Border Security: Joint, Coordinated Actions by State and DHS Needed to Guide Biometric Visas and Related Programs
Published: 2004-09-09T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Since September 11, 2001, the U.S. government has made a concerted effort to strengthen border security by enhancing visa issuance policies and procedures, as well as expanding screening of the millions of foreign visitors who enter the United States annually. Consistent with the 9/11 Commission report that recommends a biometric entry-exit screening system for travelers, the Department of State's biometric program complements the Department of Homeland Security's (DHS) United States Visitor and Immigrant Status Indicator Technology (US-VISIT) program--a governmentwide program to better control and monitor the entry, visa status, and exit of visitors. GAO was asked to present the findings of its report on State's Biometric Visa Program, as well as discuss other aspects of visa processing and border security that require coordinated, joint actions by State and DHS.
section_title: What GAO Found
paragraphs: Our report issued today finds that State is implementing the Biometric Visa Program on schedule and will likely meet the October 26, 2004, deadline for issuing visas that include biometric indicators, as mandated by Congress. As of September 1, 2004, State had installed program hardware and software at 201 visa issuing posts overseas and plans to complete the installation at the remaining 6 posts by September 30. Technology installation has progressed smoothly, however State and DHS have not provided comprehensive guidance to consular posts on when and how information from the DHS Automated Biometric Identification System (IDENT) on visa applicants should be considered by adjudicating consular officers. In the absence of such guidance, we found that these officers are unclear on how best to use the biometric program and IDENT information. Since September 11, State and DHS have made many improvements to visa issuance and border security policies. Nevertheless, in prior reports, we have found additional vulnerabilities that need to be addressed through joint, coordinated actions. For example, DHS has not adequately defined the operational context for US-VISIT, which affects the biometric program. In addition, we identified systemic weaknesses in information sharing between State and DHS in the visa revocation process. Moreover, we found related weaknesses in an interagency security check process aimed to prevent the illegal transfer of sensitive technologies.

section_title: Letter
paragraphs: We are pleased to be here to discuss our report being issued today on the  Department of State’s Biometric Visa Program, which requires that all  persons applying for U.S. visas have certain biometrics (in this case,  fingerprints) and digital photographs collected during the visa application  process and cleared through the Department of Homeland Security’s  (DHS) Automated Biometric Identification System (IDENT) before  receiving a visa. In addition, we will discuss several previous GAO reports  that highlight the need for joint, coordinated efforts by State and DHS on  programs to enhance border security and visa processes.
Since September 11, 2001, the U.S. government has made a concerted  effort to strengthen border security by enhancing visa issuance policies  and procedures, as well as improving the screening of the millions of  foreign visitors who enter, stay in, and exit the United States annually.  State’s Biometric Visa Program complements the DHS-run United States  Visitor and Immigrant Status Indicator Technology (US-VISIT) program—a  governmentwide program that collects, maintains, and shares information  on foreign nationals to better control and monitor the entry, visa status,  and exit of visitors. The Biometric Visa Program prescreens visa  applicants at U.S. consulates overseas to ensure that they are qualified to  obtain visas, while the US-VISIT program, among other things, verifies that  the same person who applied for a visa is the one who is entering the  United States using that visa. The biometric program is consistent with  the July 2004 9/11 Commission report, which recommends using  biometric identifiers for border and transportation systems and a  biometric entry-exit screening system for travelers.
Our statement today will focus on border security programs requiring  joint, coordinated efforts by State and DHS. We will first discuss our  observations of State’s Biometric Visa Program. In addition, based on prior  GAO reports, we will discuss some of our findings and our  recommendations that called for coordinated efforts between DHS and  State to improve other aspects the nonimmigrant visa process (NIV) and  border security, including US-VISIT.
subsections: section_title: Background
paragraphs: State’s $162 million Biometric Visa Program is designed to work hand-in- hand with the DHS multibillion-dollar US-VISIT program. Both programs  aim to improve U.S. border security by verifying the identity of persons  entering the United States. Both programs rely on the DHS Automated  Biographic Identification System, known as IDENT, which is a repository  of fingerprints and digital photographs of persons who either have applied  for U.S. visas since the inception of the program in September 2003, have  entered the United States at one of 115 air or 14 sea ports of entry since  January 2004, or are on a watch list—whether for previous immigration  violations or as part of the FBI’s database of terrorists and individuals with  felony convictions.
