Visa Security: Additional Actions Needed to Strengthen Overstay Enforcement and Address Risks in the Visa Process
Published: 2011-09-13T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The attempted bombing of an airline on December 25, 2009, by a Nigerian citizen with a valid U.S. visa renewed concerns about the security of the visa process. Further, unauthorized immigrants who entered the country legally on a temporary basis but then overstayed their authorized periods of admission--overstays--could pose homeland security risks. The Department of Homeland Security (DHS) has certain responsibilities for security in the visa process and for addressing overstays. DHS staff review visa applications at certain Department of State overseas posts under the Visa Security Program. DHS also manages the Visa Waiver Program through which eligible nationals from certain countries can travel to the United States without a visa. This testimony is based on GAO products issued in November 2009, August 2010, and from March to May 2011. As requested, this testimony addresses the following issues: (1) overstay enforcement efforts, (2) efforts to implement a biometric exit system and challenges with the reliability of overstay data, and (3) challenges in the Visa Security and Visa Waiver programs.
section_title: What GAO Found
paragraphs: Federal agencies take actions against a small portion of the estimated overstay population, but strengthening planning and assessment of overstay efforts could improve enforcement. Within DHS, U.S. Immigration and Customs Enforcement's (ICE) Counterterrorism and Criminal Exploitation Unit (CTCEU) is the lead agency responsible for overstay enforcement. CTCEU arrests a small portion of the estimated overstay population in the United States because of, among other things, ICE's competing priorities, but ICE expressed an intention to augment its overstay enforcement resources. From fiscal years 2006 through 2010, ICE reported devoting about 3 percent of its total field office investigative hours to CTCEU overstay investigations. ICE was considering assigning some responsibility for noncriminal overstay enforcement to its Enforcement and Removal Operations directorate, which apprehends and removes aliens subject to removal from the United States. In April 2011, GAO reported that by developing a time frame for assessing needed resources and using the assessment findings, as appropriate, ICE could strengthen its planning efforts. Moreover, in April 2011, GAO reported that CTCEU tracked various performance measures, but did not have a mechanism to assess the outcomes of its efforts. GAO reported that by establishing such a mechanism, CTCEU could better ensure that managers have information to assist in making decisions. DHS has not yet implemented a comprehensive biometric system to match available information (e.g., fingerprints) provided by foreign nationals upon their arrival and departure from the United States and faces reliability issues with data used to identify overstays. GAO reported that while the United States Visitor and Immigrant Status Indicator Technology Program's biometric entry capabilities were operating at ports of entry, exit capabilities were not, and DHS did not have a comprehensive plan for biometric exit implementation. DHS conducted pilots to test two scenarios for an air exit solution in 2009, and in August 2010, GAO concluded that the pilots' limitations, such as limitations not defined in the pilot evaluation plan like suspending exit screening at departure gates to avoid flight delays, curtailed DHS's ability to inform a decision for a long-term exit solution. Further, in April 2011, GAO reported that there is not a standard mechanism for nonimmigrants departing the United States through land ports of entry to remit their arrival and departure forms. Such a mechanism could help DHS obtain more complete departure data for identifying overstays. GAO identified various challenges in the Visa Security and Visa Waiver programs related to planning and assessment efforts. For example, in March 2011, GAO found that ICE developed a plan to expand the Visa Security Program to additional high-risk posts, but ICE had not fully adhered to the plan or kept it up to date. Further, ICE had not identified possible alternatives that would provide the additional security of Visa Security Program review at those high-risk posts that do not have a program presence. In addition, DHS implemented the Electronic System for Travel Authorization (ESTA) to meet a statutory requirement intended to enhance Visa Waiver Program security and took steps to minimize the burden on travelers to the United States added by the new requirement. However, DHS had not fully evaluated security risks related to the small percentage of Visa Waiver Program travelers without verified ESTA approval.
section_title: What GAO Recommends
paragraphs: GAO has made recommendations in prior reports that, among other things, call for DHS to strengthen management of overstay enforcement efforts, mechanisms for collecting data from foreign nationals departing the United States, and planning for addressing certain Visa Security and Visa Waiver programs' risks. DHS generally concurred with these recommendations and has actions planned or underway to address them.

