Homeland Security: First Phase of Visitor and Immigration Status Program Operating, but Improvements Needed
Published: 2004-05-11T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Department of Homeland Security (DHS) has established a program--the United States Visitor and Immigrant Status Indicator Technology (US-VISIT)--to collect, maintain, and share information, including biometric identifiers, on selected foreign nationals who travel to the United States. By congressional mandate, DHS is to develop and submit for approval an expenditure plan for US-VISIT that satisfies certain conditions, including being reviewed by GAO. Among other things, GAO was asked to determine whether the plan satisfied these conditions, and to provide observations on the plan and DHS's program management.
section_title: What GAO Found
paragraphs: DHS's fiscal year 2004 US-VISIT expenditure plan and related documentation at least partially satisfies all conditions imposed by the Congress, including meeting the capital planning and investment control review requirements of the Office of Management and Budget (OMB). DHS developed a draft risk management plan and a process to implement and manage risks. However, DHS does not have a current life cycle cost estimate or a cost/benefit analysis for US-VISIT. The US-VISIT program merges four components into one integrated whole to carry out its mission. GAO also developed a number of observations about the expenditure plan and DHS's management of the program. These generally recognize accomplishments to date and address the need for rigorous and disciplined program practices. US-VISIT largely met its commitments for implementing an initial operating capability, known as Increment 1, in early January 2004, including the deployment of entry capability to 115 air and 14 sea ports of entry. However, DHS has not employed rigorous, disciplined management controls typically associated with successful programs, such as test management, and its plans for implementing other controls, such as independent verification and validation, may not prove effective. More specifically, testing of the initial phase of the implemented system was not well managed and was completed after the system became operational. In addition, multiple test plans were developed during testing, and only the final test plan, completed after testing, included all required content, such as describing tests to be performed. Such controls, while significant for the initial phases of US-VISIT, are even more critical for the later phases, as the size and complexity of the program will only increase. Finally, DHS's plans for future US-VISIT resource needs at the land ports of entry, such as staff and facilities, are based on questionable assumptions, making future resource needs uncertain.

section_title: Letter
paragraphs: Pursuant to the Department of Homeland Security Appropriations Act,  2004, the Department of Homeland Security (DHS) submitted to the  Congress in January 2004 its fiscal year 2004 expenditure plan for the  United States Visitor and Immigrant Status Indicator Technology (US- VISIT) program. US-VISIT is a governmentwide program to collect,  maintain, and share information on foreign nationals. The program’s goals  are to enhance national security, facilitate legitimate trade and travel,  contribute to the integrity of the U.S. immigration system, and adhere to  U.S. privacy laws and policies. On January 5, 2004, DHS began operating  the first stage of its planned US-VISIT operational capability, known as  Increment 1, at 115 air and 14 sea ports of entry (POE).
As required by the appropriations act, we reviewed US-VISIT’s fiscal year  2004 expenditure plan. Our objectives were to (1) determine whether the  expenditure plan satisfies the legislative conditions specified in the act,  (2) determine the status of our US-VISIT open recommendations, and  (3) provide any other observations about the expenditure plan and DHS’s  management of US-VISIT.
On March 2, 2004, we provided your offices with a written briefing detailing  the results of our review. This report summarizes and transmits this  briefing; the full briefing, including our scope and methodology, is  reprinted as appendix I. The purpose of this report is to provide the  published briefing slides to you and to officially transmit our  recommendations to the Secretary of Homeland Security.
subsections: section_title: Compliance with Legislative Conditions
paragraphs: DHS satisfied or partially satisfied each of the applicable legislative  conditions specified in the act. In particular, the plan, including related  program documentation and program officials’ statements, satisfied or  provided for satisfying all key aspects of (1) compliance with the DHS  enterprise architecture; (2) federal acquisition rules, requirements,  guidelines, and systems acquisition management practices; and (3) review  and approval by DHS and the Office of Management and Budget (OMB).  Additionally, the plan, including program documentation and program  officials’ statements, satisfied or provided for satisfying many, but not all,  key aspects of OMB’s capital planning and investment review requirements.  For example, DHS fulfilled the OMB requirement that it justify and describe  its acquisition strategy. However, DHS does not have current life cycle  costs or a current cost/benefit analysis for US-VISIT.
section_title: Status of Open Recommendations
paragraphs: DHS has implemented one, and either partially implemented or has  initiated action to implement most of the remaining recommendations  contained in our reports on the fiscal year 2002 and fiscal year 2003  expenditure plans. Each recommendation, along with its current status, is  summarized below:  Develop a system security plan and privacy impact assessment.
The department has partially implemented this recommendation. As to the  first part of this recommendation, the program office does not have a  system security plan for US-VISIT. However, the US-VISIT Chief  Information Officer (CIO) accredited Increment 1 based upon security  certifications for each of Increment 1’s component systems and a review  of each component’s security-related documentation. Second, although the  program office has conducted a privacy impact assessment for Increment  1, the assessment does not satisfy all aspects of OMB guidance for  conducting an assessment. For example, the assessment does not discuss  alternatives to the methods of information collection, and the system  documentation does not address privacy issues.
Develop and implement a plan for satisfying key acquisition  management controls, including acquisition planning, solicitation,  requirements management, program management, contract tracking  and oversight, evaluation, and transition to support, and implement  the controls in accordance with the Software Engineering Institute’s  (SEI) guidance.
The department plans to implement this recommendation. The US-VISIT  program office has assigned responsibility for implementing the  recommended controls. However, it has not yet developed explicit plans or  time frames for defining and implementing them.
Ensure that future expenditure plans are provided to the department’s  House and Senate Appropriations Subcommittees in advance of US- VISIT funds being obligated.
With respect to the fiscal year 2004 expenditure plan, DHS implemented  this recommendation by providing the plan to the Senate and House  subcommittees on January 27, 2004. According to the program director, as  of February 2004 no funds had been obligated to US-VISIT.
Ensure that future expenditure plans fully disclose US-VISIT  capabilities, schedule, cost, and benefits.
The department has partially implemented this recommendation.  Specifically, the plan describes high-level capabilities, high-level schedule  estimates, categories of expenditures by increment, and general benefits.  However, the plan does not describe planned capabilities by increment and  provides only general information on how money will be spent in each  increment. Moreover, the plan does not identify all expected benefits in  tangible, measurable, and meaningful terms, nor does it associate any  benefits with increments.
Establish and charter an executive body composed of senior-level  representatives from DHS and each US-VISIT stakeholder  organization to guide and direct the program.
The department has implemented this recommendation by establishing a  three-entity governance structure. The entities are (1) the Homeland  Security Council, (2) the DHS Investment Review Board, and (3) the US- VISIT Federal Stakeholders Advisory Board. The purpose of the Homeland  Security Council is to ensure the coordination of all homeland security- related activities among executive departments and agencies, and the  Investment Review Board is expected to monitor US-VISIT’s achievement  of cost, schedule, and performance goals. The advisory board is chartered  to provide recommendations for overseeing program management and  performance activities, including providing advice on the overarching US- VISIT vision; recommending changes to the vision and strategic direction;  and providing a communications link for aligning strategic direction,  priorities, and resources with stakeholder operations.
Ensure that human capital and financial resources are provided to  establish a fully functional and effective program office.
The department is in the process of implementing this recommendation.  DHS has determined that US-VISIT will require 115 government personnel  and has filled 41 of these, including 12 key management positions.  However, 74 positions have yet to be filled, and all filled positions are  staffed by detailees from other organizational units within the department.
Clarify the operational context in which US-VISIT is to operate.
The department is in the process of implementing this recommendation.  DHS released Version 1 of its enterprise architecture in October 2003, and  it plans to issue Version 2 in September 2004.
Determine whether proposed US-VISIT increments will produce  mission value commensurate with cost and risks.
The department plans to implement this recommendation. The fiscal year  2004 expenditure plan identifies high-level benefits to be delivered, but the  benefits are not associated with specific increments. Additionally, the plan  does not identify the total cost of Increment 2. Program officials expected  to finalize a cost-benefit analysis this past March and a US-VISIT life cycle  cost estimate this past April.
Define program office positions, roles, and responsibilities.
The department is in the process of implementing this recommendation.  Program officials are currently working with the Office of Personnel  Management to define program position descriptions, including roles and  responsibilities. The program office has partially completed defining the  competencies for all 12 key management areas. These competencies are to  be used in defining the position descriptions.
Develop and implement a human capital strategy for the program  office.
The department plans to implement this recommendation in conjunction  with DHS’s ongoing workforce planning, but stated that they have yet to  develop a human capital strategy. According to these officials, DHS’s  departmental workforce plan is scheduled for completion during fiscal year  2004.
Develop a risk management plan and report all high risks areas and  their status to the program’s governing body on a regular basis.
The department has partially implemented this recommendation. The  program has completed a draft risk management plan, and is currently  defining risk management processes. The program is creating a risk  management team to operate in lieu of formal processes until these are  completed, and also maintains a risk-tracking database that is used to  manage risks.
Define performance standards for each program increment that are  measurable and reflect the limitations imposed by relying on existing  systems.
The department is in the process of implementing this recommendation.  The program office has defined limited performance standards, but not all  standards are being defined in a way that reflects the performance  limitations of existing systems.
section_title: Observations on the Expenditure Plan
paragraphs: Our observations recognize accomplishments to date and address the need  for rigorous and disciplined program management practices relating to  system testing, independent verification and validation, and system change  control. An overview of specific observations follows:  Increment 1 commitments were largely met. An initial operating  capability for entry (including biographic and biometric data collection)  was deployed to 115 air and 14 sea ports of entry on January 5, 2004,  with additional capabilities deployed on February 11, 2004. Exit  capability (including biometric capture) was deployed to one air and  one sea port of entry.
