Information Technology: Homeland Security Needs to Improve Entry Exit System Expenditure Planning
Published: 2003-06-09T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Pursuant to legislative direction, the Immigration and Naturalization Service (INS), now part of the Department of Homeland Security, plans to acquire and deploy an entry exit system to assist in monitoring the flow of foreign nationals in and out of the United States. By separate legislative direction, INS must submit to the Senate and House Committees on Appropriations a plan for this system that meets certain conditions, including being reviewed by GAO, before funds can be obligated. This report satisfies GAO's mandated review obligation by (1) addressing whether the plan submitted by INS, along with related INS documentation and plans, meets required conditions and (2) providing observations about the plan and INS's management of the system.
section_title: What GAO Found
paragraphs: INS's initial expenditure plan and associated system acquisition documentation and plans for the entry exit system partially meet the legislative conditions imposed by the Congress. That is, INS has implemented or has defined plans for implementing most of the legislatively mandated requirements for the plan's content, which include such areas as capital planning and investment control, acquisition, and systems acquisition management. However, key issues related to understanding and implementing system requirements, such as developing a system security plan and assessing system impact on the privacy of individuals, remain to be addressed. Moreover, INS reported that it had obligated some entry exit funding before it submitted the plan to the Appropriations Committees. Since then, INS officials told GAO that they have de-obligated and reclassified these obligations to other available funding sources. GAO observed that INS has preliminary plans showing that it intends to acquire and deploy a system that has functional and performance capabilities that satisfy the general scope of capabilities required under various laws. These include the capability to (1) collect and match alien arrival and departure data electronically; (2) be accessible to the border management community (including consular officers, federal inspection agents, and law enforcement and intelligence agencies responsible for identifying and investigating foreign nationals); and (3) support machine-readable, tamper-resistant documents with biometric identifiers at ports of entry. Each of these capabilities is integral to supporting our nation's border security process. However, GAO also observed that the initial plan does not provide sufficient information about INS commitments for the system, such as what specific system capabilities and benefits will be delivered, by when, and at what cost, and how INS intends to manage the acquisition to provide reasonable assurance that it will meet these commitments. Without sufficiently detailed information on system plans and progress, the Congress will be impeded in its efforts to oversee the system.

section_title: Letter
paragraphs: The Congress has long recognized the need for a border security system  that collects information about foreign nationals entering and exiting the  United States and identifies those who have overstayed their visits. Seven  years ago, the Congress passed legislation that directed the Immigration  and Naturalization Service (INS) to develop such an entry exit system.  More recently, the Congress has passed additional entry exit legislation,  requiring, for example, that the system be integrated with other law  enforcement databases and that it use biometric technologies to better  identify persons entering and exiting the United States.
To exercise close oversight over the entry exit system, the Congress also  prohibited the INS from obligating funds for the system that were made  available in fiscal year 2002 supplemental appropriations until the agency  submitted to the Senate and House Committees on Appropriations an  expenditure plan (1) that meets the capital planning and investment  control review requirements established by the Office of Management and  Budget (OMB), including Circular A-11, part 3; (2) that complies with the  acquisition rules, requirements, and guidelines and systems acquisition  management practices of the federal government; and (3) that is reviewed  by GAO.
This report responds to our legislative mandate to review INS’s fiscal year  2002 entry exit system expenditure plan. On November 15, 2002, INS  provided this plan to the Appropriations Committees, and on December  19, 2002, we received a copy of the plan. As agreed with your offices, our  review objectives were to (1) determine whether the plan satisfied the  legislative conditions and (2) provide observations about the expenditure  plan and INS’s management of the entry exit system. As agreed with your  offices, our review focused not only on the plan, but also on related  system documentation and plans. Our objectives, scope, and methodology  are presented in detail in appendix I.
subsections: section_title: Background
paragraphs: Securing our nation’s borders is a formidable task. The United States  shares over 7,500 miles of land border with Canada and Mexico, and it has  approximately 95,000 miles of shoreline and navigable waterways to  protect. All people and goods that legally enter the United States must  come through one of about 300 land, air, or sea ports of entry and must  undergo what is referred to as “primary inspection.” In fiscal year 2002,  INS reported that over 440 million persons passed through primary  inspections; approximately 81 percent of these inspections were at land  ports of entry (see table 1).
Following primary inspection, some persons seeking admission into the  United States go through a more detailed, secondary inspection before  they can be admitted. In fiscal year 2002, INS reported that about 8 million  of the approximately 279 million foreign nationals entering the United  States were admitted through secondary inspections (see table 2). INS  reported that 738,396 were denied admission.
subsections: section_title: Overview of the Border Security Process
paragraphs: As we previously reported, our nation’s current border security process  for controlling the entry and exit of individuals generally consists of four  primary functions: (1) issuing visas, (2) controlling entry, (3) managing  stays, and (4) controlling exit. Figure 1 depicts these functions, each of  which is described below.
The visa issuance process begins with the Department of State, which  issues immigrant and nonimmigrant visas to foreign nationals at more  than 200 diplomatic consular posts in approximately 180 countries.  Officials at these consular posts review visa applications, sometimes  interviewing applicants, before issuing a visa. As part of their review of  visa applications, the officials run the applicant’s name through one of the  State Department’s watch lists, the Consular Lookout and Support  System (CLASS), and its Consular Consolidated Database (CCD). If an  application is approved, a visa is issued; if an application is rejected, the  rejection is recorded in CLASS, and the person’s name is electronically  forwarded to the Interagency Border Inspection System (IBIS). The State  Department reports that the majority of visa applications are for  nonimmigrant travel. Canadian citizens and citizens of countries  participating in the Visa Waiver Program who travel to the United States  on business or pleasure for a period of 90 days or less are examples of  two classes of noncitizens that are exempt from these processing  requirements. Figure 2 depicts the visa issuance process.
Foreign nationals seeking entry into the United States are screened for  admission by INS or U.S. Customs Service inspectors at official air, land,  or sea ports of entry. Generally, this screening consists of questioning each  traveler regarding his or her identity and purpose of visit. The inspector is  to review the person’s travel documents and query IBIS to determine  whether there is a “lookout” for the person or vehicle. Once the inspector  has the necessary information, an admission decision is made. If additional  review is necessary, the person is referred to secondary inspection, where  a more detailed review of the travel documents, further questioning, and  queries of multiple systems are to occur. Travelers who are deemed  inadmissible are detained, and they are subject to enforcement actions as  required.
Arriving foreign nationals must also complete a paper Form I-94, which is  an arrival/departure record. For each arrival, the inspector is to review  the form for accuracy, and if the foreign national is deemed admissible, the  inspector annotates the admission classification and stamps the “Admit  Until” date on the form. The foreign national is then given the departure  portion of the form for proof of status while in the United States. INS  keeps the arrival portion for entry into the Non-Immigrant Information  System (NIIS) database.
