Visa Waiver Program: DHS Has Implemented the Electronic System for Travel Authorization, but Further Steps Needed to Address Potential Program Risks
Published: 2011-05-05T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Visa Waiver Program (VWP) allows eligible nationals from 36 member countries to travel to the United States for tourism or business for 90 days or less without a visa. In 2007, Congress required the Secretary of Homeland Security, in consultation with the Secretary of State, to implement an automated electronic travel authorization system to determine, prior to travel, applicants' eligibility to travel to the United States under the VWP. Congress also required all VWP member countries to enter into an agreement with the United States to share information on whether citizens and nationals of that country traveling to the United States represent a security threat. In 2002, Congress mandated that the Department of Homeland Security (DHS) review, at least every 2 years, the security risks posed by each VWP country's participation in the program. In this report, GAO evaluates (1) DHS's implementation of an electronic system for travel authorization; (2) U.S. agencies' progress in negotiating informationsharing agreements; and (3) DHS's timeliness in issuing biennial reports. GAO reviewed relevant documents and interviewed U.S., foreign government, and travel industry officials in six VWP countries.
section_title: What GAO Found
paragraphs: DHS has implemented the Electronic System for Travel Authorization (ESTA) and has taken steps to minimize the burden associated with the new program requirement. However, DHS has not fully evaluated security risks related to the small percentage of VWP travelers without verified ESTA approval. DHS requires applicants for VWP travel to submit biographical information and answers to eligibility questions through ESTA prior to travel. Travelers whose ESTA applications are denied can apply for a U.S. visa. In developing and implementing ESTA, DHS has made efforts to minimize the burden imposed by the new requirement. For example, although travelers formerly filled out a VWP application form for each journey to the United States, ESTA approval is generally valid for 2 years. Most travel industry officials GAO interviewed in six VWP countries praised DHS's widespread ESTA outreach efforts, reasonable implementation time frames, and responsiveness to feedback, but expressed dissatisfaction with the costs associated with ESTA. In 2010, airlines complied with the requirement to verify ESTA approval for almost 98 percent of VWP passengers prior to boarding, but the remaining 2 percent-- about 364,000 travelers--traveled under the VWP without verified ESTA approval. DHS has not yet completed a review of these cases to know to what extent they pose a risk to the program. To meet the legislative requirement, DHS requires that VWP countries enter into three information-sharing agreements with the United States; however, only half of the countries have fully complied with this requirement and many of the signed agreements have not been implemented. Half of the countries have entered into agreements to share watchlist information about known or suspected terrorists and to provide access to biographical, biometric, and criminal history data. By contrast, almost all of the 36 VWP countries have entered into an agreement to report lost and stolen passports. DHS, with the support of interagency partners, has established a compliance schedule requiring the last of the VWP countries to finalize these agreements by June 2012. Although termination from the VWP is one potential consequence for countries not complying with the information-sharing agreement requirement, U.S. officials have described it as undesirable. DHS, in coordination with State and Justice, has developed measures short of termination that could be applied to countries not meeting their compliance date. DHS has not completed half of the most recent biennial reports on VWP countries' security risks in a timely manner. According to officials, DHS assesses, among other things, counterterrorism capabilities and immigration programs. However, DHS has not completed the latest biennial reports for 18 of the 36 VWP countries in a timely manner, and over half of these reports are more than 1 year overdue. Further, in the case of two countries, DHS was unable to demonstrate that it had completed reports in the last 4 years. DHS cited a number of reasons for the reporting delays. For example, DHS officials said that they intentionally delayed report completion because they frequently did not receive mandated intelligence assessments in a timely manner and needed to review these before completing VWP country biennial reports.
section_title: What GAO Recommends
paragraphs: GAO recommends that DHS establish time frames for the regular review of cases of ESTA noncompliance and take steps to address delays in the biennial review process. DHS concurred with the report's recommendations.

section_title: Letter
paragraphs: In 2010, more than 17 million foreign nationals from 36 participating  countries entered the United States for tourism or business for 90 days or  less under the Visa Waiver Program (VWP). Congress established the  program in 1986 to facilitate international travel without threatening U.S.  security. The Implementing Recommendations of the 9/11 Commission Act  of 2007 (9/11 Act) called for the Department of Homeland Security (DHS),  which implements the program, to take steps to enhance the security of  the VWP. Among the mandated changes were (1) the implementation of  an electronic system for travel authorization designed to determine in  advance of travel the eligibility of VWP applicants to travel to the United  States under the program, (2) a requirement that all VWP countries enter  into agreements to share information with the United States on whether  citizens and nationals of that country traveling under the program  represent a threat to the security or welfare of the United States, and (3) a  requirement that all VWP countries enter into agreements with the United  States to report or make available lost and stolen passport data to the  United States. Prior to these changes, Congress also mandated in 2002 that  DHS evaluate and report on the security risks posed by each visa waiver  country’s participation in the program at least once every 2 years. In 2006,  GAO identified deficiencies in DHS’s biennial reporting process and  recommended the finalization of protocols that included deadlines for  report completion.
VWP travelers are not subject to the same degree of screening as those  with visas because they are not interviewed by a Department of State  (State) consular officer before arriving at a U.S. port of entry. As a result,  concerns have been raised that the VWP could be exploited to gain illegal  entry into the United States. Effective oversight of the VWP is essential to  find the right balance between facilitating legitimate travel and screening  for potential terrorists, criminals, and others that may pose national  security, law enforcement, or immigration concerns.
In response to your request, this report (1) reviews DHS’s implementation  of the Electronic System for Travel Authorization (ESTA); (2) assesses  U.S. agencies’ progress in negotiating the required information-sharing  agreements with VWP countries; and (3) assesses the timeliness of DHS’s  biennial reports on VWP countries.