Increment 1 testing was not managed effectively and was completed  after the system became operational. The Increment 1 system  acceptance test plan was developed largely during and after test  execution. The department developed multiple plans, and only the final  plan, which was done after testing was completed, included all required  content, such as tests to be performed and test procedures. None of the  test plan versions, including the final version, were concurred with by  the system owner or approved by the IT project manager, as required.  By not having a complete test plan before testing began, the US-VISIT  program office unnecessarily increased the risk that the testing  performed would not adequately address Increment 1 requirements and  failed to have adequate assurance that the system was being fully tested.  Further, by not fully testing Increment 1 before the system became  operational, the program office assumed the risk of introducing errors  into the deployed system. In fact, post-deployment problems surfaced  with the Student and Exchange Visitor Information System (SEVIS)  interface as a result of this approach, and manual work-arounds had to  be implemented.
The independent verification and validation contractor’s roles may be  in conflict. The US-VISIT program plans to use its contractor to review  some of the processes and products that the contractor may be  responsible for defining or executing. Depending on the products and  processes in question, this approach potentially impedes the  contractor’s independence, and thus its effectiveness.
A program-level change control board has not been established.
Changes related to Increment 1 were controlled primarily through daily  coordination meetings (i.e., oral discussions) among representatives  from Increment 1 component systems teams and program officials, and  the various boards already in place for the component systems. Without  a structured and disciplined approach to change control, program  officials do not have adequate assurance that changes made to the  component systems for non-US-VISIT purposes do not interfere with  US-VISIT functionality.
The fiscal year 2004 expenditure plan does not disclose management  reserve funding. Program officials, including the program director,  stated that reserve funding is embedded within the expenditure plan’s  various areas of proposed spending. However, the plan does not  specifically disclose these embedded reserve amounts. By not creating,  earmarking, and disclosing a specific management reserve fund in the  plan, DHS is limiting its flexibility in addressing unexpected problems  that could arise in the program’s various areas of proposed spending,  and it is limiting the ability of the Congress to exercise effective  oversight of this funding.
Plans for future US-VISIT increments do not call for additional staff  or facilities at land ports of entry. However, these plans are based on  various assumptions that potential policy changes could invalidate.  These changes could significantly increase the number of foreign  nationals who would require processing through US-VISIT. Additionally,  the Data Management Improvement Act Task Force’s 2003 Second  Annual Report to Congress has noted that existing land port of entry  facilities do not adequately support even the current entry and exit  processes. Thus, future US-VISIT staffing and facility needs are  uncertain.
section_title: Conclusions
paragraphs: The fiscal year 2004 US-VISIT expenditure plan (with related program  office documentation and representations) at least partially satisfies the  legislative conditions imposed by the Congress. Further, steps are planned,  under way, or completed to address most of our open recommendations.  However, overall progress on all of our recommendations has been slow,  and considerable work remains to fully address them. The majority of these  recommendations are aimed at correcting fundamental limitations in the  program office’s ability to manage US-VISIT in a way that reasonably  ensures the delivery of mission value commensurate with costs and  provides for the delivery of promised capabilities on time and within  budget. Given this background, it is important for DHS to implement the  recommendations quickly and completely through active planning and  continuous monitoring and reporting. Until this occurs, the program will  continue to be at high risk of not meeting expectations.
To the US-VISIT program office’s credit, the first phase of the program has  been deployed and is operating, and the commitments that DHS made  regarding this initial operating capability were largely met. However, this  was not accomplished in a manner that warrants repeating. In particular,  the program office did not employ the kind of rigorous and disciplined  management controls that are typically associated with successful  programs, such as effective test management and configuration  management practices. Moreover, the second phase of US-VISIT is already  under way, and these controls are still not established. These controls,  while significant for the initial phases of US-VISIT, are even more critical  for the later phases, because the size and complexity of the program will  only increase, and the later that problems are found, the harder and more  costly they are to fix.
Also important at this juncture in the program’s life are the still open  questions surrounding whether the initial phases of US-VISIT will return  value to the nation commensurate with their costs. Such questions warrant  answers sooner rather than later, because of the program’s size,  complexity, cost, and mission significance. It is imperative that DHS move  swiftly to address the US-VISIT program management weaknesses that we  previously identified, by implementing our remaining open  recommendations. It is equally essential that the department quickly  corrects the additional weaknesses that we have identified. Doing less will  only increase the risk associated with US-VISIT.
section_title: Recommendations for Executive Action
paragraphs: To better ensure that the US-VISIT program is worthy of investment and is  managed effectively, we are reiterating our prior recommendations, and we  further recommend that the Secretary of Homeland Security direct the  Under Secretary for Border and Transportation Security to ensure that the  US-VISIT program director takes the following actions:  Develop and approve complete test plans before testing begins. These  plans, at a minimum, should (1) specify the test environment, including  test equipment, software, material, and necessary training; (2) describe  each test to be performed, including test controls, inputs, and expected  outputs; (3) define the test procedures to be followed in conducting the  tests; and (4) provide traceability between test cases and the  requirements to be verified by the testing.
Establish processes for ensuring the independence of the IV&V  contractor.
Implement effective configuration management practices, including  establishing a US-VISIT change control board to manage and oversee  system changes.
Identify and disclose to the Appropriations Committees management  reserve funding embedded in the fiscal year 2004 expenditure plan.
Ensure that all future US-VISIT expenditure plans identify and disclose  management reserve funding.
Assess the full impact of a key future US-VISIT increment on land port  of entry workforce levels and facilities, including performing  appropriate modeling exercises.
To ensure that our recommendations addressing fundamental program  management weaknesses are addressed quickly and completely, we further  recommend that the Secretary direct the Under Secretary to have the  program director develop a plan, including explicit tasks and milestones,  for implementing all of our open recommendations, including those  provided in this report. We further recommend that this plan provide for  periodic reporting to the Secretary and Under Secretary on progress in  implementing this plan. Lastly, we recommend that the Secretary report  this progress, including reasons for delays, in all future US-VISIT  expenditure plans.
section_title: Agency Comments and Our Evaluation
paragraphs: In written comments on a draft of this report signed by the US-VISIT  Director (reprinted in app. II, along with our responses), DHS agreed with  our recommendations and most of our observations. It also stated that it  appreciated the guidance that the report provided and described actions  that it is taking or plans to take in response to our recommendations.
However, DHS stated that it did not fully agree with all of our findings,  specifically offering comments on our characterization of the status of one  open recommendation and two observations. First, it did not agree with  our position that it had not developed a security plan and completed a  privacy impact assessment. According to DHS, it has completed both. We  acknowledge DHS’s activity on both of these issues, but disagree that  completion of an adequate security plan and privacy impact assessment  has occurred. As we state in the report, the department’s security plan for  US-VISIT, titled Security and Privacy: Requirements & Guidelines  Version 1.0, is a draft document, and it does not include information  consistent with relevant guidance for a security plan, such as a risk  assessment methodology and specific controls for meeting security  requirements. Moreover, much of the document discusses guidelines for  developing a security plan, rather than specific contents of a plan. Also, as  we state in the report, the Privacy Impact Assessment was published but is  not complete because it does not satisfy important parts of OMB guidance  governing the content of these assessments, such as discussing alternatives  to the designed methods of information collection and handling.
Second, DHS stated that it did not fully agree with our observation that the  Increment 1 system test plan was developed largely during and after  testing, citing several steps that it took as part of Increment 1 requirements  definition, test preparation, and test execution. However, none of the steps  cited address our observations that DHS did not have a system acceptance  test plan developed, approved, and available in time to use as the basis for  conducting system acceptance testing and that only the version of the test  plan modified on January 16, 2004 (after testing was completed) contained  all of the required test plan content. Moreover, DHS’s comments  acknowledge that the four versions of its Increment 1 test plan were  developed during the course of test execution, and that the test schedule  did not permit sufficient time for all stakeholders to review, and thus  approve, the plans.
Third, DHS commented on the roles and responsibilities of its various  support contractors, and stated that we cited the wrong operative  documentation governing the role of its independent verification and  validation contractor. While we do not question the information provided in  DHS’s comments concerning contractor roles, we would add that its  comments omitted certain roles and responsibilities contained in the  statement of work for one of its contractors. This omitted information is  important because it is the basis for our observation that the program  office planned to task the same contractor that was responsible for  program management activities with performing independent verification  and validation activities. Under these circumstances, the contractor could  not be independent. In addition, we disagree with DHS’s comment that we  cited the wrong operative documentation, and note that the document DHS  said we should have used relates to a different support contractor than the  one tasked with both performing program activities and performing  independent verification and validation activities.
The department also provided additional technical comments, which we  have incorporated as appropriate into the report.
We are sending copies of this report to the Chairmen and Ranking Minority  Members of other Senate and House committees and subcommittees that  have authorization and oversight responsibilities for homeland security. We  are also sending copies to the Secretary of State and the Director of OMB.  Copies of this report will also be available at no charge on our Web site at  www.gao.gov.
Should you or your offices have any questions on matters discussed in this  report, please contact me at (202) 512-3439 or at hiter@gao.gov. Another  contact and key contributors to this report are listed in appendix III.
section_title: Briefing to the Staffs of the Subcommittees on Homeland Security, Senate and House Committees on Appropriations
subsections: section_title: Introduction
section_title: The United States Visitor and Immigrant Status Indicator Technology (US-VISIT) program of the Department of Homeland Security (DHS) is a governmentwide program to collect, maintain, and share information on foreign nationals. The goals of the US-VISIT program are to
paragraphs: facilitate legitimate trade and travel,  contribute to the integrity of the U.S. immigration system,1 and  adhere to U.S. privacy laws and polices.
US-VISIT capability is planned to be implemented in four increments. Increment 1  began operating on January 5, 2004, at major air and sea ports of entry (POEs).
This goal has been added since the last expenditure plan.
section_title: The US-VISIT program involves the interdependent application of people, processes, technology, and facilities.
section_title: Meets the capital planning and investment control review requirements
paragraphs: established by the Office of Management and Budget (OMB), including OMB  Circular A-11, part 3.2  Complies with DHS’s enterprise architecture.