The previously described inspection process may vary, depending on  travelers’ nationalities. As of October 2002, the National Security Entry  Exit Registration System (NSEERS) program required nonimmigrant  foreign nationals over the age of 16 from certain countries to register with  INS. At the port of entry, these persons are to be fingerprinted,  photographed, and interviewed under oath at the time they apply for entry  into the United States. The inspector also annotates the Form I-94 with a  Fingerprint Identification Number to show that the person has registered.  (App. III provides more information on NSEERS, as well as the Visa  Waiver Support System, which according to INS officials, are recently  implemented systems that will be integrated into the entry exit system.)
The entry control process also varies by type of port of entry. At air and  sea ports of entry, commercial carriers are required to submit passenger  and crew manifests before arrival. Manifest data are submitted to the  Advance Passenger Information System (APIS) and include (among other  things) the person’s full name, date of birth, nationality, and passport  number. Using the manifest data, INS inspectors conduct a name check  through IBIS before the persons arrive, identifying those who will be  subject to secondary inspection.
Land ports of entry differ from air and sea ports of entry in that no  requirements for passenger or crew manifests are imposed on commercial  carriers. Further, the procedures differ for pedestrians and occupants of  vehicles. As a general rule, pedestrians have all travel documents checked,  and if IBIS is available, a name search is conducted. (Exceptions to this  rule are Canadians, who are not required to have a passport when entering  a land port, and Mexicans with a border-crossing card, who are not  required to present a Mexican passport or a U.S. visa.) For vehicles,  license plates are checked through IBIS, and documents and names of the  vehicle’s occupants are checked randomly or when an inspector has  reason to be suspicious. Figure 3 depicts the entry control process.
Until recently, foreign nationals admitted into the United States were not  actively monitored. However, with the implementation of NSEERS, certain  foreign national males over the age of 16 are now required, within 30 days  of arrival, to report to an INS office and register, a process that includes  providing information consistent with their visas, such as proof of  residence and proof of employment. If the foreign national stays in the  United States for more than 1 year, he must also report to a designated INS  location within 10 days of each registration anniversary. If the foreign  national changes his address, school, or employer, he is required to notify  INS by mail within 10 days. Those who violate these rules will have their  photographs, fingerprints, and other information added to the National  Crime Information Center (NCIC) “wants and warrants” list for  enforcement purposes. NSEERS violators who are caught by police are  transferred to INS custody for removal or criminal prosecution. Figure 4  depicts the stay management process.
At air and sea ports of entry, carriers are responsible for collecting from  exiting foreign nationals the departure portions of the Form I-94 and for  forwarding them to INS, which in turn sends them to a data entry  contractor for manual input into the Non-Immigrant Information System.  Carriers are also required to electronically submit to APIS manifest  information of passengers leaving the United States from an air or sea port  of entry. The departure manifest information is transmitted from APIS to  the Arrival Departure Information System (ADIS), which uses name- matching algorithms to match the arrival and departure records and  identify persons who have overstayed their authorized visits. At land ports  of entry, there is no collection point for the departure portion of the Form  I-94. The foreign national is responsible for returning the departure  portion, although there is no penalty for not doing so, unless the person is  subject to NSEERS requirements. Persons subject to NSEERS must depart  the United States from an INS-designated port of entry and report to an  INS agent for examination and endorsement of departure. If these persons  do not report their exit, they become ineligible to return to the United  States. The exit control process is depicted in figure 5.
section_title: Congress Has Specified Entry Exit System Capabilities in Legislation
paragraphs: Legislation defines the capabilities that the entry exit system is to have.  The “pre-9/11” laws defining these capabilities are the Illegal Immigration  Reform and Immigrant Responsibility Act of 1996 (IIRIRA), the  Immigration and Naturalization Service Data Management Improvement  Act of 2000, and the Visa Waiver Permanent Program Act. The “post- 9/11” laws are the USA PATRIOT Act, the Aviation and Transportation  Security Act, and the Enhanced Border Security and Visa Entry Reform  Act of 2002.
Among other things, Section 110 of IIRIRA directed the Attorney General  to develop an automated entry exit control system to collect records of  departure from every alien leaving the United States and match it with the  alien’s record of arrival. It also required that the system provide on-line  searching procedures to identify each lawfully admitted nonimmigrant  who remains in the United States beyond his or her authorized period.
The Immigration and Naturalization Service Data Management  Improvement Act amended Section 110 of IIRIRA by replacing it in its  entirety. This act, among other things, requires that the entry exit system  integrate arrival and departure information on aliens required under  IIRIRA and contained in Department of Justice (including INS) and State  Department databases. Further, the act specifies that the system be  implemented at all airports and seaports by December 31, 2003; the 50  busiest land ports by December 31, 2004; and all remaining ports no later  than December 31, 2005.
The Visa Waiver Permanent Program Act, among other things, requires the  Attorney General, no later than October 1, 2001, to develop and implement  at airports and seaports a fully automated system to control entry and exit  of aliens who enter the United States under the Visa Waiver Program. The  act also requires that, by October 1, 2002, inspectors at the ports of entry  have access to any State Department or INS photograph and information  on whether the alien has been determined to be ineligible to be admitted  to the United States or receive a visa. Further, the act requires that visa  waiver applicants be checked against lookout (i.e., watch list) systems,  and that by October 1, 2007, aliens applying for a visa waiver have a  machine-readable passport.
Since September 11, 2001, three additional laws address, among other  things, an alien entry exit control system. The USA PATRIOT Act  mandates that this system be capable of interfacing with other law  enforcement agencies, and that it use biometric technology and tamper- resistant documents. The Aviation and Transportation Security Act  requires air carriers to electronically transmit manifest information for all  international flight passengers and crew members before landing at a U.S.  airport. The Enhanced Border Security and Visa Entry Reform Act further  requires the use of biometrics in travel documents by October 26, 2004; it  expands the passenger arrival manifest requirement in the Aviation and  Transportation Security Act to sea carriers and to air and sea departures;  and it requires compliance for both no later than January 1, 2003.  Appendix IV provides more information on the legislatively mandated  capabilities for an entry exit system.
section_title: Overview of the President’s Homeland Security Strategy and Department of Homeland Security
paragraphs: In July 2002, the administration issued a national strategy for homeland  security. This strategy, among other things, aligns and focuses homeland  security functions into six mission areas, one of which is border and  transportation security. To better address the issues of border and  transportation security, the strategy identifies several initiatives, including    creating “smart borders” to provide greater security, including the  development and deployment of the statutorily mandated entry exit  system; and    ensuring accountability in border and transportation security by  consolidating the current border and transportation security agencies  under a new department of homeland security.
In November 2002, the Congress passed and the President signed the  Homeland Security Act of 2002, which established this new Department  of Homeland Security (DHS) to provide greater accountability over critical  homeland security missions and unity of purpose among the agencies  responsible for them.