To assess the implementation of ESTA, we reviewed relevant  documentation, including 2006 and 2008 GAO reports evaluating the VWP  and statistics on program applicants and travelers. We also interviewed  consular, public diplomacy, and law enforcement officials at U.S.  embassies in six VWP countries: France, Ireland, Japan, South Korea,  Spain, and the United Kingdom. We met with political and commercial  officers at five of the six U.S. embassies. In the six countries, we also met  with airline officials and travel industry officials regarding ESTA  implementation. While the results of our site visits are not generalizable,  they provided perspectives on VWP and ESTA implementation. To assess  DHS’s progress in meeting information-sharing agreement requirements,  we reviewed the templates used to begin negotiations for information- sharing agreements and lists of countries that have met the requirement to  enter into information-sharing agreements with the United States. We  interviewed officials from DHS, State, and the Department of Justice  (Justice) at headquarters and at U.S. embassies in six VWP countries who  have participated in negotiating or implementing information-sharing  agreements with VWP countries. We also interviewed foreign government  officials from agencies responsible for negotiating information-sharing  agreements with the U.S. government and International Criminal Police  Organization (Interpol) officials in Lyon, France, who receive the  information on lost and stolen passports from VWP country governments.  To assess the timeliness of biennial reports on VWP countries, we  reviewed documentation of DHS biennial report completion and DHS’s  standard operating procedures for conducting biennial reviews.
We conducted this performance audit from January 2010 to May 2011, in  accordance with generally accepted government auditing standards. Those  standards require that we plan and perform the audit to obtain sufficient,  appropriate evidence to provide a reasonable basis for our findings and  conclusions based on our audit objectives. We believe that the evidence  obtained provides a reasonable basis for our findings and conclusions  based on our audit objectives.
We received written comments from DHS, which we have reprinted in  appendix III. We also received technical comments from DHS, State, and  Justice and incorporated those comments, as appropriate. DHS agreed  with our recommendations and stated that it is undertaking and  considering efforts to address them. DHS provided additional information  on its efforts to monitor and assess issues that may pose a risk to U.S.  interests.
subsections: section_title: Background
subsections: section_title: Legislation Authorizing the VWP
paragraphs: The Immigration Reform and Control Act of 1986 created the VWP as a  pilot program, and the Visa Waiver Permanent Program Act permanently  established the program in October 2000. The program’s purpose is to  facilitate the legitimate travel of visitors for business or tourism. By  providing visa-free travel to the United States, the program is intended to  boost international business and tourism, as well as airline revenues, and  create substantial economic benefits to the United States. Moreover, the  program allows State to allocate more resources to visa-issuing posts in  countries with higher risk applicant pools.
In November 2002, Congress passed the Homeland Security Act of 2002,  which established DHS and gave it responsibility for establishing visa  policy, including policy for the VWP. Previously, Justice had overall  responsibility for managing the program. In July 2004, DHS created the  Visa Waiver Program Oversight Unit within the Office of International  Enforcement and directed that unit to oversee VWP activities and monitor  participating VWP countries’ adherence to the program’s statutory and  policy requirements. In September 2007, the office was renamed the Visa  Waiver Program Office. To help fulfill its responsibilities, DHS established  an interagency working group comprising representatives from State,  Justice, and several DHS component agencies and offices, including U.S.  Customs and Border Protection (CBP) and U.S. Immigration and Customs  Enforcement.
Since the attacks on the United States on September 11, 2001, Congress  has passed several other laws to strengthen border security policies and  procedures. For example, the Enhanced Border Security and Visa Entry  Reform Act of 2002 increased the frequency—from once every 5 years to  at least once every 2 years—of mandated assessments of the effect of each  country’s continued participation in the VWP on U.S. security, law  enforcement, and immigration interests. The 9/11 Act also added security  requirements for all VWP countries, such as the requirement that countries  enter into an agreement with the United States to share information on  whether citizens and nationals of that country traveling to the United  States represent a threat to the security or welfare of the United States or  U.S. citizens.
section_title: VWP Member Countries
paragraphs: When the Visa Waiver Pilot Program was established in 1986, participation  was limited to eight countries. Since then, the VWP has expanded to 36  countries. Figure 1 shows the locations of the current member countries.
section_title: VWP Requirements
paragraphs: To qualify for the VWP a country must    offer reciprocal visa-free travel privileges to U.S. citizens;    have had a refusal rate of less than 3 percent for the previous fiscal year  for its nationals who apply for business and tourism visas; issue machine-readable passports to its citizens;   enter into an agreement with the United States to report or make available  through Interpol or other means as designated by the Secretary of  Homeland Security information about the theft or loss of passports;   accept the repatriation of any citizen, former citizen, or national against  whom a final order of removal is issued no later than 3 weeks after the  order is issued;   enter into an agreement with the United States to share information  regarding whether citizens and nationals of that country traveling to the  United States represents a threat to U.S. security or welfare; and   be determined not to compromise the law enforcement (including  immigration enforcement) or security interests of the United States by its  inclusion in the program.
In addition, all passports issued after October 26, 2005, must contain a  digital photograph in the document for travel to the United States under  the program, and passports issued after October 26, 2006, must be   e-passports that are tamper-resistant and incorporate a biometric  identifier. Nationals from countries that have joined the VWP since 2008  must use e-passports in order to travel under the VWP. Effective July 1,  2009, all emergency or temporary passports must be e-passports as well  for use under the VWP.
To be eligible to travel without a visa under the program, nationals of VWP  countries must    have received an authorization to travel under the VWP through ESTA;    have a valid passport issued by the participating country and be a national    seek entry for 90 days or less as a temporary visitor for business or    have been determined by CBP at the U.S. port of entry to represent no  threat to the welfare, health, safety, or security of the United States;   have complied with conditions of any previous admission under the  program (for example, individuals must not have overstayed the 90-day  limit during prior visits under the VWP); if entering by air or sea, possess a return trip ticket to any foreign  destination issued by a carrier that has signed an agreement with the U.S.  government to participate in the program, and must have arrived in the  United States aboard such a carrier; and if entering by land, have proof of financial solvency and a domicile abroad  to which they intend to return.