Complies with the acquisition rules, requirements, guidelines, and systems  acquisition management practices of the federal government.
Is reviewed and approved by DHS and OMB.
Is reviewed by GAO.
OMB Circular A-11 establishes policy for planning, budgeting, acquisition, and management of federal capital assets.
section_title: DHS submitted its fiscal year 2004 expenditure plan for $330 million on January 27, 2004, to the House and Senate Appropriations Subcommittees on Homeland Security.
section_title: As agreed, our objectives were to
paragraphs: 1. determine whether the US-VISIT fiscal year 2004 expenditure plan satisfies the  2. determine the status of our US-VISIT open recommendations, and  3. provide any other observations about the expenditure plan and DHS’s management of US-VISIT.
We conducted our work at DHS’s headquarters in Washington, D.C., and at its  Atlanta Field Operations Office (Atlanta’s William B. Hartsfield International Airport)  from October 2003 through February 2004 in accordance with generally accepted government auditing standards. Details of our scope and methodology are given in  attachment 1.
Legislative conditions 1. Meets the capital planning and investment control review requirements established by OMB, including OMB Circular A-11, part 7.2. Complies with the DHS enterprise architecture. 3.  Complies with the acquisition rules, requirements, guidelines, and systems acquisition management practices of the federal government. 4.  Is reviewed and approved by DHS and OMB. 5.Is reviewed by GAO.
GAO open recommendations 1. Develop a system security plan and privacy impact assessment. 2. Develop and implement a plan for satisfying key acquisition management controls, including acquisition planning, solicitation,  requirements development and management, project management, contract tracking and oversight, evaluation, and  transition to support, and implement the controls in accordance with SEI guidance. 3. Ensure that future expenditure plans are provided to DHS’s  House and Senate Appropriations Subcommittees in advance of US-VISIT funds being obligated.  4. Ensure that future expenditure plans fully disclose US-VISIT system capabilities, schedule, cost, and benefits to be delivered.
Actions have been taken to fully implement the recommendation.
GAO open recommendations 5. Establish and charter an executive body composed of senior-level representatives from DHS and each stakeholder organization to guide and direct the US-VISIT program. 6. Ensure that human capital and financial resources are provided to  establish a fully functional and effective US-VISIT program office. 7. Clarify the operational context in which US-VISIT is to operate. 8. Determine whether proposed US-VISIT increments will produce mission value commensurate with costs and risks. 9. Define US-VISIT program office positions, roles, and responsibilities. 10. Develop and implement a human capital strategy for the US-VISIT program office that provides for staffing positions with individuals who have the appropriate knowledge, skills, and abilities. 11. Develop a risk management plan and report all high risks and their  status to the executive body on a regular basis. 12. Define performance standards for each US-VISIT increment that are measurable and reflect the limitations imposed by relying on existing systems.
Commitments were largely met; the system is deployed and operating.
Testing was not managed effectively; if continued, the current approach to testing  would increase risks.
The system acceptance test (SAT) plan was developed largely during and after  test execution.
The SAT plan available during testing was not complete.
SAT was not completed before the system became operational.
Key program issues exist that increase risks if not resolved.
Independent verification and validation (IV&V) contractor’s roles may be  conflicting.
Program-level change control board has not been established.
Expenditure plan does not disclose management reserve funding.
Land POE workforce and facility needs are uncertain.
To assist DHS in managing US-VISIT, we are making eight recommendations to  the Secretary of DHS.
In their comments on a draft of this briefing, US-VISIT program officials stated that  they generally agreed with the briefing and that it was fair and balanced.
section_title: The US-VISIT program is a governmentwide endeavor intended to enhance national security, facilitate legitimate trade and travel, contribute to the integrity of the U.S. immigration system, and adhere to U.S. privacy laws and policies by
paragraphs: collecting, maintaining, and sharing information on certain foreign nationals who enter and exit the United States; identifying foreign nationals who (1) have overstayed or violated the terms of  their visit; (2) can receive, extend, or adjust their immigration status; or  (3) should be apprehended or detained by law enforcement officials;  detecting fraudulent travel documents, verifying traveler identity, and  determining traveler admissibility through the use of biometrics; and facilitating information sharing and coordination within the border management community.
section_title: The following graphic shows the organizational placement for the US-VISIT program.
section_title: Organizational Placement of US-VISIT Program (Partial DHS Organization Chart)
section_title: Acquisition Strategy
section_title: DHS plans to deliver US-VISIT capability incrementally. Currently, DHS has defined four increments, with Increments 1 through 3 being interim, or temporary, solutions, and Increment 4 being the yet-to-be-defined end vision for US-VISIT. Increments 1 through 3 include the interfacing and enhancement of existing system capabilities and the deployment of these capabilities to air, sea, and land POEs.
section_title: Increment 1 entry capability was deployed to 115 airports and 14 seaports on January 5, 2004. Increment 1 exit capability was deployed as a pilot to two POEs on January 5, 2004.2 According to the Program Director, US-VISIT is developing other exit alternatives and criteria for evaluating and selecting the alternatives. According to the Director, US-VISIT expects to select one or more of the alternatives by December 31, 2004.
paragraphs: Classes of travelers that are not subject to US-VISIT are foreign nationals admitted on A-1, A-2, C-3 (except for attendants, servants, or personal employees of accredited officials), G-1, G-2, G-3, G-4, NATO-1, NATO-2, NATO-3, NATO-4, NATO-5, or NATO-6 visas, unless the Secretary of State and the Secretary of Homeland Security jointly determine that a class of such aliens should be subject to the rule; children under the age of 14; and persons over the age of 79.
The Miami Royal Caribbean seaport and the Baltimore/Washington International Airport.
section_title: Increment 1
paragraphs: included the development of policies, procedures, and associated training for implementing US-VISIT at the air and sea POEs;  included outreach efforts, such as brochures, demonstration videos, and signage at air and sea POEs;   did not include additional inspector staff at air and sea POEs; and  did not include the acquisition of additional entry facilities. For exit, DHS is in  the process of assessing facilities space and installing conduit, electrical  supply, and signage.
Increment 2 is divided into two Increments—2A and 2B.
Increment 2A is to include at all POEs the capability to process machine- readable visas and other travel and entry documents that use biometric  identifiers. This increment is to be implemented by October 26, 2004.
section_title: Increment 2B is to expand the Increment 1 solution for entry to secondary inspection1 at the 50 highest volume land POEs by December 31, 2004. According to the expenditure plan, 2B is also to include the capability to read radio frequency (RF)2 enabled documents at the 50 busiest land POEs for both entry and exit processes.
paragraphs: According to the US-VISIT Deputy Director:  Each of the 745 entry and exit traffic lanes at these 50 land POEs is to  have the infrastructure, such as underground conduit, necessary to install  the RF technology.
Secondary inspection is used for more detailed inspections that may include checking more databases, conducting more intensive interviews of the individual, or both.
RF technology would require proximity cards and card readers. RF readers read the information contained on the card when the card is passed near the reader, and could be used to verify the identity of the card holder.
section_title: For exit lanes without RF, US-VISIT will continue to rely upon the collection
paragraphs: of manually completed I-94 forms1 from exiting travelers.
Increment 3 is to expand Increment 2B system capability to the remaining 115 land POEs. It is to be implemented by December 31, 2005.
I-94 forms have been used for years to track foreign nationals’ arrivals and departures. Each form is divided into two parts: an entry portion and an exit portion. Each form contains a unique number printed on both portions of the form for the purposes of subsequent recording and matching the arrival and departure records on nonimmigrants.
section_title: According to the expenditure plan, the prime contractor will support the integration and consolidation of processes, functionality, and data, and will develop a strategy to build on the technology and capabilities already available to fully support the US- VISIT vision. Meanwhile, the US-VISIT program will continue deploying the interim solution as planned and use the prime contractor to assist in the planning and deployment of the system, as appropriate.
paragraphs: An indefinite-delivery/indefinite-quantity contract provides for an indefinite quantity, within stated limits, of supplies or services during a fixed period of time. The government schedules deliveries or performance by placing orders with the contractor.
section_title: For human capital, DHS does not plan to acquire any additional inspection staff for Increment 2.
section_title: Component Systems
section_title: Arrival Departure Information System (ADIS), a database that stores traveler
paragraphs: IBIS lookout sources include: DHS’s Customs and Border Protection and Immigration and Customs Enforcement; the  Federal Bureau of Investigation; legacy Immigration and Naturalization Service and Customs information; the U.S. Secret Service; the U.S. Coast Guard; the Internal Revenue Service; the Drug Enforcement Agency; the Bureau of Alcohol, Tobacco & Firearms; the U.S. Marshals Service; the U.S. Office of Foreign Asset Control; the National Guard; the Treasury Inspector General; the U.S. Department of Agriculture; the Department of Defense Inspector General; the Royal Canadian Mounted Police; the U.S. State Department; Interpol; the Food and Drug Administration; the Financial Crimes Enforcement Network; the Bureau of Engraving and Printing; and the Department of Justice Office of Special Investigations. This footnote has been modified to include additional information obtained since the briefing’s delivery to the Committees.
section_title: Automated Biometric Identification System (IDENT), a system that collects and
paragraphs: stores biometric data about foreign visitors;1  Student Exchange Visitor Information System (SEVIS), a system that contains  information on foreign students;  Computer Linked Application Information Management System (CLAIMS 3), a  system that contains information on foreign nationals who request benefits, such as change of status or extension of stay; and  Consular Consolidated Database (CCD), a system that includes information on  whether a visa applicant has previously applied for a visa or currently has a valid U.S. visa.