The administration’s national strategy also proposed having a single entity  to manage who and what enters the United States. Under the new  department, this single entity is the Border and Transportation Security  Directorate. Before this, responsibility and accountability for border  security were vested primarily with INS, which was part of the Justice  Department; the Customs Service, which was part of the Department of  the Treasury; the Transportation Security Administration (TSA), which  was part of the Department of Transportation; and the Bureau of Consular  Affairs, which is part of the State Department. Effective March 1, 2003,  DHS merged within its Border and Transportation Security Directorate  three of these four agencies—INS, Customs, and TSA. The goal in doing so  is to better manage and coordinate port of entry activities, lead efforts to  create a border of the future, and secure our nation’s transportation  systems. Also, the Secretary of Homeland Security has the authority to  issue regulations regarding the issuance of visas. The regulations will be  implemented through the State Department. (See fig. 6 for a partial  organization chart of the Border and Transportation Security Directorate.)
section_title: Brief Description of the Entry Exit Program
paragraphs: The entry exit program was established to integrate the people, processes,  and technologies needed to satisfy the legislative mandates. The program  includes each of the four border security process functions: issuing visas,  controlling entry, managing stays, and controlling exit. Additionally, the  program is intended to cover the people responsible for implementing the  process, the technology to support the process, and the physical  infrastructure (e.g., vehicle and pedestrian traffic lanes and facilities)  needed to support the process.
For fiscal year 2002, the conference report for the first supplemental  appropriations act recommended that INS use $13.3 million in  appropriations for the development of an automated entry exit system.  The Congress prohibited INS from obligating these funds for the system  until the agency submitted to the Appropriations Committees an  expenditure plan (1) that meets the capital planning and investment  control review requirements established by OMB, including Circular A-11,  part 3; (2) that complies with the acquisition rules, requirements, and  guidelines and systems acquisition management practices of the federal  government; and (3) that is reviewed by GAO.
On November 15, 2002, INS submitted to its Senate and House  Appropriations Subcommittees a one-page plan for spending the $13.3  million for the entry exit system. In summary, the plan allocated the $13.3  million to 10 areas, the largest area being contract support for program  management activities ($5.6 million). Other major areas included the  design, development, and deployment of the Visa Waiver Permanent  Program Act Support System ($2.1 million); the assessment of facilities at  every port of entry along the Mexican and Canadian borders ($1.4 million);  and the development of standards for biometrics identifiers ($2.1  million). Table 3 summarizes INS’s entry exit system expenditure plan.
In fiscal year 2003, Justice requested $380 million for the entry exit  program—$362 million in new funding and $18 million provided in fiscal  year 2003 base resources. According to INS officials, $334 million of this  amount will be used for facility improvements. In conjunction with the  Consolidated Appropriations Resolution, 2003, the conference report  recommended $362 million for the entry exit program in fiscal year 2003  funds.
In March 2002, INS chartered an Entry Exit Program Team consisting of  representatives from INS, Customs, TSA, and the Bureau of Consular  Affairs, with INS serving as the program lead; the team reports to an  interagency board comprising senior leadership from these four agencies.  The team is responsible for    managing program resources (i.e., budgetary planning, formulation,  execution, and control); reporting to the Congress and other key stakeholders, as necessary; and   managing the acquisition, including defining and establishing program  management controls, developing program plans and baselines, and  managing all aspects of the entry exit system life cycle.
As currently envisioned, the program will be placed organizationally  within DHS’s Bureau of Immigration and Customs Enforcement, which is  part of the department’s Border and Transportation Security Directorate  (see fig. 6), previously mentioned. With the transition to the new  department, the program manager also stated that the program’s  governance and management structure is undergoing change.
As previously noted, the entry exit system is one of three parts of the  whole entry exit program—the technologies—the other two parts being  people and processes. As planned, the system is to provide automated  support in identifying and preventing unlawful persons from entering the  United States, as well as managing the stay and exit of those lawfully  admitted. To do this, plans indicate that the system is to share vital border  control information so as to alert border officials of national security  threats. It is also to help coordinate the enforcement of immigration laws  for alien overstays.
DHS’s Bureau of Immigration and Customs Enforcement plans to acquire  the entry exit system through a two-phase competitive acquisition process.  The first phase is referred to as a pilot demonstration. In this phase, two or  more contractors are to be awarded contracts to develop and pilot test  system solutions. Following an evaluation of each pilot system, a contract  is to be awarded to the winning contractor for full-scale development and  implementation of the entry exit system. According to the entry exit  program manager, INS has developed costs and milestones for the system  acquisition. However, INS did not respond to our requests for this  information, citing the sensitive nature of the information as its reason.
section_title: Fiscal Year 2002 Expenditure Plan Partially Satisfied Legislative Mandate
paragraphs: The Congress limited INS’s ability to obligate fiscal year 2002 appropriated  funds for the entry exit system until INS submitted to the Appropriations  Committees an expenditure plan (1) that meets the capital planning and  investment control review requirements established by OMB, including  Circular A-11, part 3; (2) that complies with the acquisition rules,  requirements, and guidelines and systems acquisition management  practices of the federal government; and (3) that is reviewed by us.
INS submitted an expenditure plan to its Senate and House Appropriations  Subcommittees on November 15, 2002. This plan and related  documentation partially satisfied the first condition and generally satisfied  the second condition, and we have satisfied the third with this report.  According to the entry exit program manager, INS’s efforts to satisfy the  two conditions are a by-product of its policies and practices for acquiring  information technology (IT) systems, which it is following, and which are  aligned with federal capital planning and acquisition requirements and  guidance.
However, INS has obligated at least part of the $13.3 million recommended  for the entry exit system before submitting the plan. Since then, INS  officials told us that they have de-obligated over $6.6 million that they had  obligated after August 2, 2002, and reclassified those obligations to other  available sources of base “Enforcement and Border Affairs” fiscal year  2002 funding.
subsections: section_title: INS Satisfied Most, but Not All, of OMB’s Capital Planning and Investment Control Review Requirements
paragraphs: OMB’s IT capital planning and investment control review policies are  intended to help agencies achieve performance goals and objectives with  minimal risk, lowest life cycle costs, and greatest benefits to the agency’s  business. OMB requires, among other things, that agencies establish a  process that defines how the agency (1) selects projects included in its IT  portfolio; (2) controls these projects to achieve the intended cost,  schedule, and performance outcomes; and (3) evaluates IT projects’  performance to maintain a positive return on investment. OMB also  requires that agencies (1) develop a system acquisition strategy;  (2) conduct an alternatives analysis that, among other things, addresses  replaced systems savings and a savings recovery schedule; (3) comply  with agencies’ enterprise architectures in developing and acquiring IT  systems; and (4) use a performance-based management system to monitor  progress against established project performance goals. Additionally, OMB  requires that IT projects (1) ensure that a system security plan is  developed and implemented, so that appropriate controls are defined,  established, and continually assessed for effectiveness, and (2) perform a  system privacy impact assessment, so that relevant privacy issues and  needs are understood and appropriately addressed early and continuously  in the system life cycle.
While the expenditure plan does not explicitly address OMB’s  requirements, related INS documents and plans satisfy most, but not all, of  the requirements. For example, INS has established a capital planning and  investment control process that defines how INS selects, controls, and  evaluates its IT projects. This process describes (1) controls used to create  the IT portfolio; (2) procedures for measuring projects against their costs,  schedule, and benefits; and (3) measures used to determine the IT  projects’ actual return on investment. The process also identifies several  decision points for review and approval. For example, approval by INS’s  Investment Approval Board of the business case (cost/benefit analysis,  risk analysis, and alternatives analysis) is required before the project team  defines system requirements. INS has not yet developed a business case  for the entry exit program.