Travelers who do not meet these requirements are required to obtain a  visa from a U.S. embassy or consulate overseas before traveling to the  United States. Unlike visa holders, VWP travelers generally may not apply  for a change in status or an extension of the allowed period of stay.  Individuals who have been refused admission to the United States  previously must also apply for a visa. VWP travelers waive their right to  review or appeal a CBP officer’s decision regarding their admissibility at  the port of entry or to contest any action for removal, other than on the  basis of an application for asylum.
section_title: DHS Implemented ESTA to Meet Mandated Requirement but Has Not Fully Analyzed Risks from Noncompliance
paragraphs: DHS has implemented ESTA to meet the 9/11 Act requirement intended to  enhance program security and has taken steps to minimize the burden on  travelers to the United States added by the new requirement, but it has not  fully analyzed the risks of carrier and passenger noncompliance with the  requirement. DHS developed ESTA to collect passenger data and complete  security checks on the data before passengers board a U.S. bound carrier.  In developing and implementing ESTA, DHS took several steps to  minimize the burden associated with ESTA use. For example, ESTA  reduced the requirement that passengers provide biographical information  to DHS officials from every trip to once every 2 years. In addition, because  of ESTA, DHS has informed passengers who do not qualify for VWP travel  that they need to apply for a visa before they travel to the United States.  Moreover, most travel industry officials we interviewed in six VWP  countries praised DHS’s widespread ESTA outreach efforts, reasonable  implementation time frames, and responsiveness to feedback but  expressed dissatisfaction over ESTA fees. Also, although carriers complied  with the ESTA requirement to verify ESTA approval for almost 98 percent  of VWP passengers before boarding them in 2010, DHS does not have a  target completion date for a review to identify potential security risks  associated with the small percentage of cases of traveler and carrier  noncompliance with the ESTA requirement.
subsections: section_title: DHS Implemented ESTA to Meet Congressional Requirement and Use Rose Rapidly After DHS Made It Mandatory
subsections: section_title: DHS Implemented ESTA to Assist with Preboarding Checks of Passenger Data
paragraphs: Pursuant to the 9/11 Act, DHS implemented ESTA, an automated, Web- based system, to assist in assessing passengers’ eligibility to travel to the  United States under the VWP by air or sea before they board a U.S. bound  carrier. DHS announced ESTA as a new requirement for travelers  entering the United States under the VWP on June 9, 2008, and began  accepting ESTA applications on a voluntary basis in August 2008.  Beginning January 12, 2009, DHS required all VWP travelers to apply for  ESTA approval prior to travel to the United States. DHS began enforcing  compliance with ESTA requirements in March 2010, exercising the right to  fine a carrier or rescind its VWP signatory status for failure to comply with  the ESTA requirement. Although passengers may apply for ESTA approval  anytime before they board a plane or ship bound for the United States,  DHS recommends that travelers apply when they begin preparing travel  plans. Prior to ESTA’s implementation, all travelers from VWP countries  manually completed a form—the I-94W—en route to the United States,  supplying biographical information and answering questions to determine  eligibility for the VWP. DHS officials collected the forms from VWP  passengers at U.S. ports of entry and used the information on the forms to  qualify or disqualify the passengers for entry into the United States  without a visa.
DHS uses ESTA to electronically collect VWP applicants’ biographical  information and responses to eligibility questions. The ESTA application  requires the same information collected through the I-94W forms. When an  applicant submits an ESTA application, DHS systems evaluate the  applicant’s biographical information and responses to VWP eligibility  questions. (See table 1.) If the DHS evaluation results in a denial of the  application, the applicant is directed to apply for a U.S. visa. For all other  applications, if this review process locates no information requiring  further analysis, DHS notifies the applicant that the application is  approved; if the process locates such information, DHS notifies the  applicant that the application is pending, and DHS performs a manual  check on the information. For example, if an applicant reports that a  previous U.S. visa application was denied, DHS deems the ESTA  application pending and performs additional review. If on further review  of any pending application DHS determines that information disqualifies  the applicant from VWP travel, the application is denied, and the individual  is directed to apply for a visa; otherwise the applicant is approved.
Figure 2 illustrates the ESTA application review process. (See app. II for  information on how to apply for ESTA.)
According to DHS data, the number of individuals submitting ESTA  applications increased from about 180,000 per month in 2008, when  applying was voluntary, to more than 1.15 million per month in 2009 and  2010 after DHS made ESTA mandatory. DHS approved over 99 percent of  the almost 28.6 million ESTA applications submitted from August 2008  through December 2010, but it also denied the applications of thousands  of individuals it deemed ineligible to travel to the United States under the  VWP. The denial rate has decreased slightly from 0.42 percent in 2008 to  0.24 percent in 2010. (See fig. 3.)
DHS data show that DHS denied 77,132 of the almost 28.6 million  applications for VWP travel submitted through ESTA from 2008 through  2010. Reasons for denials included applicants’ responses to the eligibility  questions, as well as DHS’s discovery of other information that disqualified  applicants from travel under the VWP. Examples are as follows:    DHS denied 19,871 applications because of applicant responses to the  eligibility questions.
DHS denied 36,744 pending applications because of the results of manual  reviews of passenger data.
DHS denied 15,078 applications because the applicants had unresolved  cases of a lost or stolen passport that DHS decided warranted an in-person  visa interview with a State consular officer.
In addition, ESTA applications are regularly reevaluated as new  information becomes available to DHS, potentially changing applicants’  ESTA status.
section_title: DHS Made Efforts to Minimize Burden of ESTA Requirement
paragraphs: In developing and implementing ESTA, DHS has taken steps to minimize  the burden associated with ESTA’s use.