Includes data such as: Federal Bureau of Investigation information on all known and suspected terrorists, selected wanted persons (foreign-born, unknown place of birth, previously arrested by DHS), and previous criminal histories for high-risk countries; DHS Immigration and Customs Enforcement information on deported felons and sexual registrants; DHS information on previous criminal histories and previous IDENT enrollments. Information from the bureau includes fingerprints from the Integrated Automated Fingerprint Identification System. This footnote has been modified to include additional information obtained since the briefing’s delivery to the Committees.
section_title: Increment 1 Process
section_title: Commercial air and sea carriers are required by law to transmit crew and passenger manifests before arriving in the United States. These manifests are transmitted through APIS. The APIS lists are run against the biographic lookout system and identify those arrivals who have biometric data available.
section_title: Biographic information, such as name and date of birth, is displayed on the bottom half of the screen, as well as the photograph from State’s CCD. IBIS also returns information about whether there are, within IDENT, existing fingerprints for the foreign national.
section_title: While the system is checking the fingerprints, the inspector questions the foreign national about the purpose of his or her travel and length of stay. The inspector adds the class of admission and duration of stay information into the IBIS system, and stamps the “admit until” date on the I-94 form.
section_title: The status management process manages the foreign national’s temporary presence in the United States, including the adjudication of benefits applications and investigations into possible violations of immigration regulations. ADIS matches entry and exit manifest data to ensure that each record showing a foreign national entering the United States is matched with a record showing the foreign national exiting the United States. ADIS receives status information from CLAIMS 3 and SEVIS on foreign nationals.
section_title: The following graphic shows Increment 1, as deployed on January 5, 2004.2
paragraphs: A CD-ROM is a digital storage device that is capable of being read, but not overwritten.
CLAIMS 3’s interface with ADIS was deployed and implemented on February 11, 2004.
section_title: Simplified Diagram of US-VISIT Increment 1 System Components and Process
section_title: GAO’s Review of Fiscal Year 2003 Expenditure Plan
section_title: Program management capability is not implemented.
paragraphs: U.S. General Accounting Office, Homeland Security: Risks Facing Key Border and Transportation Security Program Need to Be Addressed, GAO-03-1083 (Washington, D.C.: Sept. 19, 2003).
Operational context is unsettled.
Near-term facilities solutions pose challenges.
Mission value of first increment is currently unknown.
GAO’s Review of Fiscal Year 2002 Expenditure Plan In our report on the fiscal year 2002 expenditure plan,1 we reported that  INS intended to acquire and deploy a system with functional and performance capabilities consistent with the general scope of capabilities under various laws; the plan did not provide sufficient information to allow Congress to oversee the program; INS had not developed a security plan and privacy impact assessment; and INS had not implemented acquisition management controls in the area of  acquisition planning, solicitation, requirements development and management, project management, contract tracking and oversight, and evaluation consistent with SEI guidance.
We made recommendations to address these areas.
U.S. General Accounting Office, Information Technology: Homeland Security Needs to Improve Entry Exit System Expenditure Planning, GAO-03-563 (Washington, D.C.: June 9, 2003).
Fiscal Year 2004 Expenditure Plan Summary (see next slides for descriptions)
section_title: Description of How Funds Are to Be Used
section_title: Increment 2B—Land: This area includes costs required for the development of land infrastructure upgrades, system development and testing, and RF technology to the 50 busiest land POEs.
section_title: Operations and Maintenance: This area includes operations and maintenance of existing information systems. After deployment, this cost is to be transferred to the organizations that are responsible for the individual systems. This transfer of costs is expected by fiscal year 2006.
section_title: Summary of US-VISIT Appropriations and Reported Obligations
paragraphs: Available appropriations (millions)
The US-VISIT expenditure plan satisfies or partially satisfies each of the legislative conditions.
Condition 1. The plan, including related program documentation and program officials’ statements, partially satisfies the capital planning and investment control  review requirements established by OMB, including OMB Circular A-11, part 7,  which establishes policy for planning, budgeting, acquisition, and management of  federal capital assets.
The table that follows provides examples of the results of our analysis.
Examples of A-11 conditions Provide justification and describe acquisition strategy.
Summarize life cycle costs and cost/benefit analysis, including the  return on investment.
Results of our analysis US-VISIT has completed an Acquisition Plan dated November 28, 2003. The plan provides a high-level justification and description of the acquisition strategy for the system. DHS does not have current life cycle costs nor a current cost/benefit analysis for US-VISIT. According to program officials, US-VISIT has a draft life cycle cost estimate and cost/benefit analysis. Both are expected to be completed in March 2004.A security plan for US-VISIT has not been developed. Instead, US-VISIT was certified and accredited based upon the  updated security certification for each of Increment 1’s component systems. The US-VISIT program published a privacy impact assessment on January 5, 2004.
Provide risk inventory and assessment. US-VISIT has developed a draft risk management plan and a  process to implement and manage risks. US-VISIT also maintains a risk and issues tracking database.
Condition 2. The plan, including related program documentation and program officials’ statements, satisfies this condition by providing for compliance with DHS’s  enterprise architecture.
DHS released version 1 of the architecture in October 2003.1 It plans to issue  version 2 in September 2004.
According to the DHS Chief Information Officer (CIO), DHS is developing a process  to align its systems modernization efforts, such as US-VISIT, to its enterprise  architecture. Alignment of US-VISIT to the enterprise architecture has not yet been  addressed, but DHS CIO and US-VISIT officials stated that they plan to do so.
Department of Homeland Security Enterprise Architecture Compendium Version 1.0 and Transitional Strategy.
Condition 3. The plan, including related program documentation and program officials’ statements, satisfies the condition that it comply with the acquisition rules, requirements, guidelines, and systems acquisition management practices of the  federal government. These criteria provide a management framework based on the  use of rigorous and disciplined processes for planning, managing, and controlling the acquisition of IT resources, including acquisition planning, solicitation, requirements development and management, project management, contract tracking and oversight, and evaluation.
The table that follows provides examples of the results of our analysis.
The US-VISIT program has developed and documented an acquisition strategy and plan for a prime contractor to perform activities for modernizing US-VISIT business processes and systems, calling for, among other things, these activities to meet all  relevant legislative requirements. Activities identified include U.S. border management- related work and support; other DHS-related strategic planning, and any associated systems development and integration, business process reengineering, organizational change management, information technology support, and program management work and support; and other business, technical, and management capabilities to meet the legislative mandates, operational needs, and government business requirements.
The strategy defines a set of acquisition objectives, identifies key roles and responsibilities, sets general evaluation criteria, and establishes a high-level acquisition schedule.
The plan describes initial tasking, identifies existing systems with which to interoperate/interface, defines a set of high-level risks, and lists applicable legislation.
The RFP for the prime contractor acquisition was issued on November 28, 2003. A  selecting official has been assigned responsibility, and a team, including contract specialists, has been formed and has received training related to this acquisition. A set  of high-level evaluation factors have been defined for selecting the prime integrator, and the team plans to define more detailed criteria.
Condition 4 met. The plan, including related program documentation and program officials’ statements, satisfies the requirement that it be reviewed and approved by  DHS and OMB.
DHS and OMB reviewed and approved the US-VISIT fiscal year 2004 expenditure plan. Specifically, the DHS IRB1 approved the plan on December 17, 2003, and  OMB approved the plan on January 27, 2004.
The IRB is the executive review board that provides acquisition oversight of DHS level 1 investments and conducts portfolio management. Level 1 investment criteria are contract costs exceeding $50 million; importance to DHS strategic and performance plans; high development, operating, or maintenance costs; high risk; high return; significant resource administration; and life cycle costs exceeding $200 million. According to the DHS CIO, US-VISIT is a level 1 investment.
Condition 5 met. The plan satisfies the requirement that it be reviewed by GAO.
Our review was completed on March 2, 2004.
Open Recommendation 1: Develop a system security plan and privacy impact assessment.
Security Plan. DHS does not have a security plan for US-VISIT. Although program  officials provided us with a draft document entitled Security & Privacy:  Requirements & Guidelines Version 1.0,1 this document does not include information consistent with relevant guidance for a security plan.
The OMB and the National Institute of Standards and Technology have issued security planning guidance.2 In general, this guidance requires the development of  system security plans that (1) provide an overview of the system security requirements, (2) include a description of the controls in place or planned for meeting the security requirements, (3) delineate roles and responsibilities of all  individuals who access the system, (4) discuss a risk assessment methodology, and (5) address security awareness and training.
Security & Privacy: Requirements & Guidelines Version 1.0 Working Draft, US-VISIT Program (May 15, 2003).
Office Management and Budget Circular Number A-130, Revised (Transmittal Memorandum No. 4), Appendix III, “Security of Federal Automated Information Resources” (Nov. 28, 2000) and National Institute of Standards and Technology, Guide for Developing Security Plans for Information Systems, NIST Special Publication 800-18 (December 1998).
The draft document identifies security requirements for the US-VISIT program and  addresses the need for training and awareness. However, the document does not  include (1) specific controls for meeting the security requirements, (2) a risk  assessment methodology, and (3) roles and responsibilities of individuals with system access. Moreover, with the exception of the US-VISIT security  requirements, much of the document discusses guidelines for developing a security  plan, rather than specific contents of US-VISIT security plan.
Despite the absence of a security plan, the US-VISIT CIO accredited Increment 1  based upon updated security certifications1 for each of Increment 1’s component systems (e.g., ADIS, IDENT, and IBIS) and a review of the documentation, including component security plans, associated with these updates. According to  the security evaluation report (SER), the risks associated with each component system were evaluated, component system vulnerabilities were identified, and component system certifications were granted.
Certification is the evaluation of the extent to which a system meets a set of security requirements. Accreditation is the  authorization and approval granted to a system to process sensitive data in an operational environment; this is made on the basis of a compliance certification by designated technical personnel of the extent to which design and implementation of the system meet defined technical requirements for achieving data security.
Based on the SER, the US-VISIT security officer certified Increment 1, and Increment 1 was accredited and granted an interim authority to operate for 6  months. This authority will expire on June 18, 2004.
