its citizens. As of June 26, 2005, all 

travelers are required to have a machine-readable passport to enter the 

United States under this program. 

• Reciprocity. The country must offer visa-free travel for U.S. citizens. 

Persons entering the United States under the Visa Waiver Program must 

• have a valid passport issued by the participating country and be a national 

of that country;4

• be seeking entry for 90 days or less as a temporary visitor for business or 

tourism; 

• have been determined by CBP at the U.S. port of entry to represent no 

threat to the welfare, health, safety, or security of the United States; 

 1

Pub. L. No. 99-603. 

2

Pub. L. No. 106-396. 

3

GAO, Border Security: Implications of Eliminating the Visa Waiver Program, 

GAO-03-38 (Washington, D.C.: Nov. 22, 2002).

4

All passports issued to visa waiver travelers after October 26, 2006, must be electronic. 

Travelers with passports issued after the deadline that do not meet these requirements 

must obtain a visa from a U.S. embassy or consulate overseas before departing for the

United States. 

Page 40 GAO-08-967 Visa Waiver Program
Appendix III: Key Legislative Requirements 

for Inclusion in the Visa Waiver Program 

• have complied with conditions of any previous admission under the 

program (e.g., individuals must have stayed in the United States for 90 

days or less during prior visa waiver visits); 

• if entering by air or sea, possess a round-trip transportation ticket issued 

by a carrier that has signed an agreement with the U.S. government to 

participate in the program, and must have arrived in the United States 

aboard such a carrier; and 

• if entering by land, have proof of financial solvency and a domicile abroad 

to which they intend to return. 

Page 41 GAO-08-967 Visa Waiver Program
Appendix IV: Comments from the Department Appendix IV of Homeland Security : Comments from the 

Department of Homeland Security 

Note: GAO comments 

supplementing those in 

the report text appear at 

the end of this appendix. 

Page 42 GAO-08-967 Visa Waiver Program
Appendix IV: Comments from the Department 

of Homeland Security

See comment 1. 

Page 43 GAO-08-967 Visa Waiver Program
Appendix IV: Comments from the Department 

of Homeland Security

See comment 2. 

See comment 3. 

Page 44 GAO-08-967 Visa Waiver Program
Appendix IV: Comments from the Department 

of Homeland Security

Page 45 GAO-08-967 Visa Waiver Program
Appendix IV: Comments from the Department 

of Homeland Security

See comment 4. 

See comment 5. 

See comment 6. 

Page 46 GAO-08-967 Visa Waiver Program
Appendix IV: Comments from the Department 

of Homeland Security

Page 47 GAO-08-967 Visa Waiver Program
Appendix IV: Comments from the Department 

of Homeland Security

Following are GAO’s comments on the Department of Homeland 

Security’s letter dated August 27, 2008. 

1. We disagree that the department followed a transparent process for 

expansion of the program. As we state in our report, State and Justice 

officials told us that the lack of a transparent timeline and 

requirements for Visa Waiver Program expansion has led to confusion 

among U.S. agencies in headquarters’ offices and at U.S. embassies 

overseas, as well as foreign governments seeking to join the program. 

Moreover, absent clear direction from DHS, U.S. embassy officials in 

several aspiring countries told us that it had been difficult to explain 

the expansion process to their foreign counterparts and manage their 

expectations about when those countries might be admitted into the 

Visa Waiver Program. Therefore, we recommend in this report that 

DHS establish a clear process, in coordination with State and Justice, 

for program expansion. DHS noted that it is currently working to 

create procedures so that future candidate countries are selected and

designated in as transparent and uniform a manner as possible and 

expectations are appropriately managed during the process. 

GAO Comments 

2. Aside from the 13 Road Map countries identified in 2005, State officials 

told us that they lacked a clear rationale to explain to other aspiring, 

non-Road Map countries with refusal rates under 10 percent (Croatia, 

Israel, and Taiwan) that they will not be considered in 2008 due to the 

executive branch’s plans to expand the program first to South Korea 

and countries in Central and Eastern Europe. DHS noted that it is 

currently working to create procedures so that future candidate 

countries are selected and designated in as transparent and uniform a 

manner as possible and expectations are appropriately managed 

during the process. 

3. We have updated the report to indicate that ESTA began accepting 

voluntary applications from visa waiver travelers on August 1, 2008. 

However, DHS does not anticipate that ESTA authorizations will be 

mandatory for visa waiver travelers until after January 12, 2009. As we 

state in our report, and as DHS noted, the department has not yet 

certified that it can verify the departure of not less than 97 percent of 

foreign nationals exiting U.S. airports, or that an Electronic System for 

Travel Authorization (ESTA) for screening visa waiver travelers in 

advance of their travel is “fully operational.” Moreover, DHS has not 

yet implemented a biometric air exit system at U.S. airports. Thus, 

DHS has not yet fully developed the tools to assess and mitigate risks 

in the Visa Waiver Program. 