section_title: Letter
paragraphs: I am pleased to be here today to discuss the Department of Homeland  Security’s (DHS) programs and efforts to strengthen the security of the  visa process, including efforts to identify and take enforcement against  overstays—individuals who were admitted to the United States legally on  a temporary basis—either with a visa, or in some cases, as visitors who  were allowed to enter without a visa—but then overstayed their  authorized periods of admission. The attempted bombing of Northwest  Airlines flight 253 on December 25, 2009, by a Nigerian citizen in  possession of a valid U.S. visa renewed concerns about the security of  the visa process. Each year, millions of visitors come to the United States  legally on a temporary basis. From fiscal year 2005 through fiscal year  2010, the Department of State issued over 36 million nonimmigrant visas  for business travel, pleasure, tourism, medical treatment, or for foreign  and cultural exchange student programs, among other things. In  addition, from fiscal year 2005 through fiscal year 2010, over 98 million  visitors were admitted to the United States under the Visa Waiver  Program, which allows nationals from certain countries to apply for  admission to the country as temporary visitors for business or pleasure  without first obtaining a visa from a U.S. consulate abroad.
Further, the most recent estimates from the Pew Hispanic Center  approximated that in 2006, out of an unauthorized resident alien  population of 11.5 million to 12 million in the United States, about 4 million  to 5.5 million were overstays. In February 2008, we reported that most  overstays are likely motivated by economic opportunities to stay in the  United States beyond their authorized periods of admission. Individuals  overstaying their authorized periods of admission could pose homeland  security concerns. For example, in some instances overstays have been  identified as terrorists or involved in terrorist-related activity, such as 5 of  the 19 September 11, 2001, hijackers. Further, according to DHS data, of  approximately 400 individuals reported by the Department of Justice as  convicted in the United States as a result of international terrorism-related  investigations conducted from September 2001 through March 2010,  approximately 36 were overstays.
DHS has certain responsibilities for strengthening security in the visa  process, including identifying and taking enforcement action to address  overstays. Within DHS, U.S. Customs and Border Protection (CBP) is  tasked with, among other duties, inspecting all people applying for entry  to the United States to determine their admissibility to the country and  screening Visa Waiver Program applicants to determine their eligibility to  travel to the United States under the program. U.S. Immigration and  Customs Enforcement (ICE) is the lead agency for enforcing immigration  law in the interior of the United States and is primarily responsible for  overstay enforcement, and within ICE, the Counterterrorism and Criminal  Exploitation Unit (CTCEU) is primarily responsible for overstay  investigations. The United States Visitor and Immigrant Status Indicator  Technology Program (US-VISIT) within DHS’s National Protection and  Programs Directorate supports the identification of nonimmigrant  overstays. In 2002, DHS initiated the US-VISIT Program to develop a  comprehensive entry and exit system to collect biometric data from aliens  traveling through U.S. ports of entry. In 2004, US-VISIT initiated the first  step of this program by collecting biometric data on aliens entering the  United States. Further, the Department of State is responsible for issuing  visas to foreign nationals seeking admission to the United States. In  addition, DHS has responsibility for managing the Visa Security Program  and the Visa Waiver Program. Specifically, ICE oversees the Visa  Security Program under which it deploys officials to certain U.S.  embassies and consulates to strengthen the visa process by working with  Department of State officials in reviewing visa applications. DHS is also  responsible for establishing visa policy, including policy for the Visa  Waiver Program.
As requested, my testimony will cover the following key issues: (1) efforts  to take enforcement action against overstays and reported results; (2)  DHS’s efforts to implement a biometric exit system and the reliability of  data used to identify overstays; and (3) challenges and weaknesses in  the Visa Security and Visa Waiver programs. This testimony is based on  our prior work on overstay enforcement efforts, the US-VISIT program,  the Visa Security Program, and the Visa Waiver Program. We issued  reports from these efforts in April 2011, August 2010 and November  2009, March 2011, and May 2011, respectively. For these reports, we  examined program documentation, such as standard operating  procedures, guidance for investigations, and implementation plans. We  also interviewed DHS and Department of State officials. Additional details  on the scope and methodology are available in our published reports. We  conducted this work in accordance with generally accepted government  auditing standards.