subsections: section_title: Biometric Process at U.S. Consulates Overseas
paragraphs: The process for determining who will be issued a visa consists of several  steps. When a person applies for a visa at a U.S. consulate, a fingerprint  scan is taken of his right and left index fingers. These prints are then  transmitted from the overseas post through servers at State to DHS’s  IDENT system, which searches its records and sends a response back  through State to the post. A “hit” response—meaning that a match to  someone previously entered in the system was found—prevents the post’s  computer system from printing a visa for the applicant until the  information is reviewed and cleared by a consular officer. According to  State data, the entire process generally takes about 30 minutes. If the  computer cannot determine if two sets of prints match, IDENT refers the  case to DHS fingerprint experts, who have up to 24 hours to return a  response to State (see fig. 1).
section_title: United States Visitor and Immigrant Status Indicator Technology Program
paragraphs: US-VISIT aims to enhance national security, facilitate legitimate trade and  travel, contribute to the integrity of the U.S. immigration system, and  adhere to U.S. privacy laws and policies by    collecting, maintaining, and sharing information on certain foreign  nationals who enter and exit the United States; identifying foreign nationals who (1) have overstayed or violated the terms  of their visit; (2) can receive, extend, or adjust their immigration status; or  (3) should be apprehended or detained by law enforcement officials;   detecting fraudulent travel documents, verifying traveler identity, and  determining traveler admissibility through the use of biometrics; and facilitating information sharing and coordination among appropriate  agencies.
The process by which a foreign national is screened for entry is as follows:  When a foreign national arrives at a port of entry to the United States, a  DHS inspector scans the machine-readable travel documents. Existing  records on the foreign national, including biographic lookout hits are  returned. The computer presents available biographic information and a  photograph and determines whether IDENT contains existing fingerprints  for the foreign national. The inspector then scans the foreign national’s  fingerprints (left and right index fingers) and takes a photograph. This  information is checked against stored fingerprints in IDENT. If no  matching prints are in IDENT, the foreign national is enrolled in US-VISIT  (i.e., biographic and biometric data are entered). If the foreign national’s  fingerprints are already in IDENT, the system performs a comparison of  the fingerprint taken at the port of entry to the one on file to confirm that  the person submitting the fingerprints is the person on file. If the system  finds a mismatch of fingerprints or a watch list hit, the foreign national is  held for further screening or processing.
section_title: Biometric Visa Implementation Nearing Completion, but Some Guidance Still Needed
paragraphs: State’s implementation of the technology aspects of the biometric visa  program is currently on schedule to meet the October 26, 2004, deadline.  According to State officials, a well-planned rollout of equipment and  software and fewer technical problems than anticipated led to smooth  implementation of the technological aspects of the program at the 201  posts that had the program operating as of September 1, 2004. But amid  the fast pace of rolling out the program to meet the deadline, DHS and  State have not provided comprehensive guidance for consular posts on  how the information about visa applicants made available through the  Biometric Visa Program should best be used to help adjudicate visas.  Indeed, we found several significant differences in the implementation of  the biometric program during our visits to San Salvador, El Salvador, and  Santo Domingo, Dominican Republic. State acknowledged that posts may  be implementing the program in various ways across the 207 consular  posts that issue nonimmigrant visas.
subsections: section_title: State Expects to Meet Implementation Deadline
paragraphs: According to State officials, the implementation process for the biometric  program led to far fewer technical problems than expected. Early on, State  had a few difficulties in transmitting data between the posts and DHS’s  IDENT, primarily related to server and firewall (computer security) issues.  According to State, most issues were resolved within a few days. In fact,  201 nonimmigrant visa (NIV)-issuing posts out of 207 had the software and  hardware installed and were transmitting prints to IDENT for analysis as  of September 1, 2004. State anticipates the completion of the installation  by the October 2004 deadline.