Additionally, this authority would not extend to a modified version of Increment 1.  For example, the SER states that US-VISIT exit functionality was not part of the  Increment 1 certification and accreditation, and that it was to be certified and accredited separately from Increment 1. The SER also notes that the Increment 1  certification will require updating upon the completion of security documentation for  the exit functionality.
Privacy Impact Assessment. The US-VISIT program has conducted a privacy impact assessment for Increment 1. According to OMB guidance,1 the depth and  content of such an assessment should be appropriate for the nature of the  information to be collected and the size and complexity of the system involved.
OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002, OMB M-03-22 (Sept. 26, 2003).
The assessment should also, among other things, (1) identify appropriate measures for mitigating identified risks, (2) discuss the rationale for the final design  or business process choice, (3) discuss alternatives to the designed information collection and handling, and (4) address whether privacy is provided for in system  development documentation.
The OMB guidance also notes that an assessment may need to be updated before  deploying a system in order to, among other things, address choices made in  designing the system or in information collection and handling.
The Increment 1 assessment satisfies some, but not all, of the above four OMB  guidance areas. Specifically, it identifies Increment 1 privacy risks, discusses  mitigation strategies for each risk, and briefly discusses the rationale for design choices. However, the assessment does not discuss alternatives to the designed methods of information collection and handling. Additionally, the Increment 1  systems documentation does not address privacy issues.
According to the Program Director, the assessment will be updated for future increments.
Open Recommendation 2: Develop and implement a plan for satisfying key  acquisition management controls, including acquisition planning, solicitation, requirements development and management, project management, contract tracking and oversight, evaluation, and transition to support, and implement the  controls in accordance with SEI guidance.
According to the US-VISIT Program Director, the program office has established a  goal of achieving SEI Software Acquisition Capability Maturity Model (SA-CMM®) level 2, and the office’s Acquisition and Program Management Lead has  responsibility for achieving this status. To facilitate attaining this goal, the  Acquisition and Program Management Lead’s organization includes functions consistent with the management controls defined by the SA-CMM®, such as  acquisition planning and requirements development and management.
According to the Acquisition and Program Management Lead, an approach for  achieving level 2 will be defined as part of a strategy that has yet to be developed. However, the lead could not provide a date for when the strategy would be developed. The expenditure plan indicates that the US-VISIT program office will  solicit SEI’s participation in achieving level 2.
Open Recommendation 3: Ensure that future expenditure plans are provided to  the Department’s House and Senate Appropriations Subcommittees on Homeland Security in advance of US-VISIT funds being obligated.
The Congress appropriated $330 million in fiscal year 2004 funds for the US-VISIT  program.1 On January 27, 2004, DHS provided its fiscal year 2004 expenditure plan to the  Senate and House Appropriations Subcommittees on Homeland Security.
On January 26, 2004, DHS submitted to the Senate and House Appropriations Subcommittees on Homeland Security a request for the release of $25 million from  the fiscal year 2004 appropriations.
Department of Homeland Security Appropriations Act, 2004, Pub. L. 108-90 (Oct. 1, 2003).
Open Recommendation 4: Ensure that future expenditure plans fully disclose US- VISIT system capabilities, schedule, cost, and benefits to be delivered.
The expenditure plan identifies high-level capabilities, such as  record arrival of foreign nationals, identify foreign nationals who have stayed beyond the authorized period, and  use biometrics to verify identity of foreign nationals.
The plan does not associate these capabilities with specific increments.
The plan identifies a high-level schedule for implementing the system. For  example, Increment 2A is to be implemented by October 26, 2004; Increment 2B  by December 31, 2004; and Increment 3 by December 31, 2005.
The plan identifies total fiscal year 2004 costs by each increment. For example,  DHS plans to obligate $73 million in fiscal year 2004 funds for Increment 2A. However, the plan does not break out how the $73 million will be used to support  Increment 2A, beyond indicating that the funds will be used to read biometric information in travel documents, including fingerprints and photos, at all ports of  entry. Also, the plan does not identify any nongovernment costs.
The plan identifies seven general benefits and planned performance metrics for  measuring three of the seven benefits. The plan does not associate the benefits with increments.
The following table shows US-VISIT benefits and whether associated metrics have  been defined. metric defined?
Open Recommendation 5: Establish and charter an executive body composed of  senior-level representatives from DHS and each stakeholder organization to guide  and direct the US-VISIT program.
DHS has established a three-entity governance structure. The entities are (1) the  Homeland Security Council (HSC), (2) the DHS Investment Review Board (IRB),  and (3) the US-VISIT Federal Stakeholders Advisory Board.
The HSC is tasked with ensuring the coordination of all homeland security- related activities among executive departments and agencies and is composed of senior-level executives from across the federal government. According to  the expenditure plan, the HSC helps to set policy boundaries for the US-VISIT  program.
According to DHS’s investment management guidance,1 the IRB is the  executive review board that provides acquisition oversight of DHS level 1  investments2 and conducts portfolio management. The primary function of the  IRB is to review level 1 investments for formal entry into the budget process and at key decision points. The plan states that the IRB is to monitor the US- VISIT program’s achievement of cost, schedule, and performance goals.
DHS Management Directive 1400, Investment Review Process (undated).
Level 1 investment criteria are contract costs exceeding $50 million; importance to DHS strategic and performance plans;  high development, operating, or maintenance costs; high risk; high return; significant resource administration; and life cycle costs exceeding $200 million. According to the DHS CIO, US-VISIT is a level 1 investment.
According to its charter, the Advisory Board provides recommendations for  overseeing US-VISIT management and performance activities, including  providing advice on the overarching US-VISIT vision;  recommending the overall US-VISIT strategy and its responsiveness to all operational missions, both within DHS and with its participating government agencies;  recommending changes to the US-VISIT vision and strategic direction;  providing a communication link for aligning strategic direction, priorities, and resources with stakeholder operations;  reviewing and assessing US-VISIT programwide institutional processes to  ensure that business, fiscal, and technical priorities are integrated and carried out in accordance with established priorities; and  reviewing and recommending new US-VISIT program initiatives, including the scope, funding, and programmatic resources required.
Open Recommendation 6: Ensure that human capital and financial resources are  provided to establish a fully functional and effective program office.
DHS established the US-VISIT program office in July 2003 and determined the  office’s staffing needs to be 115 government and 117 contractor personnel.
As of February 2004, DHS had filled all the program office’s 12 key management and 29 other positions, leaving 74 positions to be filled. All filled positions are currently staffed by detailees from other organizational units within DHS, such as  Immigration and Customs Enforcement.
The graphic on the next page shows the US-VISIT program office organization structure and functions, the number of positions needed by each office, and the  number of positions filled by detailees.
In addition to the 115 government staff anticipated, the program anticipated 117  contractor support staff. As of February 2004, program officials told us they had  filled 97.5 of these 117.
Open Recommendation 7: Clarify the operational context in which US-VISIT is to  operate.
DHS is in the process of defining the operational context in which US-VISIT is to  operate. In October 2003, DHS released version 1 of its enterprise architecture, and it plans to issue version 2 in September 2004.1 We are currently reviewing DHS’s latest version of its architecture at the request of the House Committee on  Government Reform’s Subcommittee on Technology, Information Policy, Intergovernmental Relations, and the Census.
Department of Homeland Security Enterprise Architecture Compendium Version 1.0 and Transitional Strategy.
Open Recommendation 8: Determine whether proposed US-VISIT increments will  produce mission value commensurate with cost and risks.
The expenditure plan identifies high-level benefits to be provided by the US-VISIT program, such as the ability to prevent the entry of high-threat or inadmissible individuals through improved and/or advanced access to data before the foreign national’s arrival. However, the plan does not associate these benefits with specific  increments. Further, the plan does not identify the total estimated cost of Increment  2. Instead, the plan identifies only fiscal year 2004 funds to be obligated for  Increments 2A and 2B, which are $73 million and $81 million, respectively. In  addition, the plan does not include any nongovernmental costs associated with US- VISIT. The RFP indicates that the total solution for Increment 2 has not been determined and will not be finalized until the prime contractor is on board. Until that  time, DHS is not in a position to determine the total cost of Increments 2A and 2B,  and thus whether they will produce mission value commensurate with costs.
According to program officials, they have developed a life cycle cost estimate and  cost-benefit analysis that are currently being reviewed and are to be completed in  March 2004. According to these officials, the cost-benefit analysis will be for  Increment 2B.
Open Recommendation 9: Define US-VISIT program office positions, roles, and  responsibilities.
The US-VISIT program is working with the Office of Personnel Management (OPM) through an interagency agreement to, among other things, assist the program office in defining its position descriptions (including position roles and responsibilities), issuing vacancy announcements, and recruiting persons to fill the  positions.
The US-VISIT program is also working with OPM to define the competencies that  are to be used in defining the position descriptions. As of February 2004, the  program office reported that it has partially completed defining the competencies for its 12 offices and has partially competed position descriptions for 4 of the 12  offices.
The following slide shows the competencies defined and position descriptions written.
Open Recommendation 10: Develop and implement a human capital strategy for  the US-VISIT program office that provides for staffing positions with individuals who have the appropriate knowledge, skills, and abilities.
The US-VISIT program office has not yet defined a human capital strategy,  although program officials stated that they plan to develop one in concert with the  department’s ongoing workforce planning. As part of its effort, DHS is drafting a  departmental workforce plan that, according to agency officials, will likely be completed during fiscal year 2004.
According to the Program Director, the Director of Administration and Management is responsible for developing the program’s strategic human capital plan. However, descriptions of the Administration and Management office functions, including those provided by the program office and those in the expenditure plan, do not  include strategic human capital planning.
Open Recommendation 11: Develop a risk management plan and report all high risks and their status to the executive body on a regular basis.
The program office has developed a draft risk management plan, dated June 2003. The draft defines plans to develop, implement, and institutionalize a risk  management program. The program’s primary function is to identify and mitigate  US-VISIT risks.