In summary, DHS has taken action to strengthen security in the visa  process, but operational and management weaknesses have hindered  the effectiveness of these efforts. First, ICE investigates and arrests a  small portion of the estimated overstay population in the United States  because of, for example, competing enforcement priorities. ICE also  reported allocating a small percentage of its investigative work hours to  overstay investigations since fiscal year 2006, but the agency has  expressed an intention to augment the resources it dedicates to overstay  enforcement efforts moving forward. However, ICE does not yet have a  target time frame for completing its planning efforts for augmenting  overstay enforcement resources, and it lacks mechanisms for assessing  the effectiveness of its enforcement efforts. Second, DHS has not yet  implemented a comprehensive biometric entry and exit system for  collecting biometric data on foreign nationals when they depart the United  States. In the absence of such a system, DHS uses primarily biographic  data to identify overstays. However, unreliable data hinder DHS’s efforts  to accurately identify overstays. Third, ICE has deployed agents to certain  embassies and consulates as part of the Visa Security Program, but has  not performed mandated training, has faced staffing challenges, and has  not fully adhered to its program expansion plan. DHS has taken action to  strengthen the security of the Visa Waiver Program, but has not fully  analyzed program risks or completed required reports on participating  countries’ security risks in a timely manner. We made a number of  recommendations to DHS to strengthen its efforts in these areas, such as  improving its management and assessment of overstay enforcement  efforts, planning for a biometric exit capability and mechanisms for  collecting data from foreign national departing the United States at land  ports of entry, and addressing risks in the Visa Security and Visa Waiver  programs. DHS concurred with these recommendations and has actions  planned or under way to address them.
subsections: section_title: Federal Agencies Take Actions against a Small Portion of the Estimated Overstay Population
subsections: section_title: ICE Investigates Few In- Country Overstays, but Its Efforts Could Benefit from Improved Planning and Performance Management
paragraphs: As we reported in April 2011, ICE CTCEU investigates and arrests a  small portion of the estimated in-country overstay population due to,  among other things, ICE’s competing priorities; however, these efforts  could be enhanced by improved planning and performance management.  CTCEU, the primary federal entity responsible for taking enforcement  action to address in-country overstays, identifies leads for overstay cases;  takes steps to verify the accuracy of the leads it identifies by, for example,  checking leads against multiple databases; and prioritizes leads to focus  on those the unit identifies as being most likely to pose a threat to  national security or public safety. CTCEU then requires field offices to  initiate investigations on all priority, high-risk leads it identifies.
According to CTCEU data, as of October 2010, ICE field offices had  closed about 34,700 overstay investigations that CTCEU headquarters  assigned to them from fiscal year 2004 through 2010. These cases  resulted in approximately 8,100 arrests (about 23 percent of the 34,700  investigations), relative to a total estimated overstay population of 4  million to 5.5 million. About 26,700 of those investigations (or 77  percent) resulted in one of these three outcomes: (1) evidence is  uncovered indicating that the suspected overstay has departed the United  States; (2) evidence is uncovered indicating that the subject of the  investigation is in-status (e.g., the subject filed a timely application with  the United States Citizenship and Immigration Services (USCIS) to  change his or her status and/or extend his or her authorized period of  admission in the United States); or (3) CTCEU investigators exhaust all  investigative leads and cannot locate the suspected overstay. Of the  approximately 34,700 overstay investigations assigned by CTCEU  headquarters that ICE field offices closed from fiscal year 2004 through  2010, ICE officials attributed the significant portion of overstay cases that  resulted in a departure finding, in-status finding, or with all leads being  exhausted generally to difficulties associated with locating suspected  overstays and the timeliness and completeness of data in DHS’s systems  used to identify overstays.
Further, ICE reported allocating a small percentage of its resources in  terms of investigative work hours to overstay investigations since fiscal  year 2006, but the agency expressed an intention to augment the  resources it dedicates to overstay enforcement efforts moving forward.  Specifically, from fiscal years 2006 through 2010, ICE reported devoting  from 3.1 to 3.4 percent of its total field office investigative hours to  CTCEU overstay investigations. ICE attributed the small percentage of  investigative resources it reported allocating to overstay enforcement  efforts primarily to competing enforcement priorities. According to the ICE  Assistant Secretary, ICE has resources to remove 400,000 aliens per  year, or less than 4 percent of the estimated removable alien population  in the United States. In June 2010, the Assistant Secretary stated that  ICE must prioritize the use of its resources to ensure that its efforts to  remove aliens reflect the agency’s highest priorities, namely  nonimmigrants, including suspected overstays, who are identified as high  risk in terms of being most likely to pose a risk to national security or  public safety. As a result, ICE dedicated its limited resources to  addressing overstays it identified as most likely to pose a potential threat  to national security or public safety and did not generally allocate  resources to address suspected overstays that it assessed as noncriminal  and low risk. ICE indicated that it may allocate more resources to  overstay enforcement efforts moving forward and that it planned to focus  primarily on suspected overstays whom ICE has identified as high risk or  who recently overstayed their authorized periods of admission.