section_title: Fingerprinting Raising Issues in Visa Process
paragraphs: According to State’s data, from February to August 2004, the total  biometric visa process averaged about 30 minutes for an applicant’s prints  to be sent from an overseas post to the State server, and on to DHS for  IDENT analysis and then for the response to be returned through State’s  server to the posts. IDENT response time could affect visa issuance times  because a visa cannot be issued until the post has received and reviewed  the IDENT response. Our observations at posts in San Salvador and Santo  Domingo demonstrated the importance of the length of time required to  receive an IDENT response. We observed that most interviews average  only a few minutes, but the IDENT response time currently is 30 minutes.  Thus, if interviewing officers collect prints during the interview, the  interview would be completed before the IDENT response would be  available to consular officers. Since the visa cannot be issued until the  IDENT information is considered by the consulate, potential delays in the  IDENT response times could have a major effect on the visa issuance  process and inconvenience visa applicants. State has encouraged consular  officials to issue visas the day after interviews since part of the visa  process now relies on another agency’s system. This will require  significant changes for posts such as Santo Domingo, which still issues  same-day visas.
section_title: Guidance Lagging for Program Implementation
paragraphs: State has focused on implementing the Biometric Visa Program by the  mandated deadline; however, our report identifies certain lags in guidance  on how the program should be implemented at consular posts. State and  DHS have not yet provided to posts details of how all aspects of the  program will be implemented, including who should scan fingerprints,  where and who should review information about applicants returned from  IDENT, and response times for the IDENT system. In addition, DHS and  State have not provided comprehensive guidance for consular posts on  how the information about visa applicants made available through the  Biometric Visa Program should be used to help adjudicate visas.
We believe that it is important for State and DHS to articulate how the  program could best be implemented, providing a roadmap for posts to  develop implementation plans that incorporate the guidance. We  recognize, however, that the workload, personnel and facility resources  vary considerably from post to post. As a result, each post may not be able  to easily implement the Biometric Visa Program according to a precise set  of guidelines. However, posts could develop procedures to implement the  guidance, identify resource and facility constraints, and implement  mitigating actions to address their own unique circumstances. Therefore,  we have recommended that DHS and State provide comprehensive  guidance to consular posts on how information about visa applicants that  is now available from IDENT should be used to help adjudicate visas. In  responding to our recommendation, DHS generally concurred and State  acknowledged that there may be a lag in guidance.
subsections: section_title: Program Implementation Varies at Consular Posts
paragraphs: Our work at two posts shows that, because they lack specific guidance on  the system’s use, consular officers at these overseas posts are uncertain  how they should implement the Biometric Visa Program and are currently  using the returned IDENT responses in a variety of ways. For example, we  found that, in cases in which the IDENT response information is available  to the overseas post by the time of the visa applicant interview, some  consular officers who conduct interviews review information before the  interview, some review it during the interview, and some rely instead on a  designated officer or the line chief to review the information after the  interview is completed and before affected visas are printed.
We found several differences in the visa operations at two posts—San  Salvador, El Salvador, and Santo Domingo, Dominican Republic—that  handle a large volume of visa applications. For example,    San Salvador, one of the first posts to begin implementing the program in  September 2003, has a large new embassy complex that allowed the post  great flexibility in implementing the collection of biometrics. Applicants  are led through outdoor security screening before entering the interview  waiting room. Once in the waiting room, they immediately proceed to a  fingerprint scanning window where an American officer verifies their  names and photographs and scans their fingerprints. By the time they  arrive at their interview windows, usually the interviewing officer has  received their IDENT responses. However, the post has designated one  officer to review all of the IDENT responses, so some interviewing officers  do not take the time to review IDENT information on those they interview  even if the information is available at the time of the interview.