Further, INS has developed an entry exit system acquisition strategy.  Under this strategy, INS intends to acquire the system in two phases. In  the first phase, it plans to award contracts to multiple vendors to develop  prototype versions of the system and to demonstrate their capabilities  against requirements, on a pilot basis, at a simulated port of entry. In the  second phase, INS plans to award a contract to develop, integrate, and  implement an operational entry exit system. Additionally, it has developed  an alternatives analysis, and, according to the entry exit program manager,  INS’s fiscal year 2004 Exhibit 300 for the entry exit program addresses  the potential savings associated with replacing existing systems and a  schedule for achieving those savings. In addition, preliminary planning  documents indicate that INS plans to comply with its enterprise  architecture, and that it intends to apply earned value management  standards and techniques to monitor and control costs and to measure  progress against established performance goals.
However, INS has yet to develop a security plan and privacy impact  assessment for the entry exit system, both of which are important to  understanding system requirements and ensuring that the proper  safeguards are in place to protect system data and resources. According to  INS officials, the agency has not developed a security plan and privacy  impact assessment because it is too early in the system development life  cycle to do so. This is not consistent with system acquisition best practices  and federal guidance, which advocate understanding and defining security  and privacy requirements both early and continuously in a system’s life  cycle. Until these important requirements are satisfied, the basis for  further entry exit system definition and acquisition will be limited, thereby  introducing the risk that security and privacy will not be effectively and  efficiently addressed.
section_title: INS Generally Satisfied Key Federal Acquisition Rules, Requirements, and Guidelines and Systems Acquisition Management Practices
paragraphs: Federal acquisition rules, requirements, guidelines, and management  practices provide an acquisition management framework that is based on  the use of rigorous and disciplined processes for planning, managing, and  controlling the acquisition of IT resources. These acquisition  management processes are also embodied in published best practices  models, such as the Software Acquisition Capability Maturity Model®  developed by Carnegie Mellon University’s Software Engineering Institute  (SEI). SEI’s model explicitly defines acquisition process management  controls that are recognized hallmarks of successful organizations and  that, if implemented effectively, can greatly increase the chances of  acquiring software-intensive systems that provide promised capabilities on  time and within budget. Key processes include the following:    Acquisition planning. Ensures that reasonable planning for the  acquisition is conducted and that all aspects of the total acquisition effort  are included in these plans.
Solicitation. Ensures that a request for proposal that delineates a project’s  requirements is prepared and, consistent with relevant solicitation laws  and regulations, that a contractor is selected that can most cost-effectively  satisfy these requirements.
Requirements development and management. Establishes and maintains  a common and unambiguous definition of software requirements among  the acquisition team, the system users, and the development contractor.
Project management. Provides for management of the activities within the  project office and supporting contractors to ensure a timely, efficient, and  cost-effective acquisition.
Contract tracking and oversight. Ensures that the development  contractor performs according to the terms of the contract; needed  contract changes are identified, negotiated, and incorporated into the  contract; and contractor performance issues are identified early, when  they are easier to address.
Evaluation. Determines whether the acquired products and services  satisfy contract requirements before acceptance.
Within these key processes, SEI identifies practices that are needed to  effectively execute each process. Among others, these practices include  (1) having a written policy, (2) assigning responsibility for the acquisition,  (3) developing and adhering to a plan, (4) performing management review  activities, and (5) measuring the status of key activities and using these  measurements to make decisions.
INS plans generally satisfy SEI’s acquisition processes and practices. For  example, INS’s governing acquisition policy and supporting procedures for  acquiring and implementing the entry exit system are provided by INS’s  Systems Development Life Cycle, its Information Technology Investment  Management process, and the Federal Acquisition Regulation, which our  analysis shows are generally consistent with SEI’s acquisition model. (See  app. I for a description of our analysis.) Further, responsibility for  acquiring and implementing the entry exit system was assigned to INS  (and now to DHS’s Bureau of Immigration and Customs Enforcement).  INS has developed an acquisition plan that outlines its approach and  strategy for acquiring the entry exit system. Additionally, INS has issued a  request for information to solicit input from development contractors on  the capabilities of their respective commercial products and services to  assist in developing system requirements, and it has developed procedures  and criteria for evaluating contractor proposals and selecting a contractor  to develop the entry exit system. Further, through its Information  Technology Investment Management process, INS plans to measure the  status and progress of acquisition activities and use this information for  investment decision-making.
According to the entry exit program manager, INS has made a  commitment to following rigorous and disciplined processes and practices  in acquiring the entry exit system because this is what its governing policy  and procedures require. If implemented effectively, such processes and  practices can minimize the acquisition and deployment risks associated  with the entry exit system.
section_title: GAO Reviewed Expenditure Plan
paragraphs: On December 19, 2002, we received a copy of the initial expenditure plan  that INS submitted to the Congress, and on January 17, 2003, INS provided  us with most of the supporting acquisition management documentation we  requested. We reviewed the plan and documentation, and the results of  our review are provided in this report.
section_title: Expenditure Plan Submitted to the Congress after Funds Were Obligated
paragraphs: In addition to requiring the expenditure plan to satisfy the above three  conditions, the Congress also limited INS’s ability to obligate funds for the  entry exit system until INS submitted the plan to the Appropriations  Committees. However, INS obligated entry exit system funding before  submitting the plan. Specifically, as part of a January 6, 2003, briefing on  planned fiscal year 2003 entry exit spending, INS reported to its House  Appropriations Subcommittee that, as of September 30, 2002, it had  obligated approximately $9.8 million of the $13.3 million recommended for  the entry exit system to perform tasks described in its expenditure plan.  Since then, INS officials told us that they have de-obligated over $6.6  million that they had obligated after August 2, 2002, and reclassified those  obligations to other available sources of base “Enforcement and Border  Affairs” fiscal year 2002 funding.
section_title: Other Observations: Planned Entry Exit Capabilities Are Aligned with Legislation, but Future Expenditure Plans Need to Be Improved
paragraphs: Recent legislation has defined the capabilities that the entry exit system is  to provide, and INS’s preliminary plans show that it intends for the system  to provide these capabilities. However, INS’s first entry exit system  expenditure plan does not adequately disclose material information about  the system. Without sufficiently detailed information on system plans and  progress, the Congress will be impeded in its efforts to oversee the system  and constrained in its ability to provide timely guidance and release of  funding.
subsections: section_title: Preliminary Plans Provide for Implementing System Capabilities Cited in Legislation
paragraphs: As discussed in the Background section of this report, various laws have  defined the types of capabilities that the entry exit system is to provide.  (See app. IV for a more detailed summary of the legislation.) For example,  the system must, among other things, (1) collect and match alien arrival  and departure data electronically; (2) be accessible to the border  management community, including consular officers, federal inspection  agents, and law enforcement and intelligence agencies responsible for the  identification and investigation of foreign nationals; and (3) support  machine-readable, tamper-resistant documents containing biometric  identifiers at U.S. ports of entry.