Less frequent applications. ESTA approval for program participants  generally remains valid for 2 years. Prior to ESTA implementation,  passengers traveling under the program were required to complete the I- 94W form to determine their program eligibility each time they boarded a  carrier to the United States. When DHS implemented ESTA, the burden on  passengers increased because DHS also required ESTA applicants to  complete an I-94W form. However, on June 29, 2010, DHS eliminated the I- 94W requirement for most air and sea travelers who had been approved by  ESTA. According to travel industry officials in the six VWP countries we  visited, this change has simplified travel for many travelers, especially  business travelers who travel several times each year. DHS officials said  the change also eliminated the problems of deciphering sometimes  illegible handwriting on the I-94W forms.
Earlier notice of ineligibility. ESTA notifies passengers of program  ineligibility, and therefore of the need to apply for a visa, before they  embark for the United States. Prior to ESTA implementation, passengers  from VWP countries did not learn until reaching the U.S. port of entry  whether they were eligible to enter under the VWP or would be required to  obtain a visa. Because DHS received passengers’ completed I-94W forms at  the port of entry, DHS officials did not recommend that carriers prevent  passengers from VWP countries from boarding a U.S. bound carrier   without a visa unless they were deemed ineligible based on other limited  preboarding information provided by carriers.
Widespread U.S. government outreach. VWP country government and  travel industry officials praised widespread U.S. government efforts to  provide information about the ESTA requirements. After announcing  ESTA, DHS began an outreach campaign in VWP countries and for foreign  government embassy staff in the United States, with the assistance of  other U.S. agencies, to publicize the requirement. DHS officials said they  spent $4.5 million on ESTA outreach efforts. Although none of the six  embassies we visited tracked the costs associated with outreach, each  embassy provided documentation of their use of many types of outreach  efforts listed in table 2. VWP country government officials and travel  industry officials we met said that although they were initially concerned  that ESTA implementation would be difficult and negatively affect airlines  and many VWP passengers, implementation went more smoothly than  expected.
Reasonable implementation time frames. Most of the VWP country airline  officials with whom we met said that the ESTA implementation time  frames set by DHS were reasonable. In 2008, DHS introduced ESTA and  made compliance voluntary. The following year, DHS made ESTA  mandatory but did not levy fines if airlines did not verify passengers’ ESTA  approval before boarding them. This allowed the U.S. government more  time to publicize the requirement, according to DHS officials. Enforcement  began in March 2010. According to most of the officials we interviewed  from 17 airlines in the six VWP countries we visited, the phased-in  compliance generally allowed passengers sufficient time to learn about the  ESTA requirement and allowed most airlines sufficient time to update  their systems to meet the requirement. ESTA officials said that the phased- in compliance also provided time to fix problems with the system before  enforcing airline and passenger compliance.
DHS responsiveness to travel industry feedback. VWP travel industry  officials said that DHS officials’ efforts to adapt ESTA in response to  feedback have clarified the application process. Since initial  implementation of ESTA in 2008, DHS has issued updates to the system on  21 occasions. According to DHS officials, many of these changes  addressed parts of the application that were unclear to applicants. For  example, DHS learned from some travel industry officials that many  applicants did not know how to answer a question on the application  about whether they had committed a crime of moral turpitude because  they did not know the definition of “moral turpitude.” In September 2010,  DHS released an updated ESTA application that included a definition of  the term directly under the question. Further, updates have made the  ESTA application available in 22 languages instead of only English. DHS  also made it possible for denied applicants to reapply and be approved if  they mistakenly answered “yes” to select eligibility questions. Although  travel industry officials we met with in six VWP countries said there are  still ways ESTA should be improved, they said that DHS’s responsiveness  in amending the ESTA application had made the system more user  friendly.
Shorter reported passenger processing times. According to a study  commissioned by DHS and conducted at three U.S. ports of entry, ESTA  has reduced the average time DHS takes to process a VWP passenger  before deciding whether to admit them into the United States by a range of  between 17.8 and 54 percent. The study attributed this time savings to  factors such as the reduction in number of documents DHS officers  needed to handle and evaluate and the reduction in data entry needed at  the port of entry.
Although DHS took steps to minimize the burden imposed by ESTA  implementation, almost all government and travel industry officials we  met in six VWP countries expressed dissatisfaction over the Travel  Promotion Act of 2009 (TPA) fee collected as part of the ESTA  application. In September 2010, the U.S. government began to charge  ESTA applicants a $14 fee when they applied for ESTA approval, including  $10 for the creation of a corporation to promote travel to the United States  and $4 to fund ESTA operations. According to many of the VWP country  government and travel industry officials with whom we met, the TPA fee is  unfair because it burdens those traveling to the United States with an  added fee to encourage others to travel to the United States. Some of the  officials pointed out that it was unrelated to VWP travel and that it runs  counter to the program objective of simplifying travel for VWP  participants. DHS officials said that many government and travel industry  officials from VWP countries view the fee as a step away from visa-free  travel and consider ESTA with the fee “visa-lite.” By comparison, a  nonimmigrant visitor visa costs over $100 but is generally valid for five  times as long as ESTA approval. Several foreign officials said they  expected that the fee amount would continue to rise over time. DHS  officials stated that they cannot control the TPA portion of the ESTA fee  because it was mandated by law.