Santo Domingo’s consular section is hampered by significant facility  constraints. The NIV applicant waiting area is very cramped and has been  even more restricted over recent months due to construction efforts. Some  of the NIV applicants are forced to share space in the immigrant visa  waiting area. Santo Domingo has fewer interviewing windows than San  Salvador and cannot easily spare one to designate for fulltime fingerprint  scanning due to high interview volume. Some interviewing officers scan  applicants’ fingerprints at the time of the interview, so the interview ends  before the IDENT response has been returned from DHS. One consular  officer is designated to review the IDENT responses for all of the  applicants, and interviewing officers may not see IDENT information on  the applicants they interview. In some cases, the designated officer  determines if the applicant should receive a visa, and in others he brings  the IDENT information back to the original interviewing officer for the  case for further review.
section_title: Joint, Coordinated Actions by State and DHS Required on Many Aspects of Visa Processing and Border Security
paragraphs: Since September 11, 2001, we have issued reports recommending that  State and DHS work together to improve several aspects of border  security and the visa process, as described below. These reports show the  importance of joint, coordinated actions by State and DHS to maximize  program effectiveness.
subsections: section_title: US-VISIT Operating at Selected Points of Entry, but DHS Further Defining its Operational Context
paragraphs: The US-VISIT program supports a multifaceted, critical mission: to help  protect approximately 95,000 miles of shoreline and navigable waterways  through inspections of foreign nationals at U.S. ports of entry. DHS has  deployed an initial operating capability for entry to 115 airports and 14  seaports. It has also deployed an exit capability, as a pilot, at two airports  and one seaport. Since becoming operational, DHS reports that more than  eight million foreign nationals have been processed by US-VISIT at ports  of entry, resulting in hundreds being denied entry. Its scope is large and  complex, connecting 16 existing information technology systems in a  governmentwide process involving multiple departments and agencies. In  addition to these and other challenges, the program’s operational context,  or homeland security enterprise architecture, is not yet adequately  defined.
DHS released an initial version of its enterprise architecture in September  2003; however, we found that this architecture was missing, either  partially or completely, all the key elements expected in a well-defined  architecture, such as descriptions of business processes, information  flows among these processes, and security rules associated with these  information flows. DHS could benefit from such key elements to help  clarify and optimize the relationships between US-VISIT and other  homeland security programs operations, such as State’s Biometric Visa  Program, both in terms of processes and the underlying information  technology infrastructure and applications. Although the biometrics  program is administered by State, it falls under the overall visa policy area  of the DHS Directorate of Border and Transportation Security, and is part  of our national homeland security mission. State officials indicated that  they are waiting for DHS to further define US-VISIT, which would help  guide State’s actions on the Biometric Visa Program.
section_title: Aspects of NIV Process Require State and DHS Cooperation
paragraphs: Since September 11, 2001, our work has demonstrated the need for State  and DHS to work together to better address potential vulnerabilities in the  visa process. In June 2003, we identified systemic weaknesses in the visa  revocation process, many of which were the result of a failure to share and  fully utilize information. We reported that the visa revocation process was  not used aggressively to share information among agencies on individuals  with visas revoked on terrorism grounds. It also broke down when these  individuals had already entered the United States prior to revocation.  Immigration officials and the Federal Bureau of Investigation (FBI) were  not then routinely taking actions to investigate, locate, or resolve the cases  of individuals who remained in the United States after their visas were  revoked. Therefore, we recommended that DHS, in conjunction with the  Departments of State and Justice, develop specific policies and procedures  to ensure that appropriate agencies are notified of revocations based on  terrorism grounds and take proper actions.
In July 2004, we followed up on our findings and recommendations  regarding interagency coordination in the visa revocation process and  found that State and DHS had taken some actions in the summer of 2003 to  address these weaknesses. However, our review showed that some  weaknesses remained. For instance, in some cases State took a week or  longer to notify DHS that individuals with revoked visas might be in the  country. Without these notifications, DHS may not know to investigate  those individuals. Given outstanding legal and policy issues regarding the  removal of individuals based solely on their visa revocation, we  recommended that the Secretaries of Homeland Security and State jointly  (1) develop a written governmentwide policy that clearly defines roles and  responsibilities and sets performance standards and (2) address  outstanding legal and policy issues in this area or provide Congress with  specific actions it could take to resolve them. State agreed to work  together with DHS to address these recommendations.