Initial INS plans for the entry exit system are generally aligned with these  legislatively directed system capabilities. For example, the operational  capabilities for the planned system include, among other things,  (1) electronically recording and matching arrivals and departures for the  purpose of identifying visa overstays; (2) interoperating with other entities  involved in border management, including law enforcement and  intelligence agencies; and (3) implementing a biometric standard on all  travel documents issued on or after October 26, 2004. Table 4 provides a  list of the high-level operational requirements defined in preliminary  system plans, and table 5 provides a detailed comparison to the key  legislative requirements.
Description of requirement  Record pertinent information before the arrival of persons to the United States, such as visas and  immigration petitions and applications.  Record the arrival and departure of aliens; record changes in a visitor’s status; identify those persons  who have remained in the United States beyond their authorized period; and enable the reporting of  overstay statistics to Congress.  Facilitate identification of lawfully admitted non-U.S. citizens.  Enable the biometric standard selected by the National Institute for Standards and Technology and  consistent with the International Civil Aviation Organization’s standards.  Include the biometric standard on all travel documents issued on or after October 26, 2004.  Develop a unified workflow that integrates the activities of all agencies supporting border  management.  Be interoperable with other entities as appropriate, including law enforcement and intelligence  agencies.  Provide access to, exchange, and integrate alien arrival and departure information that is in an  electronic format in the databases of the Departments of Justice and State.  Develop a capability to exchange information between existing and future systems among border  management agencies (within the requirement of the law) regardless of what agency owns the  system.  Notify appropriate authorities as required.  Provide improved decision support to inspectors, adjudicators, consular officers, and other appropriate  personnel, including access to fully integrated lookout information, comprehensive travel document  information (including immediate access to nonimmigrant visa and immigrant visa data), and alien  overstay alerts.
section_title: System Acquisition Commitments and Progress Need to Be Addressed in Future Expenditure Plans
paragraphs: The legislative requirement to submit an expenditure plan for the entry  exit system to the Appropriations Committees is intended to provide  lawmakers with a sufficient understanding of the system acquisition to  permit effective oversight and to allow for informed decision-making  about the use of appropriated funds. For this to occur, however, our prior  experience in working with the Congress and other agencies in developing  and implementing expenditure plans shows that these plans need to  disclose a sufficient level and scope of information for the Congress to  understand what system capabilities and benefits are to be delivered, by  when, and at what cost, and what progress is being made against the  commitments that were made in prior expenditure plans. Further, our  experience shows that the plans should disclose how the acquisition will  be managed to provide reasonable assurance that system capability,  benefit, schedule, and cost commitments will be met. In effect, the  expenditure plans can be viewed as contractual arrangements with the  committees. Such treatment is consistent with expenditure planning  precedents set with the Internal Revenue Service and the former U.S.  Customs Service on their respective system modernization programs.
INS’s first expenditure plan does not contain the level and scope of  information needed for the Congress to understand its plans and  commitments relative to system capabilities, benefits, schedules, and  costs. More specifically, this first plan only identifies general “areas of  expenditure” and associated funding amounts (see table 6 for the verbatim  text of the plan as submitted). According to INS officials, this is because  the expenditure plan was developed on the basis of Justice Department  guidance, which did not require more detailed information. However, they  said that future plans will include more detailed and complete information  on system capabilities, benefits, schedules, and costs, but they did not  provide supporting documentation or specific details. Without this level of  detail, the Congress will be denied the information needed to allow it to  oversee plans and progress on the system.
section_title: Conclusions
paragraphs: The immense importance of the entry exit system to the security of our  nation’s borders is undeniable, as is the need to acquire and implement  this system effectively and efficiently. This criticality is a major reason that  the Congress placed limitations on the use of entry exit system funding  until the Congress has been assured, through the submission of a high- quality plan, that the system is being managed effectively.
INS partially met the legislative conditions that the Congress placed on its  use of fiscal year 2002 entry exit system funding. However, it is important  that DHS promptly address certain capital planning and investment  control issues—security and privacy—and that the Congress be given the  opportunity to exercise its intended level of expenditure plan oversight  before funds are obligated. It is equally important that future expenditure  plans disclose sufficient information to permit meaningful congressional  understanding and oversight of the system. While this lack of detail is a  material limitation in the first plan, it will become even more problematic  in the future: as the magnitude and complexity of the entry exit system  acquisition increases in fiscal year 2003 and beyond, so will the  importance of creating plans with the appropriate level and scope of  information.
Of particular significance going forward will be how effectively DHS  implements the system investment and acquisition controls provided for in  the first plan and related documentation. Therefore, it is important that  future plans disclose project information of sufficient level and scope  about (1) what system capabilities and benefits are to be delivered, by  when, and at what cost; (2) how well DHS is progressing against the  commitments that it made in prior expenditure plans; and (3) how the  acquisition is being managed to provide reasonable assurance that the  system capability, benefit, schedule, and cost commitments will be met.  This approach to expenditure planning for congressional oversight has  worked successfully with other federal agencies and the Congress.
section_title: Recommendations for Executive Action
paragraphs: To help ensure the effective management and acquisition of the entry exit  system, we recommend that the Secretary of Homeland Security, through  whatever entry exit program governance structure is established, direct  the entry exit program manager to ensure that planned investment and  acquisition management controls, including the development of a business  case, are fully implemented in accordance with recognized best practices  and relevant federal requirements and guidance. At a minimum, we  recommend that the Secretary’s direction include having the entry exit  program manager immediately develop and begin implementing a system  security plan. At the same time, we recommend that the Secretary have the  program manager perform a privacy impact analysis and use the results of  this analysis in near-term and subsequent system acquisition decision- making. Further, in light of INS’s recent transition to the new department  and potential changes to system investment and acquisition controls  provided for in the first plan, we recommend that controls in the areas of  acquisition planning, solicitation, requirements management, project  management, contract tracking and oversight, and evaluation be  implemented in accordance with SEI guidance.
Additionally, we recommend that the Secretary ensure that future  expenditure plans (1) be provided to the department’s Senate and House  Appropriations Subcommittees in advance of entry exit system funds  being obligated and (2) fully disclose what entry exit system capabilities  and benefits are to be delivered, by when, and at what cost, and how it  intends to manage the acquisition to provide reasonable assurance that  these system capability, benefit, schedule, and cost commitments will be  met.
section_title: Agency Comments and Our Evaluation
paragraphs: In written comments on a draft of our report signed by DHS’s Assistant  Secretary, Bureau of Immigration and Customs Enforcement (reprinted in  app. II, along with our responses), the department did not explicitly agree  or disagree with our conclusions and recommendations. However, the  department described actions that it plans to take that are consistent with  our recommendations, including developing and implementing a system  security plan, developing system management controls, providing future  expenditure plans to the Appropriations Subcommittees before obligating  any funds, and specifying system capabilities and benefits in future plans.  We support these planned actions.