ICE was considering assigning some responsibility for noncriminal  overstay enforcement to its Enforcement and Removal Operations (ERO)  directorate, which has responsibility for apprehending and removing  aliens who do not have lawful immigration status from the United States.  However, ERO did not plan to assume this responsibility until ICE  assessed the funding and resources doing so would require. ICE had not  established a time frame for completing this assessment. We reported in  April 2011 that by developing such a time frame and utilizing the  assessment findings, as appropriate, ICE could strengthen its planning  efforts and be better positioned to hold staff accountable for completing  the assessment. We recommended that ICE establish a target time frame  for assessing the funding and resources ERO would require in order to  assume responsibility for civil overstay enforcement and use the results of  that assessment. DHS officials agreed with our recommendation and  stated that ICE planned to identify resources needed to transition this  responsibility to ERO as part of its fiscal year 2013 resource-planning  process.
Moreover, although CTCEU established an output program goal and  target, and tracked various performance measures, it did not have a  mechanism in place to assess the outcomes of its efforts, particularly the  extent to which the program was meeting its mission as it relates to  overstays—to prevent terrorists and other criminals from exploiting the  nation’s immigration system. CTCEU’s program goal is to prevent  criminals and terrorists from exploiting the immigration system by  proactively developing cases for investigation, and its performance target  is to send 100 percent of verified priority leads to field offices as cases.  CTCEU also tracks a variety of output measures, such as the number of  cases completed their associated results (i.e., arrested, departed, in- status, or all leads exhausted) and average hours spent to complete an  investigation. While CTCEU’s performance target permits it to assess an  output internal to the program—the percentage of verified priority leads it  sends to field offices for investigation—it does not provide program  officials with a means to assess the impact of the program in terms of  preventing terrorists and other criminals from exploiting the immigration  system. We reported that by establishing such mechanisms, CTCEU  could better ensure that managers have information to assist in making  decisions for strengthening overstay enforcement efforts and assessing  performance against CTCEU’s goals. In our April 2011 report, we  recommended that ICE develop outcome-based performance  measures—or proxy measures if program outcomes cannot be  captured—and associated targets on CTCEU’s progress in preventing  terrorists and other criminals from exploiting the nation’s immigration  system. DHS officials agreed with our recommendation and stated that  ICE planned to work with DHS’s national security partners to determine if  measures could be implemented.
section_title: The Department of State and CBP Have Taken Action to Prevent Ineligible Out-of-Country Overstays from Returning to the United States
paragraphs: In addition to ICE’s overstay enforcement activities, in April 2011 we  reported that the Department of State and CBP are responsible for,  respectively, preventing ineligible violators from obtaining a new visa or  being admitted to the country at a port of entry. According to Department  of State data, the department denied about 52,800 nonimmigrant visa  applications and about 114,200 immigrant visa applications from fiscal  year 2005 through fiscal year 2010 due, at least in part, to applicants  having previously been unlawfully present in the United States for more  than 180 days, according to statute. Similarly, CBP reported that it  refused admission to about 5,000 foreign nationals applying for admission  to the United States from fiscal year 2005 through 2010 (an average of  about 830 per year) specifically because of the applicants’ previous status  as unlawfully present in the United States for more than 180 days.
section_title: DHS Has Not Implemented a Reliable Exit System and Faces Reliability Issues with Existing Visa Overstay Data
subsections: section_title: DHS Has Not Yet Implemented a Comprehensive Biometric Exit System
paragraphs: DHS has not yet implemented a comprehensive biometric system to  match available information provided by foreign nationals upon their  arrival and departure from the United States. In August 2007, we reported  that while US-VISIT biometric entry capabilities were operating at air, sea,  and land ports of entry, exit capabilities were not, and that DHS did not  have a comprehensive plan or a complete schedule for biometric exit  implementation. In addition, we reported that DHS continued to propose  spending tens of millions of dollars on US-VISIT exit projects that were  not well-defined, planned, or justified on the basis of costs, benefits, and  risks. Moreover, in November 2009, we reported that DHS had not  adopted an integrated approach to scheduling, executing, and tracking  the work that needed to be accomplished to deliver a comprehensive exit  solution as part of the US-VISIT program. We concluded that, without a  master schedule that was integrated and derived in accordance with  relevant guidance, DHS could not reliably commit to when and how it  would deliver a comprehensive exit solution or adequately monitor and  manage its progress toward this end. We recommended that DHS ensure  that an integrated master schedule be developed and maintained. DHS  concurred and reported, as of July 2011, that the documentation of  schedule practices and procedures is ongoing, and that an updated  schedule standard, management plan, and management process that are  compliant with schedule guidelines are under review.