In addition, some airline officials expressed concern that the ESTA  requirement was one of many requirements imposed by DHS that required  the carriers to bear the cost of system updates. DHS officials said that the  ESTA requirement did impose a new cost to carriers, but that it was  necessary to strengthen the security of the VWP.
section_title: Carrier Compliance with ESTA Requirement Increased After DHS Made ESTA Mandatory, but DHS Has Not Fully Assessed Risks of Noncompliance
paragraphs: According to DHS, air and sea carriers are required to verify that each  passenger they board has ESTA approval before boarding them. Carriers’  compliance with the requirement has increased since DHS made ESTA  mandatory and has exceeded 99 percent in recent months. DHS data show  the following:    2008. In 2008, when VWP passenger and carrier compliance was  voluntary, airlines and sea carriers verified ESTA approval for about 5.4  percent of passengers boarded under the VWP. According to DHS officials,  carriers needed time to update their systems to receive passengers’ ESTA  status, and DHS needed time to publicize the new travel requirement.   2009. ESTA became mandatory in January 2009, and carriers verified  ESTA approval for about 88 percent of passengers boarded under the VWP  that year.   2010. In March 2010, DHS began enforcing carrier compliance. In that  year, carriers verified ESTA approval for almost 98 percent of VWP  passengers. As of January 2011, DHS had imposed fines on VWP carriers  for 5 of the passengers who had been allowed to board without ESTA  approval.
Figure 4 shows the percentage of VWP passengers boarded by carriers  who had verified the passengers’ ESTA approval. In addition, from  September 2010 through January 2011, carrier compliance each month  exceeded 99 percent.
Although carriers verified ESTA approval for almost 98 percent of VWP  passengers before boarding them for VWP travel in 2010, DHS has not fully  analyzed the potential risks posed by cases where carriers boarded  passengers for VWP travel without verifying that they had ESTA approval.  In 2010, about 2 percent—364,086 VWP passengers—were boarded  without verified ESTA approval. For most of these passengers—363,438,  or about 99.8 percent—no ESTA application had been recorded. The  remainder without ESTA approval—648, or about 0.2 percent—were  passengers whose ESTA applications had been denied. DHS officials told  us that, although there is no official agency plan for monitoring and  oversight of ESTA, the ESTA office is undertaking a review of each case of  a carrier’s boarding a VWP traveler without an approved ESTA application;  however, DHS has not established a target date for completing this review.  In its review of these cases, DHS officials said they expect to determine  why the carrier boarded the passengers, whether and why DHS admitted  these individuals into the United States, and whether the airline or sea  carrier should be fined for noncompliance.
DHS tracks some data on passengers that travel under the VWP without  verified ESTA approval but does not track other data that would help  officials know the extent to which noncompliance poses a risk to the  program. For example, although DHS officials said that about 180 VWP  travelers who arrive at a U.S. port of entry without ESTA approval are  admitted to the United States each day, they have not tracked how many,  if any, of those passengers had been denied by ESTA. DHS also reported  that 6,486 VWP passengers were refused entry into the United States at the  port of entry in 2010, but that number includes VWP passengers for whom  carriers had verified ESTA approval. Officials did not track how many of  those had been boarded without verified ESTA approval. DHS also did not  know how many passengers without verified ESTA approval were boarded  with DHS approval after system outages precluded timely verification of  ESTA approval.
Without a completed analysis of noncompliance with ESTA requirements,  DHS is unable to determine the level of risk that noncompliance poses to  VWP security and to identify improvements needed to minimize  noncompliance. In addition, without analysis of data on travelers who  were admitted to the United States without a visa after being denied by  ESTA, DHS cannot determine the extent to which ESTA is accurately  identifying individuals who should be denied travel under the program.
section_title: Only Half of VWP Countries Have Entered Into All Required Information- Sharing Agreements
paragraphs: Although DHS and partners at State and Justice have made progress in  negotiating information-sharing agreements with VWP countries, required  by the 9/11 Act, only half of the countries have entered into all required  agreements. In addition, many of the agreements entered into have not  been implemented. The 9/11 Act does not establish an explicit deadline for  compliance, but DHS with support from State and Justice has produced a  completion schedule that requires agreements to be entered into by the  end of each country’s current or next biennial review cycle, the last of  which will be completed by June 2012. In coordination with State and  Justice, DHS also outlined measures short of termination that may be  applied to VWP countries not meeting their compliance date.
subsections: section_title: DHS Requires VWP Countries to Enter Into Three Agreements
paragraphs: The 9/11 Act specifies that each VWP country must enter into agreements  with the United States to share information regarding whether citizens and  nationals of that country traveling to the United States represent a threat  to the security or welfare of the United States and to report lost or stolen  passports. DHS, in consultation with other agencies, has determined that  VWP countries can satisfy the requirement by entering into the following  three bilateral agreements:    Homeland Security Presidential Directive 6 (HSPD-6),    Preventing and Combating Serious Crime (PCSC), and    Lost and Stolen Passports (LASP).
According to DHS officials, countries joining the VWP after the 9/11 Act  entered into force are required to enter into HSPD-6 and PCSC agreements  with the United States as a condition of admission into the program. In  addition, prior to joining the VWP, such countries are required to enter  into agreements containing specific arrangements for information sharing  on lost and stolen passports. As illustrated in table 3 below, DHS, State,  and Justice have made some progress with VWP countries in entering into  the agreements.
All VWP countries and the United States share some information with one  another on some level, but the existence of a formal agreement improves  information sharing, according to DHS officials. As opposed to informal  case-by-case information sharing, formal agreements expand the pool of  information to which the United States has systematic access. They can  draw attention to and provide information on individuals of whom the  United States would not otherwise be aware. According to officials, formal  agreements generally expedite the sharing of information by laying out  specific terms that can be easily referred to when requesting data. DHS  officials observed that timely access to information is especially important  for CBP officials at ports of entry.
subsections: section_title: HSPD-6 Agreement
paragraphs: HSPD-6 agreements establish a procedure between the United States and  partner countries to share watchlist information about known or  suspected terrorists. As of January 2011, 19 of the 36 VWP countries had  signed HSPD-6 agreements, and 13 have begun sharing information  according to the signed agreements. (See table 3.) Justice’s Terrorist  Screening Center (TSC) and State have the primary responsibility to  negotiate and conclude these information-sharing agreements. An  interagency working group, co-led by TSC and State that also includes  representatives from U.S. law enforcement, intelligence, and policy  communities, addresses issues with the exchange of information and  coordinates efforts to enhance information exchange. While the  agreements are based on a template that officials use as a starting point  for negotiations, according to TSC officials, the terms of each HSPD-6  agreement are unique, prescribing levels of information sharing that reflect  the laws, political will, and domestic policies of each partner country. TSC  officials said most HSPD-6 agreements are legally nonbinding. Officials  said that this allows more flexibility in information-sharing procedures and  simplifies negotiations with officials from partner countries. The TSC  officials noted that the nonbinding nature of the agreements may allow  some VWP countries to avoid bureaucratic and political hurdles.