The department provided other principal comments. First, it stated that we  failed to consider that the lack of specific detail in the fiscal year 2002  expenditure plan is attributable to a number of pending policy decisions.  Second, it stated that it had addressed the development of a system  security plan and privacy impact assessment and provided a draft  document entitled Technical Architecture and Security Requirements  that it said addressed these issues. Third, it commented that we concluded  that the entry exit program office is in compliance with INS’s ITIM, and  therefore the entry exit system is in compliance with OMB requirements.  Fourth, it said we failed to consider and incorporate information regarding  its obligation of supplemental appropriations.
We do not agree with these four comments. First, as we state in this  report, the legislative requirement to develop an expenditure plan is  intended to provide lawmakers with a sufficient understanding of the  system acquisition to permit effective oversight and informed decision- making about the use of appropriated funds. For this to occur, the plan  needs to disclose a sufficient level and scope of information for the  Congress to understand what system capabilities and benefits are to be  delivered, by when, and at what cost. The plan also needs to disclose what  progress is being made against the commitments that were made in prior  expenditure plans, as well as how the acquisition will be managed to  provide reasonable assurance that system capability, benefit, schedule,  and cost commitments will be met. To the extent that this information was  not known because of pending policy issues, these issues should have  been explained and a timetable for addressing them included in the plan.  Notwithstanding these undecided policy matters, the plan could have  provided more detailed information. For example, it could have addressed  how the acquisition was to be managed.
Second, the draft document that the department provided with its  comments does not satisfy relevant federal guidance governing a security  plan and a privacy impact assessment. While the document acknowledges  the need to develop the plan and conduct the assessment, and the  document describes high-level security requirements, it does not include,  for example, rules of behavior for individuals who access the system and  the consequences for violating those rules; methods for identifying,  appropriately limiting, and controlling interconnections with other  systems; and procedures for periodically reviewing the effectiveness of  security controls. Similarly, the document does not include an assessment  of the privacy implications of personal information to be collected and  maintained by the system.
Third, while we state in this report that INS’s ITIM process generally  satisfies OMB’s requirement to establish a process that defines how the  agency selects, controls, and evaluates its IT projects, we do not state that  the program office is in full compliance with the ITIM process, and that  therefore the entry exit system is in compliance with OMB requirements.  Rather, we conclude that, in going forward, it is important that INS focus  on implementing the investment management controls provided for the  plan and related documentation. Accordingly, we recommend that DHS  fully implement planned investment management controls in accordance  with relevant federal requirements and guidance.
Fourth, we did not include in our draft report the information that the  department provided regarding its obligation of the supplemental  appropriations because the department provided this information to us in  a letter dated April 7, 2003. We sent our draft report to the department for  comment on April 3, 2003, before we received the department’s letter. We  have since modified this report, as appropriate, to incorporate the  information in the April 7, 2003, letter.
The department also provided additional technical comments, which we  have incorporated as appropriate into this report.
We are sending copies of this report to interested congressional  committees. We are also sending copies to the Secretary of Homeland  Security, the Director of the Office of Management and Budget, and the  Secretary of State. We will also send copies to others upon request. In  addition, copies will be available at no charge on our Web site at  www.gao.gov.
Should you or your offices have questions on matters discussed in this  report, please contact me at (202) 512-3439. I can also be reached by   E-mail at hiter@gao.gov. An additional GAO contact and staff  acknowledgments are listed in appendix V.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: The Congress limited the ability of the Immigration and Naturalization  Service (INS) to obligate funds for the entry exit system until INS  submitted an expenditure plan (1) that meets the capital planning and  investment control review requirements established by the Office of  Management and Budget (OMB), including Circular A-11, part 3; (2) that  complies with the acquisition rules, requirements, and guidelines and  systems acquisition management practices of the federal government; and  (3) that is reviewed by us. To satisfy our legislative mandate, our  objectives were to review INS’s expenditure plan to (1) determine whether  the plan satisfied the legislative conditions and (2) provide observations  about the expenditure plan and INS’s management of the entry exit  system. Our review focused not only on the plan, but also on related  system documentation and plans.
To determine whether INS’s expenditure plan satisfied the legislative  conditions, we first identified and analyzed relevant federal guidance, such  as OMB’s investment control review requirements and guidelines and the  Federal Acquisition Regulation (FAR). We then reviewed INS’s  expenditure plan and related documentation, such as entry exit planning  documents (i.e., concept paper, concept of operations, business case, cost- effectiveness study, and feasibility study); visa waiver support system  functional requirements, system design, and interface control documents;  and the concept of operations for the National Security Entry Exit  Registration System (NSEERS). We also interviewed the entry exit  program team program manager and other INS and Department of Justice  officials to determine what INS is doing to satisfy the legislative  conditions. To specifically address the legislative conditions, we did the  following:    To determine whether INS’s expenditure plan met OMB’s capital planning  and investment control review requirements, we reviewed entry exit  planning documents and INS’s procedures for managing information  technology (IT) investments. We then compared the planning documents  with OMB requirements to identify whether any variances existed. We  discussed reasons for variances with the entry exit program manager.
To determine whether INS’s plan complies with federal acquisition rules,  requirements, and guidelines and systems acquisition management  practices, we reviewed INS’s policies and procedures for governing system  acquisition efforts, such as its System Development Life Cycle and IT  investment management guidelines. We then identified and reviewed the  acquisition management best practices model developed by the Software  Engineering Institute (SEI), which many federal agencies have adopted as  a benchmarking tool for acquiring software-intensive systems in a manner  that comports with federal acquisition rules, requirements, and guidelines.  Next, we compared the primary components of INS’s System Development  Life Cycle and its investment management procedures with the  components of SEI’s model to determine whether any variances existed.  The components addressed in SEI’s model were acquisition planning,  solicitation, requirements development and management, project  management, contract tracking and oversight, and evaluation. Because the  entry exit program manager stated that INS was following the  requirements of the FAR in acquiring the entry exit system, we also  compared selected sections of the FAR (e.g., acquisition planning, and  contract negotiation and administration) with SEI’s model. Our  comparative analysis focused on whether key components of the SEI  model were provided for in the policies and procedures that INS was  following or intended to follow; it did not include evaluating the quality of  INS’s policies and procedures.
To identify observations about the expenditure plan and INS’s  management of the entry exit system, we first identified system  capabilities mandated in the applicable legislation. Next, we identified  and reviewed the entry exit system’s planned operational requirements  and mapped the planned requirements to the legislatively mandated  system capabilities to identify any variances. We also compared INS’s  expenditure plan with those of two other agencies that have been required  to submit expenditure plans to the Congress (the Internal Revenue Service  and the U.S. Customs Service). We interviewed INS officials about plans  for providing information regarding the system’s benefits, schedules, and  costs in future expenditure plans.
The scope of our work was based on INS’s policies and procedures before  the transition to the Department of Homeland Security.