The expenditure plan states that the program office is currently defining risk  management processes. In the interim, the program office is creating a risk management team to assist the program office in proactively identifying and managing risks while formal processes and procedures are being developed.
The expenditure plan also states that the US-VISIT program office currently  maintains a risk and issue tracking database and conducts weekly risk and schedule meetings. Within the risk database, each risk is assigned a risk impact rating and an owner. The database also gives the date when the risk is considered closed. In addition, the US-VISIT program office has staff dedicated to tracking  these items and meeting weekly with the various integrated project teams to  mitigate potential risks.
Open Recommendation 12: Define performance standards for each US-VISIT increment that are measurable and reflect the limitations imposed by relying on  existing systems.
US-VISIT has defined limited, measurable performance standards. For example:  System availability1—the system shall be available 99.5 percent of the time.
Data currency—(1) US-VISIT Increment 1 Doc Key2 data shall be made  available to any interfacing US-VISIT system within 24 hours of the event (enrollment, biometric encounter, departure, inspector modified data); (2) IBIS/APIS arrival manifests, departure manifests, and inspector-modified data shall be made available to ADIS within 24 hours of each stated event; and  (3) IDENT shall reconcile a biometric encounter within 24 hours of the event.
System availability is defined as the time the system is operating satisfactorily, expressed as a percentage of time that the system is required to be operational.
DocKey includes such information as biographical data and the fingerprint identification number, and is used to track a foreign national’s identity as the information is shared between systems.
However, not all performance standards are being defined in a way that reflects the  performance limitations of existing systems.
In particular, US-VISIT documentation states that the system performance standard for Increment 1 is 99.5 percent. However, Increment 1 availability is the product of  its component system availabilities. Given that US-VISIT system documentation also states that the system availability performance standard for IDENT and ADIS  is 99.5 percent, Increment 1 system availability would have to be something less  than 99.5 percent (99.5 x 99.5 x other component systems’ availability).
Observation 1: Increment 1 commitments were largely met; the system is  deployed and operating.
According to DHS, Increment 1 was to deliver an initial operating capability to all air  and sea POEs by December 31, 2003, that included recording the arrival and departure of foreign nationals using passenger and crew manifest data,  verifying foreign nationals’ identity upon entry into the United States through the use of biometrics and checks against watchlists at air POEs and 13 of 42  sea POEs,  interfacing with seven existing systems that contain data about foreign  nationals, identifying foreign nationals who have overstayed their visits or changed their  visitor status, and   potentially including an exit capability beyond the capture of the manifest data.
Generally, an initial operating capability was delivered to air and sea POEs on  January 5, 2004. In particular, Increment 1 entry capability (including biographic and biometric data collection) was deployed to 115 airports and 14 seaports on  January 5, 2004. Further, while the expenditure plan states that an Increment 1 exit capability was deployed to 80 air and 14 sea POEs on January 5, 2004, exit capability (including biometric capture) was deployed to only one air POE  (Baltimore/Washington International Airport) and one sea POE (Miami Royal Caribbean seaport).
DHS’s specific satisfaction of each commitment is described on the following slides.
INS Data Management Improvement Act of 2000, Pub. L. 106-215 (June 15, 2000).
Recording the arrival and departure of foreign nationals using passenger and crew  manifest data:  Satisfied: Carriers submit electronic arrival and departure manifest data to  IBIS/APIS.
Verifying foreign nationals’ identity upon entry into the United States through the  use of biometrics and checks against watchlists at air POEs and 13 sea POEs:  Satisfied: After carriers submit electronic manifest data to IBIS/APIS,  IBIS/APIS is queried to determine whether there is any biographic lookout or  visa information for the foreign national. Once the foreign national arrives at a  primary POE inspection booth, the inspector, using a document reader, scans the machine-readable travel documents. IBIS/APIS returns any existing  records on the foreign national, including manifest data matches and biographic lookout hits. When a match is found in the manifest data, the  foreign national’s name is highlighted and outlined on the manifest data portion of the screen. (Verifying foreign nationals’ identity, cont’d)
Biographic information, such as name and date of birth, is displayed on the  bottom half of the screen, as well as the picture from the scanned visa. IBIS  also returns information about whether there are, within IDENT, existing  fingerprints for the foreign national.
The inspector switches to the IDENT screen and scans the foreign national’s fingerprints (left and right index fingers) and photograph. The system accepts  the best fingerprints available within the 5-second scanning period. This  information is forwarded to the IDENT database, where it is checked against stored fingerprints in the IDENT lookout database. If no prints are currently in  the IDENT database, the foreign national is enrolled in US-VISIT (i.e.,  biographic and biometric data are entered). If the foreign national’s fingerprints are already in IDENT, the system performs a 1:1 match (a comparison of the  fingerprint taken during the primary inspection to the one on file) to confirm that  the person submitting the fingerprints is the person on file. If the system finds a  mismatch of fingerprints or a watchlist hit, the foreign national is sent to  secondary inspection for further screening or processing.
Interfacing seven existing systems that contain data about foreign nationals:  Largely satisfied: As of January 5, 2004, US-VISIT interfaced six of seven  existing systems. The CLAIMS 3 to ADIS interface was not operational on January 5, 2004, but program officials told us that it was subsequently placed into production on February 11, 2004.
Identifying foreign nationals who have overstayed their visits or changed their  visitor status:  Largely satisfied: ADIS matches entry and exit manifest data provided by air and sea carriers. The exit process includes the carriers’ submission of  electronic manifest data to IBIS/APIS. This biographic information is passed to  ADIS, where it is matched against entry information. (Verifying foreign nationals who overstay or change status, cont’d)
US-VISIT was to rely on interfaces with CLAIMS 3 and SEVIS to obtain  information regarding changes in visitor status. However, as of January 5,  2004, the CLAIMS 3 interface was not operational; it was subsequently placed into production on February 11, 2004. Further, although the SEVIS to ADIS interface was implemented on January 5, 2004, after January 5, problems surfaced, and manual workarounds had to be implemented. According to the  program officials, the problems are still being addressed.
Potentially include an exit capability beyond the capture of the manifest data:  Not satisfied: Biometric exit capability was not deployed to the 80 air1 and 14  sea POEs that received Increment 1 capability. Instead, biometric exit capability was provided to two POEs for pilot testing. Under this testing, foreign nationals use a self-serve kiosk where they are prompted to scan their travel documentation and provide their fingerprints (right and left index fingers). On a  daily basis, the information collected on departed passengers is downloaded to  a CD-ROM.2 The CD is then express mailed to a DHS contractor facility to be  uploaded into IDENT, where a 1:1 match is performed (i.e., the fingerprint captured during entry is compared with the one captured at exit).
According to program officials, biometric capture for exit was deployed at two  POEs on January 5, 2004, as a pilot. According to these officials, this exit capability was deployed to only two POEs because US-VISIT decided to  evaluate other exit alternatives.
Only 80 of the 115 air POEs are departure airports for international flights.
A CD-ROM is a digital storage device that is capable of being read, but not overwritten.
Observation 2: The system acceptance test (SAT) plan was developed largely during and after test execution.
The purpose of SAT is to identify and correct system defects (i.e., unmet system functional, performance, and interface requirements) and thereby obtain reasonable assurance that the system performs as specified before it is deployed and operationally used. To be effective, testing activities should be planned and  implemented in a structured and disciplined fashion. Among other things, this  includes developing effective test plans to guide the testing activities. According to  relevant systems development guidance,1 SAT plans are to be developed before  test execution.
However, this was not the case for Increment 1. Specifically, the US-VISIT program  provided us with four versions of a test plan, each containing more information than  the previous version. While the initial version was dated September 18, 2003, which is before testing began, the three subsequent versions (all dated November 17, 2003) were modified on November 25, 2003, December 18, 2003, and January  16, 2004, respectively.
According to US-VISIT officials, in the absence of a DHS Systems Development Life Cycle (SDLC), they followed the former Immigration and Naturalization Service’s SDLC, version 6.0, to manage US-VISIT development.
According to the program office, the version modified on January 16, 2004, is the  final plan. According to the SAT Test Analysis Report (dated January 23, 2004),  testing began on September 29, 2003, and was completed on January 7, 2004, meaning that the plans governing the execution of testing were not sufficiently developed before test execution.1 The following timeline compares test plan development and execution.
According to an IT management program official, although the Test Analysis Report was marked “Final,” it is still being reviewed.
According to US-VISIT officials, SAT test plans were not completed before testing  began because of the compressed schedule for testing. According to these  officials, a draft test plan was developed and periodically updated to reflect documentation provided by the component contractors.
In the absence of a complete test plan before testing began, the US-VISIT program  office unnecessarily increased the risk that the testing performed would not adequately address Increment 1 requirements, which increased the chances of  either having to redo already executed tests or deploy a system that would not perform as intended. In fact, postdeployment problems surfaced with the SEVIS interface, and manual workarounds had to be implemented. According to the  program officials, the problems are still being addressed.
Observation 3: SAT plan available during testing was not complete.
To be effective, testing activities should be planned and implemented in a  structured and disciplined fashion. Among other things, this includes developing effective test plans to guide the testing activities. According to relevant systems  development guidance, a complete test plan (1) specifies the test environment, including test equipment, software, material, and necessary training; (2) describes each test to be performed, including test controls, inputs, and expected outputs; (3) defines the test procedures to be followed in conducting the tests; and (4) provides traceability between test cases and the requirements to be verified by the  testing.1 This guidance also requires that the system owner concur with, and the IT  project manager approve, the test plan before SAT testing.
According to US-VISIT officials, in the absence of a DHS Systems Development Life Cycle (SDLC), they followed the former Immigration and Naturalization Service’s SDLC, version 6.0, to manage US-VISIT development.
As previously noted, the US-VISIT program office provided us with four versions of  the SAT test plan. The first three versions of the plan were not complete. The final  plan largely satisfied the above criteria.