More specifically, with regard to a biometric exit capability at land ports of  entry, we reported in December 2006 that US-VISIT officials concluded  that, for various reasons, a biometric US-VISIT exit capability could not be  implemented without incurring a major impact on land facilities. In  December 2009, DHS initiated a land exit pilot to collect departure  information from temporary workers traveling through two Arizona land  ports of entry. Under this pilot, temporary workers who entered the United  States at these ports of entry were required to register their final  departure by providing biometric and biographic information at exit kiosks  located at the ports of entry. DHS planned to use the results of this pilot to  help inform future decisions on the pedestrian component of the long- term land exit component of a comprehensive exit system.
With regard to air and sea ports of entry, in April 2008, DHS announced  its intention to implement biometric exit verification at air and sea ports of  entry in a Notice of Proposed Rule Making. Under this notice,  commercial air and sea carriers would be responsible for developing and  deploying the capability to collect biometric information from departing  travelers and transmit it to DHS. DHS received comments on the notice  and has not yet published a final rule. Subsequent to the rule making  notice, on September 30, 2008, the Consolidated Security, Disaster  Assistance, and Continuing Appropriations Act, 2009, was enacted, which  directed DHS to test two scenarios for an air exit solution: (1) airline  collection and transmission of biometric exit data, as proposed in the rule  making notice and (2) CBP collection of such information at the departure  gate. DHS conducted two pilots in 2009, and we reported on them in  August 2010. Specifically, we reported that the pilots addressed one  statutory requirement for a CBP scenario to collect information on exiting  foreign nationals. However, DHS was unable to address the statutory  requirement for an airline scenario because no airline was willing to  participate. We reported on limitations with the pilots, such as the  reported scope and approach of the pilots including limitations not defined  in the pilot evaluation plan like suspending exit screening at departure  gates to avoid flight delays, that curtailed their ability to inform a decision  for a long-term air exit solution and pointed to the need for additional  sources of information on air exit’s operational impacts. We  recommended that the Secretary of Homeland Security identify additional  sources of information beyond the pilots, such as comments from the  Notice of Proposed Rule Making, to inform an air exit solution decision.  DHS agreed with the recommendation and stated that the pilots it  conducted would not serve as the sole source of information to inform an  air exit solution decision. In July 2011, DHS stated that it continues to  examine all options in connection with a final biometric air exit solution  and has recently given consideration to using its authority to establish an  advisory committee to study and provide recommendations to DHS and  Congress on implementing an air exit program.
section_title: More Reliable, Accessible Data Could Improve DHS’s Efforts to Identify and Share Information on Overstays
paragraphs: In the absence of a comprehensive biometric entry and exit system for  identifying and tracking overstays, US-VISIT and CTCEU primarily  analyze biographic entry and exit data collected at land, air, and sea ports  of entry to identify overstays. In April 2011, we reported that DHS’s efforts  to identify and report on visa overstays were hindered by unreliable data.  Specifically, CBP does not inspect travelers exiting the United States  through land ports of entry, including collecting their biometric information,  and CBP did not provide a standard mechanism for nonimmigrants  departing the United States through land ports of entry to remit their  arrival and departure forms. Nonimmigrants departing the United States  through land ports of entry turn in their forms on their own initiative.  According to CBP officials, at some ports of entry, CBP provides a box for  nonimmigrants to drop off their forms, while at other ports of entry  departing nonimmigrants may park their cars, enter the port of entry  facility, and provide their forms to a CBP officer. These forms contain  information, such as arrival and departure dates, used by DHS to identify  overstays. If the benefits outweigh the costs, a mechanism to provide  nonimmigrants with a way to turn in their arrival and departure forms  could help DHS obtain more complete and reliable departure data for  identifying overstays. We recommended that the Commissioner of CBP  analyze the costs and benefits of developing a standard mechanism for  collecting these forms at land ports of entry, and develop a standard  mechanism to collect them, to the extent that benefits outweigh the costs.  CBP agreed with our recommendation and stated it planned to complete  a cost-effective independent evaluation.