In February 2004, we reported that the time it takes to adjudicate a visa for  a science student or scholar depends largely on whether an applicant must  undergo a security check known as Visas Mantis, which is designed to  protect against sensitive technology transfers. Based on a random sample  of Visas Mantis cases for science students and scholars, we found it took  an average of 67 days for the interagency security check to be processed  and for State to notify the post. We also found that the way in which Visas  Mantis information was disseminated at headquarters made it difficult to  resolve some cases expeditiously. Finally, consular staff at posts we  visited stated that they lacked clear guidance on the Visas Mantis program.  While State and FBI officials acknowledged there had been lengthy waits,  they reported having measures under way to improve the process and to  identify and resolve outstanding Visas Mantis cases. We recommended  that the Secretary of State, in coordination with the Director of the FBI  and the Secretary of Homeland Security, develop and implement a plan to  improve the Visas Mantis process. We are currently reviewing the  measures these agencies have taken to improve the Visas Mantis program  made since our February report and will report on our findings at the  beginning of next year.
Overall, we have reported on a number of areas in which joint,  coordinated actions by DHS and State are needed to improve border  security and visa processing. In commenting in our report of State’s  biometric program, both DHS and State have pledged their commitment to  continued cooperation and joint actions. Indeed, these agencies are  currently working together as part of the US-VISIT program. For example,  State participates in two DHS-led groups designed to oversee and manage  the US-VISIT program. First, State participates on the US-VISIT Federal  Stakeholders Advisory Board, which provides guidance and direction to  the US-VISIT program. State also participates as part of the US-VISIT  Integrated Project Team, which meets weekly to discuss, among other  things, operational issues concerning the deployment of US-VISIT.
section_title: Conclusion
paragraphs: Mr. Chairman, overall, our work has demonstrated that coordinated, joint  actions by State and DHS are critical for homeland and border security.  State and DHS have worked together to roll out the biometric technology  to consular posts worldwide on schedule. Moreover, their cooperation on  US-VISIT will be critical to ensure that information is available to  consulates to adjudicate visa applications and prevent persons from  unlawfully entering the United States. However, they have not yet  provided comprehensive guidance to the posts on how the program and  biometric information should be used to adjudicate visas. We recognize  that it may not be feasible for each post to implement biometric visas in  the same way, given the variances among posts in workload, security  concerns with the applicant pool, facilities, and personnel. However,  guidance to posts on how to best implement the program, including best  practices, would enable posts to develop operating procedures, identify  resource needs, and implement mitigating actions to address the unique  circumstances at each post.
Therefore we have recommended that the Secretaries of Homeland  Security and State develop and provide comprehensive guidance to  consular posts on how best to implement the Biometric Visa Program. The  guidance should address the planned uses for the information generated  by the Biometric Visa Program at consular posts including directions to  consular officers on when and how information from the IDENT database  on visa applicants should be considered. Further, we have recommended  that the Secretary of State direct consular posts to develop an  implementation plan based on this guidance. DHS generally concurred  with our recommendations, stating that GAO’s identification of areas  where improvements are needed in the Biometric Visa Program will  contribute to ongoing efforts to strengthen the visa process. State  acknowledged that there may be a lag in guidance. Regarding US-VISIT,  we made an earlier recommendation that the Secretary for Homeland  Security clarify the operational context in which US-VISIT is to operate.  DHS agreed with our recommendation and plans to issue the next version  of their enterprise architecture in September of 2004. This is an essential  component in establishing biometric policy and creating consistency  between the DHS-run US-VISIT program and State’s Biometric Visa  program.
Mr. Chairman, this concludes my prepared statement. I would be pleased  to answer any questions you or other members of the committee may  have.
section_title: Contacts and Acknowledgments
paragraphs: For questions regarding this testimony, please call Jess Ford at (202) 512- 4128. Other key contributors to this statement include John Brummet,  Sharron Candon, Deborah Davis, Kathryn Hartsburg, David Hinchman, and  David Noone.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. It may be reproduced and distributed in its entirety without further  permission from GAO. However, because this work may contain copyrighted images or  other material, permission from the copyright holder may be necessary if you wish to  reproduce this material separately.