Noting that State and TSC continue to negotiate HSPD-6 agreements with  VWP countries, officials cited concerns regarding privacy and data  protection expressed by many VWP countries as reasons for the delayed  progress. According to these officials, in some cases, domestic laws of  VWP countries limit their ability to commit to sharing some information,  thereby complicating and slowing the negotiation process. The terms of  HSPD-6 agreements are also extremely sensitive, TSC officials noted, and  therefore many HSPD-6 agreements are classified. Officials expressed  concern that disclosure of the agreements themselves might either (1)  cause countries that had already signed agreements to become less  cooperative in sharing data on known or suspected terrorists and reduce  the exchange of information or (2) cause countries in negotiation to  become less willing to sign agreements or insist on terms prescribing less  information sharing.
The value and quality of information received through HSPD-6 agreements  vary, and some partnerships are more useful than others, according to TSC  officials. The officials stated that some partner countries were more  willing than others to share data on known or suspected terrorists. For  example, according to TSC officials, some countries do not share data on  individuals suspected of terrorist activity but only on those already  convicted. In other cases, TSC officials stated that some partner countries  did not have the technical capacity to provide all information typically  obtained through HSPD-6 agreements. For example, terrorist watchlist  data include at least the name and date of birth of the suspect and may  also include biometric information such as fingerprints or photographs.  According to DHS officials, some member countries do not have the legal  or technical ability to store such information.
TSC has evidence that information is being shared as a result of HSPD-6  agreements. They provided the number of encounters with known or  suspected terrorists generated through sharing watchlist information with  foreign governments. TSC officials noted that they viewed these data as  one measure of the relevance of the program, but not as comprehensive  performance indicators. Although TSC records the number of encounters,  HSPD-6 agreements do not contain terms requiring partner countries to  reveal the results of these encounters, and there is no case management  system to track and close them out, according to TSC officials.
section_title: PCSC Agreement
paragraphs: The PCSC agreements establish the framework for law enforcement  cooperation by providing each party automated access to the other’s  criminal databases that contain biographical, biometric, and criminal  history data. (See table 3.) As of January 2011, 18 of the 36 VWP countries  had met the PCSC information-sharing agreement requirement, but the  networking modifications and system upgrades required to enable this  information sharing to take place have not been completed for any VWP  countries. The language of the PCSC agreements varies slightly because,  according to agency officials, partner countries have different legal  definitions of what constitutes a serious crime or felony, as well as varying  demands regarding data protection provisions.
Achieving greater progress negotiating PCSC agreements has been  difficult, according to DHS officials, because the agreements require  lengthy and intensive face-to-face discussions with foreign governments.  Justice and DHS, with assistance from State, negotiate the agreements  with officials from partner countries that can include representatives from  their law enforcement and justice ministries, as well as their diplomatic  corps. Further, sharing sensitive personal information with the United  States is publicly unpopular in many VWP countries, even if the countries’  law enforcement agencies have no reluctance to share information.  Officials in some VWP countries told us that efforts to overcome political  barriers have caused further delays.
Though officials expect to complete networking modifications necessary  to allow queries of Spain’s and Germany’s criminal databases in 2011, the  process is a legally and technically complex one that has not yet been  completed for any of the VWP countries. According to officials, DHS is  frequently not in a position to influence the speed of PCSC implementation  for a number of reasons. For example, according to DHS officials, some  VWP countries require parliamentary ratification before implementation  can begin. Also U.S. and partner country officials must develop a common  information technology architecture to allow queries between databases.
section_title: LASP Agreement
paragraphs: In a 2006 GAO report, we found that not all VWP countries were  consistently reporting data on lost and stolen passports. We recommended  that DHS develop clear standard operating procedures for such reporting,  including a definition of timely reporting. As of January 2011, all VWP  countries were sharing lost and stolen passport information with the  United States, and 34 of the 36 VWP countries had entered into LASP  agreements. (See table 3.)
The 9/11 Act requires VWP countries to enter into an agreement with the  United States to report, or make available to the United States through  Interpol or other means as designated by the Secretary of Homeland  Security information about the theft or loss of passports. According to  DHS officials, other international mandates have helped the United States  to obtain LASP information. Since 2005, all European Union countries  have been mandated to send data on lost and stolen passports to Interpol  for its Stolen and Lost Travel Documents database. In addition, Australia  and New Zealand have agreements to share lost and stolen passport  information through the Regional Movement Alert System. According to  officials, in fiscal year 2004, more than 700 fraudulent passports from VWP  countries were intercepted at U.S. ports of entry; however, by fiscal year  2010, this number had decreased to 64. DHS officials attributed the  decrease in the use of fraudulent passports in part to better LASP  reporting to Interpol. More complete data has allowed DHS to identify  more individuals attempting VWP travel with a passport that has been  reported lost or stolen before they begin travel.