We conducted our work at INS headquarters in Washington, D.C., from  September 2002 through March 2003 in accordance with generally  accepted government auditing standards.
section_title: Appendix II: Comments from the Department of Homeland Security
paragraphs: The following are GAO’s comments on the Department of Homeland  Security’s letter dated May 7, 2003.
subsections: section_title: GAO Comments
paragraphs: 1.  We agree that the development of a system security plan and privacy  impact assessment of the system is a significant matter. We also  acknowledge that on May 6, 2003, the department provided us with a  draft document entitled Technical Architecture and Security  Requirements. However, we reviewed the document and found that it  does not include information consistent with a security plan and  privacy impact assessment. The Office of Management and Budget  (OMB) and the National Institute of Standards and Technology (NIST)  have issued security planning guidance. In general, this guidance calls  for developing risk-based security plans that (1) provide an overview  of system security requirements, (2) describe the controls in place or  planned for meeting requirements, and (3) define responsibilities and  expected behavior for all individuals who access the system. The draft  document provided by the department acknowledges the need to  address but does not include many of these security plan elements,  such as rules of behavior for individuals who access the system and  the consequences for violating those rules; methods for identifying,  appropriately limiting, and controlling interconnections with other  systems; and procedures for periodically reviewing the effectiveness of  security controls. In addition, it does not, for example, describe the  specific controls in place or planned to address requirements or  delineate responsibilities and the expected behavior of individuals who  access the system. Similarly, the document does not include an  assessment of the privacy implications of personal information to be  collected and maintained by the entry exit system.  2.  We disagree that we failed to consider that the lack of specific detail in  the fiscal year 2002 expenditure plan is attributable to a number of  policy decisions that are pending. As we state in this report, the  legislative requirement to develop an expenditure plan is intended to  provide lawmakers with a sufficient understanding of the system  acquisition to permit effective oversight and to allow for informed  decision-making about the use of appropriated funds. For this to  occur, the plan needs to disclose a sufficient level and scope of  information for the Congress to understand what system capabilities  and benefits are to be delivered, by when, and at what cost, and what  progress is being made against the commitments that were made in  prior expenditure plans. Further, the plan should disclose how the  acquisition will be managed to provide reasonable assurance that  system capability, benefit, schedule, and cost commitments will be  met. Consequently, pending policy decisions that affect plans for the  entry exit program are precisely the kind of detail missing in this  expenditure plan that should be disclosed. To the extent that detailed  planning information is not known, this should be explained and a  timetable for obtaining this information included in the plan.  3.  We agree that we concluded in this report that INS’s Information  Technology Investment Management (ITIM) process generally satisfies  OMB’s requirement to establish a process that defines how the agency  (1) selects projects included in its information technology portfolio;  (2) controls these projects to achieve the intended cost, schedule, and  performance outcomes; and (3) evaluates information technology  projects’ performance to maintain a positive return on investment. We  do not, however, state that the program office is in full compliance  with the ITIM process, and therefore the entry exit system is in  compliance with OMB requirements. Further, we concluded that of  particular significance going forward will be how effectively the  department implements the investment management controls provided  for its plan and related documentation. Accordingly, we recommended  that the department fully implement planned investment management  controls in accordance with relevant federal requirements and  guidance.  4.  We have modified this report to recognize that an entry exit system  business case has yet to be developed, and we have added a  recommendation that the department develop a business case as part  of implementing planned investment management controls.  5.  We do not question the department’s statement, because this was not  within the scope of our review.  6.  We agree and have modified this report.  7.  We sent our draft report to the department on April 3, 2003, which was  4 days before we received the department’s letter dated April 7, 2003.  We have since modified this report to reflect the information in the  April 7 letter.
section_title: Appendix III: Summary of Entry Exit Related Systems
paragraphs: Over the last year, INS has implemented two systems that are intended to  provide certain near-term border security capabilities until the entry exit  system is acquired and implemented. These two systems are the Visa  Waiver Permanent Program Act Support System and the National Security  Entry Exit Registration System (NSEERS). According to the entry exit  program manager, both systems will be integrated into the entry exit  system.
subsections: section_title: Visa Waiver Permanent Program Act Support System
paragraphs: On October 1, 2002, INS implemented the Visa Waiver Permanent Program  Act Support System. This system electronically collects arrival and  departure information for all passengers and crew members who are  provided a waiver and who arrive and depart U.S. airports and seaports. It  modifies two existing systems—Customs’ Advance Passenger Information  System (APIS) and INS’s Arrival Departure Information System (ADIS)— in collecting information.
Arrival: Before entering an air or sea port of entry, commercial carriers  must electronically submit manifest information (e.g., for each passenger  and crew member, the person’s name, address, country of residence, and  passport number) to APIS. This information is queried against several  databases, including the Interagency Border Inspection System (IBIS)  Consolidated Lookout Database and the Datashare Immigrant Visa  database. Receiving the manifest data before carriers arrive allows INS to  review the data beforehand and identify passengers who will require  referral to secondary inspection. The inspector also inputs the “Admit  Until” date into IBIS, which establishes the foreign national’s length of  stay. Both the manifest data and the approved length of stay are  transmitted to ADIS.
Departure: Carriers are also required to electronically submit to APIS  manifest information of passengers leaving the United States from an air  or sea port. The departure manifest information is transmitted from APIS  to ADIS, which uses name-matching algorithms to match the arrival and  departure records. The matching results are used to identify persons who  have overstayed their authorized visits.
According to the entry exit program manager, INS has been able to match  98 percent of received departure records to arrival records. The program  manager also estimated that there are currently 16 million outstanding  (i.e., unmatched) arrival records. He also estimated that INS receives  about 350,000 arrival records per day.
section_title: National Security Entry Exit Registration System
paragraphs: On June 5, 2002, the Attorney General established the NSEERS program to  capture information about certain foreign nationals entering, staying in,  and exiting the United States. In brief, NSEERS consists of (1) a modified  version of an existing INS system used to collect and record enforcement  data, the Enforcement Case Tracking System; (2) more deployments of an  existing INS biometric capture/analysis system, the Automated Biometric  Identification System; and (3) updated business processes/rules covering  the registration of certain nonimmigrants. Under the updated business  processes/rules, existing registration requirements were changed to  require certain nonimmigrant aliens to report to INS upon arrival;  approximately 30 days after arrival; every 12 months after arrival; upon  certain events (e.g., change of address, employment, or school); and at the  time of departure from the United States. Registration requirements also  now include photographing and fingerprinting the alien and matching both  against criminal and terrorist watch lists. According to INS, NSEERS was  deployed to a limited number of sites on September 11, 2002, and became  fully operational at 238 INS locations on October 1, 2002.