Further, we previously reported on weaknesses in DHS processes for  collecting departure data, and how these weaknesses impact the  determination of overstay rates. The Implementing Recommendations of  the 9/11 Commission Act required that DHS certify that a system is in  place that can verify the departure of not less than 97 percent of foreign  nationals who depart through U.S. airports in order for DHS to expand the  Visa Waiver Program. In September 2008, we reported that DHS’s  methodology for comparing arrivals and departures for the purpose of  departure verification would not inform overall or country-specific overstay  rates because DHS’s methodology did not begin with arrival records to  determine if those foreign nationals departed or remained in the United  States beyond their authorized periods of admission. Rather, DHS’s  methodology started with departure records and matched them to arrival  records. As a result, DHS’s methodology counted overstays who left the  country, but did not identify overstays who have not departed the United  States and appear to have no intention of leaving. We recommended that  DHS explore cost-effective actions necessary to further improve the  reliability of overstay data. DHS reported that it is taking steps to improve  the accuracy and reliability of the overstay data, by efforts such as  continuing to audit carrier performance and work with airlines to improve  the accuracy and completeness of data collection. Moreover, by statute,  DHS is required to submit an annual report to Congress providing  numerical estimates of the number of aliens from each country in each  nonimmigrant classification who overstayed an authorized period of  admission that expired during the fiscal year prior to the year for which  the report is made. DHS officials stated that the department has not  provided Congress annual overstay estimates regularly since 1994  because officials do not have sufficient confidence in the quality of the  department’s overstay data—which is maintained and generated by US- VISIT. As a result, DHS officials stated that the department cannot  reliably report overstay rates in accordance with the statute.
In addition, in April 2011 we reported that DHS took several steps to  provide its component entities and other federal agencies with information  to identify and take enforcement action on overstays, including creating  biometric and biographic lookouts—or electronic alerts—on the records of  overstay subjects that are recorded in databases. However, DHS did not  create lookouts for the following two categories of overstays: (1)  temporary visitors who were admitted to the United States using  nonimmigrant business and pleasure visas and subsequently overstayed  by 90 days or less; and (2) suspected in-country overstays who CTCEU  deemed not to be a priority for investigation in terms of being most likely  to pose a threat to national security or public safety. Broadening the  scope of electronic lookouts in federal information systems could enhance  overstay information sharing. In April 2011, we recommended that the  Secretary of Homeland Security direct the Commissioner of Customs and  Border Protection, the Under Secretary of the National Protection and  Programs Directorate, and the Assistant Secretary of Immigration and  Customs Enforcement to assess the costs and benefits of creating  biometric and biographic lookouts for these two categories of overstays.  Agency officials agreed with our recommendation and have actions under  way to address it. For example, agency officials stated that they have met  to assess the costs and benefits of creating lookouts for those categories  of overstays.
section_title: Additional Steps Needed to Address Risks in the Visa Security and Visa Waiver Programs
subsections: section_title: Visa Security Program
paragraphs: As we reported in March 2011, the Visa Security Program faces several  key challenges in implementing operations at overseas posts. For  example, we reported that Visa Security Program agents’ advising and  training of consular officers, as mandated by section 428 of the Homeland  Security Act, varied from post to post, and some posts provided no  training to consular officers. We contacted consular sections at 13  overseas posts, and officials from 5 of the 13 consular sections we  interviewed stated that they had received no training from the Visa  Security Program agents in the last year, and none of the agents we  interviewed reported providing training on specific security threats. At  posts where Visa Security Program agents provided training for consular  officers, topics covered included fraudulent documents, immigration law,  human smuggling, and interviewing techniques. In March 2011, we  recommended that DHS issue guidance requiring Visa Security Program  agents to provide training for consular officers as mandated by section  428 of the Homeland Security Act. DHS concurred with our  recommendation and has actions under way to address it.
Further, in March 2011 we reported that Visa Security Program agents  performed a variety of investigative and administrative functions beyond  their visa security responsibilities, including criminal investigations,  attaché functions, and regional responsibilities. According to ICE officials,  Visa Security Program agents perform non-program functions only after  completing their visa security screening and vetting workload. However,  both agents and Department of State officials at some posts told us that  these other investigative and administrative functions sometimes slowed  or limited Visa Security Program agents’ visa security-related activities.  We recommended that DHS develop a mechanism to track the amount of  time spent by Visa Security Program agents on visa security activities and  other investigations, in order to determine appropriate staffing levels and  resource needs for Visa Security Program operations at posts overseas  to ensure visa security operations are not limited. DHS did not concur  with our recommendation, stating that ICE currently tracks case  investigation hours through its data system, and that adding the metric to  the Visa Security Program tracking system would be redundant. However,  DHS’s response did not address our finding that ICE does not have a  mechanism that allows the agency to track the amount of time agents  spend on both investigation hours and hours spent on visa security  activities. Therefore, we continue to believe the recommendation has  merit and should be implemented.