section_title: DHS Established a Compliance Schedule for Entering Into Information- Sharing Agreements
paragraphs: Although the 9/11 Act does not establish an explicit deadline, DHS, with  the support of partners at State and Justice, has produced a compliance  schedule that requires agreements to be entered into by the end of each  country’s current or next biennial review cycle, the last of which will be  completed by June 2012. In March 2010, State sent a cable to posts in all  VWP countries that instructed the appropriate posts to communicate the  particular compliance date to the government of each noncompliant VWP  country. However, DHS officials expressed concern that some VWP  countries may not have entered into all agreements by the specified  compliance dates.
section_title: DHS Has Outlined Measures to Encourage VWP Countries to Enter Into Information-Sharing Agreements
paragraphs: According to DHS officials, termination from the VWP is one potential  consequence for VWP countries that do not enter into information-sharing  agreements. However, U.S. officials described termination as undesirable,  saying that it would significantly impact diplomatic relations and would  weaken any informal exchange of information. Further, termination would  require all citizens from the country to obtain visas before traveling to the  United States. According to officials, particularly in the larger VWP  countries, this step would overwhelm consular offices and discourage  travel to the United States, thereby damaging trade and tourism. U.S.  embassy officials in France told us that when the United States required  only a small portion of the French traveling population—those without  machine-readable passports—to obtain visas, U.S. embassy officials  logged many overtime hours, while long lines of applicants extended into  the embassy courtyard.
DHS helped write a classified strategy document that outlines a  contingency plan listing possible measures short of termination from the  VWP that may be taken if a VWP country does not meet its specified  compliance date for entering into information-sharing agreements. The  strategy document provides steps that would need to be taken prior to  selecting and implementing one of these measures. According to officials,  DHS plans to decide which measures to apply on a case-by-case basis.
section_title: DHS Has Not Consistently Completed Timely Biennial Reports
paragraphs: DHS conducts reviews to determine whether issues of security, law  enforcement, or immigration affect VWP country participation in the  program; however, the agency has not completed half of the mandated  biennial reports resulting from these reviews in a timely manner. In 2002,  Congress mandated that, at least once every 2 years, DHS evaluate the  effect of each country’s continued participation in the program on the  security, law enforcement, and immigration interests of the United States.  The mandate also directed DHS to determine based on the evaluation  whether each VWP country’s designation should continue or be terminated  and to submit a written report on that determination to select  congressional committees.
To fulfill this requirement, DHS conducts reviews of VWP countries that  examine and document, among other things, counterterrorism and law  enforcement capabilities, border control and immigration programs and  policies, and security procedures. To document its findings, DHS  composes a report on each VWP country reviewed and a brief summary of  the report to submit to congressional committees. In conjunction with  DHS’s reviews, the Director of National Intelligence (DNI) produces  intelligence assessments that DHS reviews prior to finalizing its VWP  country biennial reports. According to VWP officials, they visited 12  program countries in fiscal year 2009 and 10 countries in fiscal year 2010  to gather the data needed to complete these reports. As of February 2011,  the Visa Waiver Program Office had completed 3 country visits and  anticipated conducting 10 more for fiscal year 2011. If issues of concern  are identified during the VWP country review process, DHS drafts an  engagement strategy documenting the issues of concern and suggesting  recommendations for addressing the issues. According to VWP officials,  they also regularly monitor VWP country efforts to stay informed about  any emerging issues that may affect the countries’ VWP status.
In 2006, we found that DHS had not completed the required biennial  reviews in a timely fashion, and we recommended that DHS establish  protocols including deadlines for biennial report completion. DHS  established protocols in 2007 that include timely completion of biennial  reports as a goal. Our current review shows that DHS has not completed  the latest biennial reports for 50 percent, or 18 of the 36 VWP countries in  a timely manner. Also, over half of those reports are more than 1 year  overdue. In the case of two countries, DHS was unable to demonstrate that  they had completed reports in over 4 years. Further, according to the  evidence supplied by DHS, of the 17 reports completed since the beginning  of 2009, over 25 percent were transmitted to Congress 3 or more months  after report completion, and 2 of those after more than 6 months. DHS  cited a number of reasons for the reporting delays, including a lack of  resources needed to complete timely reports. In addition, DHS officials  said that they sometimes intentionally delayed report completion for two  reasons: (1) because they frequently did not receive DNI intelligence  assessments in a timely manner and needed to review these before  completing VWP country biennial reports or (2) in order to incorporate  anticipated developments in the status of information-sharing agreement  negotiations with a VWP country. Further, DHS officials cited lengthy  internal review as the primary reason for delays in submitting the formal  summary reports to Congress. Without timely reports, it is not clear to  Congress whether vulnerabilities exist that jeopardize continued  participation in the VWP.
section_title: Conclusions
paragraphs: The VWP facilitates travel for nationals from qualifying countries,  removing the requirement that they apply in-person at a U.S. embassy for a  nonimmigrant visa for business or pleasure travel of 90 days or less. In an  attempt to facilitate visa-free travel without sacrificing travel security,  Congress has mandated security measures such as ESTA, information- sharing requirements, and VWP country biennial reviews. While ESTA has  added a fee and a new pretravel requirement that place additional burdens  on the VWP traveler, it has reduced the burden on VWP travelers in several  other ways. DHS does not fully know the extent to which ESTA has  mitigated VWP risks, however, because its review of cases of passengers  being permitted to travel without verified ESTA approval is not yet  complete. Although the percentage of VWP travelers without verified  ESTA approval is very small, DHS oversight of noncompliant travelers may  reduce the risk that an individual that poses a security risk to the United  States could board a plane or ship traveling to the United States. Even if  DHS has authority to deny individuals entry to the United States in such  cases, ESTA was designed to screen such individuals before they embark  on travel to the United States. Moreover, with only half of the countries  participating in the VWP in full compliance with the requirement to enter  into information-sharing agreements with the United States, DHS may not  have sufficient information to deny participation in the VWP to individuals  who pose a security risk to the United States. In addition, the  congressional mandate requiring VWP country biennial reports provides  important information to Congress on security measures in place in VWP  countries but also on potential vulnerabilities that could affect the  countries’ future participation in the program. Because DHS has not  consistently submitted the reports in a timely manner since the legal  requirement was imposed in 2002, Congress does not have the assurance  that DHS efforts to require program countries to minimize vulnerabilities  and its recommendations for continued status in the VWP are based on up- to-date assessments.