section_title: Appendix IV: Summary of Legislation Regarding Entry Exit System Capabilities
subsections: section_title: Legislation Illegal Immigration Reform and Immigrant Responsibility Act of 1996 Public Law 104-208 September 30, 1996
paragraphs: Provisions  By September 30, 1998, the Attorney General shall develop an automated entry exit  control system that—  (1) collects a record of departure for every alien departing the United States and matches    it with the corresponding arrival record and  (2) identifies, through on-line searching procedures, lawfully admitted aliens who overstay  their visas.  Overstay information identified through the system shall be integrated into appropriate  databases of the Immigration and Naturalization Service (INS) and the Department of  State, including those used at ports of entry and at consular offices.  Notwithstanding any other provision of federal, state, or local law, a federal, state, or local  government entity or official may not prohibit or in any way restrict any government entity  or official from sending to or receiving from INS information regarding the citizenship or  immigration status, lawful or unlawful, of any individual.  For the purposes of this section, the term “integrated entry and exit data system” means  an electronic system that—  (1) provides access to, and integrates, alien arrival and departure data that are     (a) authorized or required to be created or collected under law; (b) in an electronic format;  and (c) in a database of the Department of Justice or the Department of State, including  those created or used at ports of entry and at consular offices;  (2) uses available data described above to produce a report of arriving and departing  aliens by country of nationality, classification as an immigrant or nonimmigrant, and date  of arrival in and departure from the United States;  (3) matches an alien’s available arrival data with the alien’s available departure data;  (4) identifies, through on-line searching procedures, lawfully admitted nonimmigrants who  may have remained in the United States beyond the period authorized by the Attorney  General; and  (5) otherwise uses available alien arrival and departure data described in paragraph (1)  above to permit the Attorney General to make the reports required under 8 U.S.C. section  1365a(e):    Number of departure records collected, with an accounting by nationality.    Number of departure records that were successfully matched to records of arrival, with  an accounting by nationality and classification as an immigrant or nonimmigrant.
Number of aliens who arrived pursuant to a nonimmigrant visa, or the Visa Waiver  Program, for whom no matching departure data have been obtained through the  system or by other means as of the end of the alien’s authorized period of stay, with an  accounting by nationality and arrival date in the United States.
Number of lawfully admitted nonimmigrants identified as visa overstays, with an  accounting by nationality.
The Attorney General shall implement the integrated entry exit system at airports and  seaports by December 31, 2003. System requirements:  include available arrival/departure data,    ensure that the arrival/departure data, when collected or created by an immigration  officer, are entered into the system and can be accessed by other officers at other  air/seaports.
The Attorney General must implement the system at the 50 busiest land border ports of  entry by December 31, 2004. System requirements:    Same as specified above    Arrival/departure data on aliens shall be accessible at other high-traffic land border  ports of entry.
The system shall be fully implemented at all remaining ports of entry by December 31,  2005.
Provisions  Not later than October 1, 2001, the Attorney General shall develop and implement a fully  automated entry exit control system that will collect a record of arrival and departure for  every alien who arrives and departs by sea or air at a port of entry in the United States  and is provided a waiver.  Not later than October 1, 2002, the system shall enable immigration officers conducting  inspections at ports of entry to obtain from the system, with respect to aliens seeking a  waiver, (1) any photograph of the alien that may be contained in the records of the State  Department or INS; and (2) information on whether the alien has ever been determined to  be ineligible to receive a visa or be admitted to the United States.  The system shall maintain, for a minimum of 10 years, information about each application  for admission made by an alien seeking a waiver.  On and after October 1, 2007, the alien at the time of application for admission must have  a valid unexpired machine-readable passport that satisfies the internationally accepted  standard for machine readability.  Countries designated to participate before May 1, 2000, shall issue machine-readable  passports no later than October 1, 2003.  All Visa Waiver Program (VWP) applicants are to be checked against lookout systems.  By October 1, 2002, no waiver may be provided to an alien arriving by air or sea at a port  of entry on a carrier unless the carrier is electronically transmitting passenger data to the  entry exit system.  Not less than 1 hour before arrival at port of entry, signatory aircraft transporting VWP  aliens must electronically furnish the passenger data required by the Attorney General in  regulations.  The system shall contain sufficient data to permit the Attorney General to calculate, for  each program country and each fiscal year, the portion of nationals of that country who  arrive under VWP at air and sea ports of entry but for whom no record of departure exists,  expressed as a percentage of the total number of such VWP aliens for the particular  country.  Focus of system development shall be on (a) utilization of biometric technology and  (b) tamper-resistant documents readable at ports of entry.  The system must be accessible to (a) all consular officers responsible for visa issuance,  (b) all federal inspection agents at all U.S. border inspection points, and (c) all law  enforcement and intelligence responsible for investigation or identification of aliens.  The entry exit system must be able to interface with law enforcement databases to be  used by federal law enforcement to identify and detain individuals who pose a threat to  the national security of the United States.   (1) Not later than 60 days after the date of enactment, each air carrier and foreign air  carrier operating a passenger flight in foreign air transportation to the United States shall  provide to the Commissioner of Customs by electronic transmission a passenger and  crew manifest containing the following information:    The full name of each passenger and crew member.    The date of birth and citizenship of each passenger and crew member.    The sex of each passenger and crew member.    The passport number and country of issuance of each passenger and crew member if  required for travel.
The U.S. visa number or resident alien card number of each passenger and crew  member, as applicable.
Such other information as the Under Secretary of Transportation for Security, in  consultation with the Commissioner of Customs, determines is reasonably necessary  to ensure aviation safety.
Carriers may use the advanced passenger information system established under section  431 of the Tariff Act of 1930 (19 U.S.C. 1431) to provide the information required by the  preceding sentence.
Provisions  (2) Passenger name records—The carriers shall make passenger name record  information available to the Customs Service upon request.  (3) Transmission of manifest—a passenger and crew manifest required for a flight under  paragraph (1) above shall be transmitted to the Customs Service in advance of the  aircraft landing in the United States in such manner, time, and form as the Customs  Service prescribes.  (4) Transmission of manifests to other federal agencies—Upon request, information  provided to the Under Secretary or the Customs Service under this subsection may be  shared with other federal agencies for the purpose of protecting national security.  No later than October 26, 2004, the Secretary of State and the Attorney General shall  issue to aliens only machine-readable, tamper-resistant visas and other travel and entry  documents that use biometrics.  In addition to the requirement for biometric identifiers, name-search capacity and support  must also be implemented between 18 months and 4.5 years after the date of enactment.  Not later than October 26, 2004, the Attorney General and Secretary of State shall install  at all U.S. ports of entry equipment and software to allow biometric comparison and  authentication of all U.S. visas and other travel and entry documents issued to aliens.  Not later than January 1, 2003, arrival and departure manifests must be electronically  provided to appropriate immigration officers for each passenger (including crew members  and any other occupants) of air and sea carriers at port of entry.  The information to be provided with respect to each person listed on a manifest shall  include (1) complete name; (2) date of birth; (3) citizenship; (4) sex; (5) passport number  and country of issuance; (6) country of residence; (7) U.S. visa number, date, and place  of issuance, where applicable; (8) alien registration number, where applicable; (9) U.S.  address while in the United States; and (10) such other information that the Attorney  General, in consultation with the Secretaries of State and the Treasury, determines as  being necessary for the identification of the persons transported and for the enforcement  of the immigration laws and to protect safety and national security.
section_title: Appendix V: GAO Contacts and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the person named above, other key contributors were Carol  Cha, Barbara Collier, Neil Doherty, Ashfaq Huda, Richard Hung, Franklin  Jackson, Tammi Nguyen, and Jamelyn Smith.