Moreover, we found that ICE’s use of 30-day temporary duty assignments  to fill Visa Waiver Program positions at posts created challenges and  affected continuity of operations at some posts. Consular officers we  interviewed at 3 of 13 posts discussed challenges caused by this use of  temporary duty agents. The Visa Security Program’s 5-year plan also  identified recruitment of qualified personnel as a challenge and  recommended incentives for Visa Security Program agents as critical to  the program’s mission, stating, “These assignments present significant  attendant lifestyle difficulties. If the mission is to be accomplished, ICE,  like State, needs a way to provide incentives for qualified personnel to  accept these hardship assignments.” However, according to ICE officials,  ICE had not provided incentives to facilitate recruitment for hardship  posts. ICE officials stated that they have had difficulty attracting agents  to Saudi Arabia, and ICE agents at post told us they have little incentive  to volunteer for Visa Security Program assignments. Thus, we  recommended that DHS develop a plan to provide Visa Security Program  coverage at high-risk posts where the possibility of deploying agents may  be limited. DHS agreed with our recommendation and is taking steps to  implement it.
In addition, ICE developed a plan to expand the Visa Security Program to  additional high-risk visa-issuing posts, but ICE had not fully adhered to  the plan or kept it up to date. The program’s 5-year expansion plan,  developed in 2007, identified 14 posts for expansion between 2009 and  2010, but 9 of these locations had not been established at the time of our  March 2011 report, and ICE had not updated the plan to reflect the  current situation. Furthermore, ICE had not fully addressed remaining  visa risk in high-risk posts that did not have a Visa Security Program  presence. ICE, with input from the Department of State, developed a list  of worldwide visa-issuing posts that are ranked according to visa risk.  Although the expansion plan stated that risk analysis is the primary input  to Visa Security Program site selection and that the expansion plan  represented an effort to address visa risk, ICE had not expanded the Visa  Security Program to some high-risk posts. For example, 11 of the top 20  high-risk posts identified by ICE and Department of State were not  covered by Visa Security Program at the time of our review. The  expansion of the Visa Security Program may be limited by a number of  factors—including budget limitations and objections from Department of  State officials at some posts—and ICE had not identified possible  alternatives that would provide the additional security of Visa Security  Program review at those posts that do not have a program presence. In  May 2011, we recommended that DHS develop a plan to provide Visa  Security Program coverage at high-risk posts where the possibility of  deploying agents may be limited. DHS concurred with our  recommendation and noted actions under way to address it, such as  enhancing information technology systems to allow for screening and  reviewing of visa applicants at posts worldwide.
section_title: Visa Waiver Program
paragraphs: As we reported in May 2011, DHS implemented the Electronic System for  Travel Authorization (ESTA) to meet a statutory requirement intended to  enhance Visa Waiver Program security and took steps to minimize the  burden on travelers to the United States added by the new requirement.  However, DHS had not fully evaluated security risks related to the small  percentage of Visa Waiver Program travelers without verified ESTA  approval. DHS developed ESTA to collect passenger data and complete  security checks on the data before passengers board a U.S. bound  carrier. DHS requires applicants for Visa Waiver Program travel to submit  biographical information and answers to eligibility questions through  ESTA prior to travel. Travelers whose ESTA applications are denied can  apply for a U.S. visa. In developing and implementing ESTA, DHS took  several steps to minimize the burden associated with ESTA use. For  example, ESTA reduced the requirement that passengers provide  biographical information to DHS officials from every trip to once every 2  years. In addition, because of ESTA, DHS has informed passengers who  do not qualify for Visa Waiver Program travel that they need to apply for a  visa before they travel to the United States. Moreover, most travel  industry officials we interviewed in six Visa Waiver Program countries  praised DHS’s widespread ESTA outreach efforts, reasonable  implementation time frames, and responsiveness to feedback but  expressed dissatisfaction over ESTA fees paid by ESTA applicants.