Page 48 GAO-08-967 Visa Waiver Program
Appendix IV: Comments from the Department 

of Homeland Security

4. In July 2006, we reported that DHS needed to improve its 

communication with officials at U.S. embassies so it could 

communicate directly with officials best positioned to monitor 

compliance with the program’s requirements, and report on current 

events and issues of potential concern in each of the participating 

countries. Therefore, we recommended that DHS establish points of 

contact at U.S. embassies and develop protocols to ensure that the 

Visa Waiver Program Office receives periodic updates in countries 

where there are security concerns. As we note in this report, the Visa 

Waiver Program Office has recently begun communicating and 

disseminating relevant program information regularly with U.S. 

embassy officials at Visa Waiver Program posts. However, despite our 

requests during the course of this review—and again following our 

receipt of DHS’s formal comments on the draft of this report—the 

department has not provided us with sufficient documentation to 

demonstrate that it has established points of contact at U.S. embassies 

for all 27 participating countries or established protocols for 

communications between these contacts and the Visa Waiver Program 

Office. Furthermore, the department has not provided us with 

documentation to demonstrate that established points of contact are 

reporting periodically to the Visa Waiver Program Office. Therefore, 

we cannot conclude that these 2006 recommendations are fully 

implemented. 

5. DHS noted that it has not yet signed memorandums of understanding 

(MOU) with any of the 27 current Visa Waiver Program countries. 

Because the MOUs will commit all signatories to report to Interpol or 

otherwise make available to the United States information about lost 

and stolen blank and issued passports, this recommendation will 

remain open until all MOUs are finalized. 

6. To verify the departure of not less than 97 percent of foreign nationals 

exiting U.S. airports, DHS reported to us in December 2007 that it will 

match records, reported by airlines, of visitors departing the country 

with the department’s existing records of any prior arrivals, 

immigration status changes, or prior departures from the United 

States. In January 2008, the Assistant Secretary for Policy 

Development made this statement, which corroborated data that we 

received from US-VISIT in late October 2007. At the time of our 

February 2008 testimony,1 DHS confirmed to us that it planned to 

 1

GAO, Visa Waiver Program: Limitations with Department of Homeland Security’s Plan

to Verify Departure of Foreign Nationals, GAO-08-458T (Washington, D.C.: Feb. 28, 2008).

Page 49 GAO-08-967 Visa Waiver Program
Appendix IV: Comments from the Department 

of Homeland Security

employ a methodology that begins with departure records; however, as 

DHS indicated in its written comments on a draft of this report, it has 

still not decided on a final methodology. DHS has not provided us with 

information on any other options that it might be considering to meet 

this provision. Furthermore, the department has not explained how 

and when it intends to validate these data. 

Page 50 GAO-08-967 Visa Waiver Program
Appendix V: Comments from the Department Appendix V of Justice : Comments from the Department 

of Justice 

Page 51 GAO-08-967 Visa Waiver Program
Appendix V: Comments from the Department 

of Justice 

Page 52 GAO-08-967 Visa Waiver Program
Appendix VI: 

A

GAO Contact and Staff 

cknowledgments 

Page 53 GAO-08-967

Appendix VI: GAO Contact and Staff 

Acknowledgments 

Jess T. Ford, (202) 512-4128, or fordj@gao.gov

In addition to the individual named above, John Brummet, Assistant 

Director; Teresa Abruzzo; Kathryn Bernet; Joseph Carney; Martin de 

Alteriis; Etana Finkler; Eric Larson; and Mary Moutsos made key 

contributions to this report. 

Visa Waiver Program

GAO Contact 

Staff 

Acknowledgments 

(320540) 
GAO’s Mission The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost

is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts 

newly released reports, testimony, and correspondence on its Web site. To

have GAO e-mail you a list of newly posted products every afternoon, go 

to www.gao.gov and select “E-mail Updates.” 

The first copy of each printed report is free. Additional copies are $2 each. 

A check or money order should be made out to the Superintendent of 

Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 

more copies mailed to a single address are discounted 25 percent. Orders 

should be sent to: 

U.S. Government Accountability Office 

441 G Street NW, Room LM 

Washington, DC 20548 

To order by Phone: Voice: (202) 512-6000 

TDD: (202) 512-2537 

Fax: (202) 512-6061 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470 

Ralph Dawn, Managing Director, dawnr@gao.gov, (202) 512-4400 

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, DC 20548 

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800 

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Mail or Phone 

To Report Fraud,

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Public Affairs 

PRINTED ON RECYCLED PAPER