The September 18, 2003, test plan included a description of the test  environment and a brief description of tests to be performed, but the  description of the tests did not include controls, inputs, and expected outputs. Further, the plan did not include specific test procedures for implementing the  test cases and provide traceability between the test cases and the  requirements that they were designed to test.
Similarly, the November 25, 2003, test plan included a description of the test environment and a brief description of tests to be performed, but the  description of the tests did not include controls, inputs, and expected outputs. Further, the plan did not include specific test procedures for implementing the  test cases or provide traceability between the test cases and the requirements they were designed to test.
The December 18, 2003, test plan included a description of the test  environment and a brief description of 55 tests to be performed. The plan also described actual test procedures and controls, inputs, and expected outputs for  24 of the 55 test cases. The plan included traceability between the test cases  and requirements.
The January 16, 2004, test plan included a description of the test environment; the tests to be performed, including inputs, controls, and expected outputs; the  actual test procedures for each test case; and traceability between the test cases and requirements.
None of the test plan versions, including the final version, indicated concurrence by  the system owner or approval by the IT project manager.
The following graphic shows the SAT plans’ satisfaction of relevant criteria.
According to US-VISIT officials, SAT test plans were not completed before testing  began because the compressed schedule necessitated continuously updating the  plan as documentation was provided by the component contractors. According to  an IT management official, test cases were nevertheless available for ADIS and  IDENT in these systems’ regression test plans or in a test case repository.
Without a complete test plan for Increment 1, DHS did not have adequate assurance that the system was being fully tested, and it unnecessarily assumed the  risk that errors detected would not be addressed before the system was deployed, and that the system would not perform as intended when deployed. In fact,  postdeployment problems surfaced with the SEVIS interface, and manual workarounds had to be implemented. According to the program officials, the  problems are still being addressed.
Observation 4: SAT was not completed before the system became operational.
The purpose of SAT is to identify and correct system defects (i.e., unmet system functional, performance, and interface requirements) and thereby obtain reasonable assurance that the system performs as specified before it is deployed and operationally used. SAT is accomplished in part by (1) executing a predefined set of test cases, each traceable to one or more system requirements, (2) determining if test case outcomes produce expected results, and (3) correcting identified problems. To the extent that test cases are not executed, the scope of  system testing can be impaired, and thus the level of assurance that the system will  perform satisfactorily is reduced.
Increment 1 began operating on January 5, 2004. However, according to the SAT  Test Analysis Report, testing was completed 2 days after Increment 1 began operating (January 7, 2004). Moreover, the Test Analysis Report shows that  important test cases were not executed. For example, none of the test cases  designed to test the CLAIMS 3 and SEVIS interfaces were executed.
According to agency officials, the CLAIMS 3 to ADIS interface was not ready for  acceptance testing before January 5, 2004. Accordingly, deployment of this  capability and the associated testing were deferred; they were completed on February 11, 2004.
Similarly, the SEVIS to ADIS interface was not ready for testing before January 5,  2004. However, this interface was implemented on January 5, 2004, without acceptance testing. According to program officials, the program owner and technical project managers were aware of the risks associated with this approach.
By not fully testing Increment 1 before the system became operational, the program  office assumed the risk of introducing errors into the deployed system and  potentially jeopardizing its ability to effectively perform its core functions. In fact,  postdeployment problems surfaced with the SEVIS interface as a result of this  approach, and manual workarounds had to be implemented. According to the  program officials, the problems are still being addressed.
Observation 5: Independent verification and validation (IV&V) contractor’s roles  may be conflicting.
As we have previously reported,1 the purpose of independent verification and validation (IV&V) is to provide an independent review of system processes and  products. The use of IV&V is a recognized best practice for large and complex system development and acquisition projects like US-VISIT. To be effective, the  IV&V function must be performed by an entity that is independent of the processes  and products that are being reviewed.
The US-VISIT program plans to use its IV&V contractor to review some of the processes and products that the contractor may be responsible for. For example,  the contractor statement of work, dated July 18, 2003, states that it shall provide  program and project management support, including providing guidance and direction and creating some of the strategic program and project level products. At  the same time, the statement of work states that the contractor will assess  contractor and agency performance and technical documents.
U.S. General Accounting Office, Customs Service Modernization: Results of Review of First Automated Commercial Environment Expenditure Plan, GAO-01-696 (Washington, D.C.: June 5, 2001).
Depending on the products and processes in question, this approach potentially does not satisfy the independence requirements of effective IV&V, because the  reviews conducted could lack independence from program cost and schedule pressures. Without effective IV&V, DHS is unnecessarily exposing itself to the risk  that US-VISIT increments will not perform as intended or be delivered on time and  within budget.
Observation 6: Program-level change control board has not been established.
The purpose of configuration management is to establish and maintain the integrity  of work products (e.g., hardware,software, and documentation). According to  relevant guidance,1 system configuration management includes four management tasks: (1) identification of hardware and software parts (items/components/ subcomponents) to be formally managed, (2) control of changes to the parts, (3) periodic reporting on configuration status, and (4) periodic auditing of  configuration status. A key ingredient to effectively controlling configuration change  is the functioning of a change control board (CCB); using such a board is a structured and disciplined approach for evaluating and approving proposed configuration changes.
SEI’s Capability Maturity Model ® Integration (CMMISM) for Systems Engineering, Software Engineering, Integrated Product and Process Development, and Supplier Sourcing, Version 1.1 (Pittsburgh: March 2002).
According to the US-VISIT CIO, the program does not yet have a change control board. In the absence of one, program officials told us that changes related to  Increment 1 were controlled primarily through daily coordination meetings (i.e., oral  discussions) among representatives from Increment 1 component systems (e.g.,  IDENT, ADIS, and IBIS) teams and program officials, and the CCBs already in  place for the component systems.
The following graphic depicts the US-VISIT program’s interim change control board approach compared to a structured and disciplined program-level change control  approach. In particular, the interim approach requires individuals from each system  component to interface with as many as six other stakeholders on system changes.  Moreover, these interactions are via human-to-human communication. In contrast,  the alternative approach reduces the number of interfaces to one for each  component system and relies on electronic interactions with a single control point  and an authoritative configuration data store.
Without a structured and disciplined approach to change control, the US-VISIT  program does not have adequate assurance that approved system changes are  actually made; that approved changes are based, in part, on US-VISIT impact and  value rather than solely on system component needs; and most importantly, that  changes made to the component systems for non-US-VISIT purposes do not interfere with US-VISIT functionality.
Observation 7: Expenditure plan does not disclose management reserve funding.
The creation and use of a management reserve fund to earmark resources for  addressing the many uncertainties that are inherent in large-scale systems acquisition programs is an established practice and a prudent management approach. The appropriations committees have historically supported an explicitly designated management reserve fund in expenditure plans submitted for such  programs as the Internal Revenue Service’s Business Systems Modernization and DHS’s Automated Commercial Environment. Such explicit designation provides the  agency with a flexible resource source for addressing unexpected contingencies that can inevitably arise in any area of proposed spending on the program, and it  provides the Congress with sufficient understanding about management reserve funding needs and plans to exercise oversight over the amount of funding and its  use.
The fiscal year 2004 US-VISIT expenditure plan does not contain an explicitly designated management reserve fund. According to US-VISIT officials, including the program director, reserve funding is instead embedded within the expenditure plan’s various areas of proposed spending. However, the plan does not specifically disclose these embedded reserve amounts. We requested but have yet to receive  information on the location and amounts of reserve funding embedded in the plan.1 By not creating, earmarking, and disclosing a specific management reserve fund in  its fiscal year 2004 US-VISIT expenditure plan, DHS is limiting its flexibility in  addressing unexpected problems that could arise in the program’s various areas of  proposed spending, and it is limiting the ability of the Congress to exercise effective  oversight of this funding.
In agency comments on a draft of this report, US-VISIT stated that it supported establishing a management reserve and would be revising its fiscal year 2004 expenditure plan to identify a discrete management reserve amount.
Observation 8: Land POE workforce and facility needs are uncertain.
Effectively planning for program resource needs, such as staffing levels and facility  additions or improvements, depends on a number of factors, including the assumptions being made about the scope of the program and the sufficiency of  existing staffing levels and facilities. Without reliable assumptions, the resulting projections of resource needs are at best uncertain.
For entry at land POEs, DHS plans for Increment 2B do not call for additional staff  or facilities. The plans do not call for acquiring and deploying any additional staff to  collect biometrics while processing foreign nationals through secondary inspection areas. Similarly, these plans provide for using existing facilities, augmented only by  such infrastructure improvements as conduits, electrical supply, and signage. For  exit at land POEs, DHS’s plans for Increment 2B also do not call for additional staff  or facilities, although they do provide for installation of RF technology at yet-to-be- defined locations in the facility area to record exit information.
US-VISIT Increment 2B workforce and facility plans are based on various assumptions, including (1) no additional foreign nationals will need to go to  secondary inspection and (2) the average time needed to capture the biometric information will be 15 seconds, based on the Increment 1 experience at air POEs. However, these assumptions raise questions for several reasons.
According to DHS program officials, including the Acting Increment 2B  Program Manager, the Director of Facilities and Engineering, and the Program Director, any policy changes that could significantly increase the number of foreign nationals who would require processing through US-VISIT could impact  these assumptions and thus staffing and facilities needs.
According to the Increment 1 pilot test results, the average time needed to capture biometric information is 19 seconds. Moreover, DHS facilities told us that they have yet to model the impact of even the additional 15 seconds for secondary inspections.
Moreover, according to a report from the Data Management Improvement Act Task  Force,1 existing land POE facilities do not adequately support even the current entry and exit processes. In particular, more than 100 land POEs have less than 50  percent of the required capacity (workforce and facilities) to support current inspection processes and traffic workloads.
To assist in its planning, the US-VISIT program office has begun facility feasibility assessments and space utilization studies at each land POE. Until such analysis is  completed, the assumptions being used to support Increment 2B workforce and  facility planning will be questionable, and the projected workforce and facility resource needs will be uncertain.