In 2010, airlines complied with the requirement to verify ESTA approval  for almost 98 percent of the Visa Waiver Program passengers prior to  boarding, but the remaining 2 percent— about 364,000 travelers— traveled under the Visa Waiver Program without verified ESTA approval.  In addition, about 650 of these passengers traveled to the United States  with a denied ESTA. As we reported in May 2011, DHS had not yet  completed a review of these cases to know to what extent they pose a  risk to the program. DHS officials told us that, although there was no  official agency plan for monitoring and oversight of ESTA, the ESTA office  was undertaking a review of each case of a carrier’s boarding a Visa  Waiver Program traveler without an approved ESTA application; however,  DHS had not established a target date for completing this review. DHS  tracked some data on passengers that travel under the Visa Waiver  Program without verified ESTA approval but did not track other data that  would help officials know the extent to which noncompliance poses a risk  to the program. Without a completed analysis of noncompliance with  ESTA requirements, DHS was unable to determine the level of risk that  noncompliance poses to Visa Waiver Program security and to identify  improvements needed to minimize noncompliance. In addition, without  analysis of data on travelers who were admitted to the United States  without a visa after being denied by ESTA, DHS cannot determine the  extent to which ESTA is accurately identifying individuals who should be  denied travel under the program. In May 2011, we recommended that  DHS establish time frames for the regular review and documentation of  cases of Visa Waiver Program passengers traveling to a U.S. port of  entry without verified ESTA approval. DHS concurred with our  recommendation and committed to establish procedures to review  quarterly a representative sample of noncompliant passengers to  evaluate, identify, and mitigate potential security risks associated with the  ESTA program.
Further, in May 2011 we reported that to meet certain statutory  requirements, DHS requires that Visa Waiver Program countries enter  into three information-sharing agreements with the United States;  however, only half of the countries had fully complied with this  requirement and many of the signed agreements have not been  implemented. Half of the countries entered into agreements to share  watchlist information about known or suspected terrorists and to provide  access to biographical, biometric, and criminal history data. By contrast,  almost all of the 36 Visa Waiver Program countries entered into an  agreement to report lost and stolen passports. DHS, with the support of  interagency partners, established a compliance schedule requiring the  last of the Visa Waiver Program countries to finalize these agreements by  June 2012. Although termination from the Visa Waiver Program is one  potential consequence for countries not complying with the information- sharing agreement requirement, U.S. officials have described it as  undesirable. DHS, in coordination with the Departments of State and  Justice, developed measures short of termination that could be applied to  countries not meeting their compliance date.
In addition, as of May 2011, DHS had not completed half of the most  recent biennial reports on Visa Waiver Program countries’ security risks in  a timely manner. In 2002, Congress mandated that, at least once every 2  years, DHS evaluate the effect of each country’s continued participation  in the program on the security, law enforcement, and immigration  interests of the United States. The mandate also directed DHS to  determine based on the evaluation whether each Visa Waiver Program  country’s designation should continue or be terminated and to submit a  written report on that determination to select congressional committees.  According to officials, DHS assesses, among other things,  counterterrorism capabilities and immigration programs. However, DHS  had not completed the latest biennial reports for 18 of the 36 Visa Waiver  Program countries in a timely manner, and over half of these reports are  more than 1 year overdue. Further, in the case of 2 countries, DHS was  unable to demonstrate that it had completed reports in the last 4 years.  DHS cited a number of reasons for the reporting delays. For example,  DHS officials said that they intentionally delayed report completion  because they frequently did not receive mandated intelligence  assessments in a timely manner and needed to review these before  completing Visa Waiver Program country biennial reports. We  recommended that DHS take steps to address delays in the biennial  country review process so that the mandated country reports can be  completed on time. DHS concurred with our recommendation and  reported that it would consider process changes to address our concerns  with the timeliness of continuing Visa Waiver Program reports.
This concludes my prepared testimony statement. I would be pleased to  respond to any questions that members of the Subcommittee may have.
section_title: Contacts and Acknowledgments
paragraphs: For further information regarding this testimony, please contact Richard  M. Stana at (202) 512-8777 or stanar@gao.gov. In addition, contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this statement. Individuals who made key  contributions to this testimony are Rebecca Gambler, Assistant Director;  Jeffrey Baldwin-Bott; Frances Cook; David Hinchman; Jeremy Manion;  Taylor Matheson; Jeff Miller; Anthony Moran; Jessica Orr; Zane Seals;  and Joshua Wiener.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.