section_title: Recommendations for Executive Action
paragraphs: To ensure that DHS can identify and mitigate potential security risks  associated with the VWP, we recommend that the Secretary of Homeland  Security take the following two actions:    establish time frames for the regular review and documentation of cases of  VWP passengers traveling to a U.S. port of entry without verified ESTA  approval, and take steps to address delays in the biennial country review process so that  the mandated country reports can be completed on time.
section_title: Agency Comments and Our Evaluation
paragraphs: DHS provided written comments on a draft of this report. These comments  are reprinted in appendix III. DHS, State, and Justice provided technical  comments that we have incorporated into this report, as appropriate. In  commenting on the draft, DHS stated that it concurred with GAO’s  recommendations and expects to be able to implement them. DHS  provided additional information on its efforts to ensure that VWP  countries remain compliant with program requirements and to monitor  and assess issues that may pose a risk to U.S. interests. DHS also provided  information on actions it is taking to resolve the issues identified in the  audit. For example, DHS stated it will have established procedures by the  end of May 2011 to perform quarterly reviews of a representative sample  of VWP passengers who do not comply with the ESTA requirement.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies of this report to the  appropriate congressional committees, the Secretary of Homeland  Security, the Secretary of State, the Attorney General, and other interested  parties. The report also will be available on the GAO Web site at no charge  at http://www.gao.gov.
If you or your staff members have any questions about this report, please  contact me at (202) 512-4268 or fordj@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on the  last page of this report. Key contributors are listed in appendix IV.
section_title: Appendix I: Scope and Methodology
paragraphs: To assess the implementation of the Electronic System for Travel  Authorization (ESTA), we reviewed relevant documentation, including  2006 and 2008 GAO reports evaluating the Visa Waiver Program (VWP) and  statistics on program applicants and travelers. Between June and  September 2010, we interviewed consular, public diplomacy, and law  enforcement officials at U.S. embassies in six VWP countries: France,  Ireland, Japan, South Korea, Spain, and the United Kingdom. We also  interviewed political and commercial officers at embassies in five of these  countries. While the results of our site visits are not generalizable, they  provided perspectives on VWP and ESTA implementation. We met with  travel industry officials, including airline representatives, and foreign  government officials in the six countries we visited to discuss ESTA  implementation. We selected the countries we visited so that we could  interview officials from VWP countries in diverse geographic regions that  varied in terms of information-sharing signature status, number of  travelers to the United States, and the existence in-country of potential  program security risks. We met with officials from the Department of  Homeland Security (DHS) in Washington, D.C. We used data provided by  DHS from the ESTA database to assess the usage of the program and  airline compliance with the ESTA requirements and determined that the  data was sufficiently reliable for our purposes.
To evaluate the status of information sharing, we analyzed data regarding  which countries had signed the agreements and interviewed DHS,  Department of State (State), and Department of Justice (Justice) officials  in Washington, D.C., and International Criminal Police Organization  (Interpol) officials in Lyon, France. We reviewed the Implementing  Recommendations of the 9/11 Commission Act of 2007, which contained  the information-sharing requirement. We received and reviewed copies of  many Preventing and Combating Serious Crime and Lost and Stolen  Passport agreements. While conducting our fieldwork, we confirmed the  status of the agreements in each of the countries we visited. We  determined that the data on the status of information sharing were  sufficiently reliable for our purposes. However, we were unable to view  the signed Homeland Security Presidential Directive 6 agreements,  because Justice’s Terrorist Screening Center declined to provide us  requested access to the agreements. We also met with foreign government  officials from agencies involved with VWP information-sharing agreement  negotiations in the six countries we visited to discuss their views  regarding VWP information-sharing negotiations with U.S. officials. In  addition, with Interpol officials in France, we discussed the status of the  sharing of information on lost and stolen passports. Interpol officials were  unable to provide country-specific statistics regarding sharing of lost and  stolen passport information due to its data privacy policy.
To assess DHS efforts to complete timely biennial reviews of each VWP  country, we reviewed DHS documents, as well as the links to completed  reviews on the DHS intranet Web site to determine whether the reviews  were completed in a timely manner. We also reviewed a 2006 GAO report  that recommended improvements to the timeliness of DHS’s biennial  reporting process.
We conducted this performance audit from January 2010 to May 2011, in  accordance with generally accepted government auditing standards. Those  standards require that we plan and perform the audit to obtain sufficient,  appropriate evidence to provide a reasonable basis for our findings and  conclusions based on our audit objectives. We believe that the evidence  obtained provides a reasonable basis for our findings and conclusions  based on our audit objectives.
section_title: Appendix II: How to Apply for ESTA Approval
paragraphs: The official ESTA application can be completed online at  https://esta.cbp.dhs.gov/esta/. (See fig 5.) DHS officials told us they  actively publicize the official Web site, because many unofficial Web sites  exist that charge an additional fee to fill out an application for an  individual. They said the unofficial Web sites are not fraudulent if they do  not use the official DHS or ESTA logos and provide the service they  promise.
section_title: Appendix III: Comments from the Department of Homeland Security
section_title: Appendix IV: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the individual named above, Anthony Moran, Assistant  Director; Jeffrey Baldwin-Bott; Mattias Fenton; Reid Lowe; and John F.  Miller made key contributions to this report. Martin DeAlteriis, Joyce  Evans, Etana Finkler, Richard Hung, Mary Moutsos, Jena Sinkfield, and  Cynthia S. Taylor also provided technical assistance.