Data Management Improvement Act Task Force, Second Annual Report to the Congress (Washington, D.C., December 2003).
section_title: To the US-VISIT program office’s credit, the first phase of the program has been deployed and is operating, and the commitments that DHS made regarding this initial operating capability were largely met. However, this was not accomplished in a manner that warrants repeating.
section_title: It is imperative that DHS move swiftly to address the US-VISIT program management weaknesses that we previously identified by implementing our remaining open recommendations. It is equally paramount that the department quickly correct the additional weaknesses that we have identified. To do less increases the risk associated with US-VISIT.
section_title: Develop and approve complete test plans before testing begins. These plans,
paragraphs: at a minimum, should (1) specify the test environment, including test equipment, software, material, and necessary training; (2) describe each test to be performed, including test controls, inputs, and expected outputs;  (3) define the test procedures to be followed in conducting the tests; and  (4) provide traceability between test cases and the requirements to be verified by the testing.
Establish processes for ensuring the independence of the IV&V contractor.
Implement effective configuration management practices, including establishing a US-VISIT change control board to manage and oversee system  changes.
section_title: Identify and disclose management reserve funding embedded in the fiscal year 2004 expenditure plan to the Appropriations Committees.
paragraphs: Ensure that all future US-VISIT expenditure plans identify and disclose management reserve funding.
Assess the full impact of Increment 2B on land POE workforce levels and facilities, including performing appropriate modeling exercises.
To ensure that our recommendations addressing fundamental program  management weaknesses are addressed quickly and completely, we further recommend that the Secretary direct the Under Secretary to have the program director develop a plan, including explicit tasks and milestones, for implementing all our open recommendations, including those provided in this report. We further  recommend that this plan provide for periodic reporting to the Secretary and Under Secretary on progress in implementing this plan. Last, we recommend that the Secretary report this progress, including reasons for delays, in all future US-VISIT  expenditure plans.
section_title: We provided this briefing to and discussed its contents with the US-VISIT program officials, including the Program Director. These officials stated that they generally agreed with our findings, conclusions, and recommendations, and stated that the briefing was fair and balanced. The department also provided some technical comments, which we have incorporated into the briefing, as appropriate.
paragraphs: assessed DHS’s plans and ongoing and completed actions to establish and implement the US-VISIT program (including acquiring the US-VISIT system,  expanding and modifying existing port of entry facilities, and developing and implementing policies and procedures) and compared them to existing  guidance to assess risks.
For DHS-provided data that we did not substantiate, we have made appropriate attribution indicating the data’s source.
We conducted our work at DHS’s headquarters in Washington, D.C., and at its  Atlanta Field Operations Office (Atlanta’s William B. Hartsfield International Airport)  from October 2003 through February 2004 in accordance with generally accepted government auditing standards.
section_title: Comments from the Department of Homeland Security
paragraphs: The following are GAO’s comments on the Department of Homeland  Security’s letter dated April 27, 2004.
subsections: section_title: GAO Comments
paragraphs: 1. We do not agree that the US-VISIT program has a security plan. In  response to our request for the US-VISIT security plan, DHS provided a  draft document entitled Security and Privacy: Requirements &  Guidelines Version 1.0. However, as we state in the report, this  document does not include information consistent with relevant  guidance for a security plan. For example, this guidance states that a  system security plan should (1) provide an overview of the system  security requirements, (2) include a description of the controls in place  or planned for meeting the requirements, (3) delineate roles and  responsibilities of all individuals who have access to the system,  (4) describe the risk assessment methodology to be used, and  (5) address security awareness and training. The document provided by  DHS addressed two of these requirements—security requirements and  training and awareness. As we state in the report, the document does  not (1) describe specific controls to satisfy the security requirements,  (2) describe the risk assessment methodology, and (3) identify roles  and responsibilities of individuals with system access. Further, much of  the document discusses guidelines for developing a security plan,  rather than providing the specific content expected of a plan. 2. Although DHS has completed a Privacy Impact Assessment for  Increment 1, the assessment is not consistent with the Office of  Management and Budget guidance. This guidance says that a Privacy  Impact Assessment should, among other things, (1) identify  appropriate measures for mitigating identified risks, (2) discuss the  rationale for the final design or business process choice, (3) discuss  alternatives to the designed information collection and handling, and  (4) address whether privacy is provided for in system development and  documentation. While the Privacy Impact Assessment for US-VISIT  Increment 1 discusses mitigation strategies for identified risks and  briefly discusses the rationale for design choices, it does not discuss  alternatives to the designed information collection and handling.  Further, Increment 1 system documentation does not address privacy. 3. DHS’s comments did not include a copy of its revised fiscal year 2004  expenditure plan because, according to an agency official, OMB has not  yet approved the revised plan for release, and thus we cannot  substantiate its comments concerning either the amount or the  disclosure of management reserve funding. Further, we are not aware  of any unduly burdensome restrictions and/or approval processes for  using such a reserve. We have modified our report to reflect DHS’s  statement that it supports establishing a management reserve and the  status of revisions to its expenditure plan. 4. We have modified the report as appropriate to reflect these comments  and subsequent oral comments concerning the membership of the US- VISIT Advisory Board. 5. We do not believe that DHS's comments provide any evidence to  counter our observation that the system acceptance test plan was  developed largely during and after testing. In general, these comments  concern the Increment 1 test strategy, test contractor and component  system development team coordination, Increment 1 use cases, and  pre-existing component system test cases, none of which are related to  our point about the completeness of the four versions of the test plan.  More specifically, our observation does not address whether or not an  Increment 1 test strategy was developed and approved, although we  would note that the version of the strategy that the program office  provided to us was incomplete, was undated, and did not indicate any  level of approval. Further, our observation does not address whether  some unspecified level of coordination occurred between the test  contractor and the component system development teams; it does not  concern the development, modification, and use of Increment 1  “overarching” use cases, although we acknowledge that such use cases  are important in developing test cases; and it does not address the pre- existence of component system test cases and their residence in a test  case repository, although we note that when we previously asked for  additional information on this repository, none was provided.
Rather, our observation concerns whether a sufficiently defined US- VISIT Increment 1 system acceptance test plan was developed,  approved, and available in time to be used as the basis for conducting  system acceptance testing. As we state in the report, to be sufficient  such a plan should, among other things, define the full complement of  test cases, including inputs and outputs, and the procedures for  executing these test cases. Moreover, these test cases should be  traceable to system requirements. However, as we state in our report,  this content was added to the Increment 1 test plan during the course of  testing, and only the version of the test plan modified January 16, 2004,  contained all of this content. Moreover, DHS's comments recognize that  these test plan versions were developed during the course of test  execution and that the test schedule did not permit sufficient time for  all stakeholders to review the versions. 6. We do not disagree with DHS’s comments describing the roles and  responsibilities of its program office support contractor and its  Federally Funded Research and Development Center (FFRDC)  contractor. However, DHS’s description of the FFRDC contractor’s  roles and responsibilities do not cover all of the taskings envisioned for  this contractor. Specifically, DHS’s comments state that the FFRDC  contractor is to execute such program and project management  activities as strategic planning, contractor source selection, acquisition  management, risk management, and performance management. These  roles and responsibilities are consistent with the FFRDC contractor’s  statement of work that was provided by DHS. However, DHS’s  comments omit other roles and responsibilities specified in this  statement of work. In particular, the comments do not cite that this  contractor is also to conduct audits and evaluations in the form of  independent verification and validation activities. It is this audit and  evaluation role, particularly the independence element, which is the  basis for our concern and observation. As we note above and state in  the report, US-VISIT program plans and the contractor’s statement of  work provide for using the same contractor both to perform program  and project management activities, including creation of related  products, and to assess those activities and products. Under these  circumstances, the contractor could not be sufficiently independent to  effectively discharge the audit and evaluation tasks. 7. We do not agree with DHS’s comment that we cited the wrong operative  documentation pertaining to US-VISIT independent verification and  validation plans. As discussed in our comment No. 6, the statement of  work that we cite in the report relates to DHS plans to use the FFRDC  contractor to both perform program and project management activities  and develop related products and to audit and evaluate those activities  and products. The testing contractor and testing activities discussed in  DHS comments are separate and distinct from our observation about  DHS plans for using the FFRDC contractor. Accordingly, our report  does not make any observation regarding the independence of the  testing contractor. 8. We agree that US-VISIT lacks a change control board and support  DHS’s stated commitment to establish a structured and disciplined  change control process that would include such a board.
section_title: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the individual named above, Barbara Collier, Gary Delaney,  Neil Doherty, Tamra Goldstein, David Hinchman, Thomas Keightley, John  Mortin, Debra Picozzi, Karl Seifert, and Jessica Waselkow made key  contributions to this report.
section_title: GAO’s Mission
paragraphs: The General Accounting Office, the audit, evaluation and investigative arm of  Congress, exists to support Congress in meeting its constitutional responsibilities  and to help improve the performance and accountability of the federal  government for the American people. GAO examines the use of public funds;  evaluates federal programs and policies; and provides analyses,  recommendations, and other assistance to help Congress make informed  oversight, policy, and funding decisions. GAO’s commitment to good government  is reflected in its core values of accountability, integrity, and reliability.
section_title: Obtaining Copies of GAO Reports and Testimony
paragraphs: The fastest and easiest way to obtain copies of GAO documents at no cost is  through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and full- text files of current reports and testimony and an expanding archive of older  products. The Web site features a search engine to help you locate documents  using key words and phrases. You can print these documents in their entirety,  including charts and other graphics.
Each day, GAO issues a list of newly released reports, testimony, and  correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site  daily. The list contains links to the full-text document files. To have GAO e-mail  this list to you every afternoon, go to www.gao.gov and select “Subscribe to e-mail  alerts” under the “Order GAO Products” heading.
subsections: section_title: Order by Mail or Phone
section_title: To Report Fraud, Waste, and Abuse in Federal Programs
section_title: Public Affairs