Border Security: US-VISIT Program Faces Strategic, Operational, and Technological Challenges at Land Ports of Entry
Published: 2006-12-06T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Department of Homeland Security (DHS) established the U.S. Visitor and Immigrant Status Indicator Technology (US-VISIT) program to collect, maintain, and share data on selected foreign nationals entering and exiting the United States at air, sea and land ports of entry (POEs). These data, including biometric identifiers like digital fingerprints, are to be used to screen persons against watch lists, verify visitors' identities, and record arrival and departure. GAO was asked to review implementation at land POE facilities and in doing so GAO analyzed: (1) efforts to implement US-VISIT entry capability; (2) efforts to implement US-VISIT exit capability; and (3) DHS's efforts to define how US-VISIT fits with other emerging border security initiatives. GAO reviewed DHS and US-VISIT program documents, interviewed program officials, and visited 21 land POEs with varied traffic levels on both borders.
section_title: What GAO Found
paragraphs: US-VISIT entry capability has been installed at 154 of the 170 land POEs. Officials at all 21 sites GAO visited reported that US-VISIT had improved their ability to process visitors and verify identities. DHS plans to further enhance US-VISIT's capabilities by, among other things, requiring new technology and equipment for scanning all 10 fingerprints. While this may aid border security, installation could increase processing times and adversely affect operations at land POEs where space constraints, traffic congestion, and processing delays already exist. GAO's work indicated that management controls in place to identify such problems and evaluate operations were insufficient and inconsistently administered. For example, GAO identified computer processing problems at 12 sites visited; at 9 of these, the problems were not always reported. US-VISIT has developed performance measures, but measures to gauge factors that uniquely affect land POE operations were not developed; these would put US-VISIT officials in a better position to identify areas for improvement. US-VISIT officials concluded that, for various reasons, a biometric US-VISIT exit capability cannot now be implemented without incurring a major impact on land POE facilities. An interim nonbiometric exit technology being tested does not meet the statutory requirement for a biometric exit capability and cannot ensure that visitors who enter the country are those who leave. DHS has not yet reported to Congress on a required plan describing how it intends to fully implement a biometric entry/exit program, or use nonbiometric solutions. Until this plan is finalized, neither DHS nor Congress is in a good position to prioritize and allocate program resources or plan for POE facilities modifications. DHS has not yet articulated how US-VISIT is to align with other emerging land border security initiatives and mandates, and thus cannot ensure that the program will meet strategic program goals and operate cost effectively at land POEs. Knowing how US-VISIT is to work with these initiatives, such as one requiring U.S. citizens, Canadians, and others to present passports or other documents at the border in 2009, is important for understanding the broader strategic context for US-VISIT and identifying resources, tools, and potential facility modifications needed to ensure success.

section_title: Letter
paragraphs: This report is a publicly available version of our report on the  implementation of the U.S. Visitor and Immigrant Status Indicator  Technology (US-VISIT) program at land ports of entry (POE).  Our  original report was designated For Official Use Only because, according to  the Department of Homeland Security (DHS), it contained specific  information of a sensitive nature.
In the years since the 2001 terrorist attacks, the need to secure U.S.  borders has taken on added importance and has received increasing  attention from Congress and the public. In an effort to avoid repetition of  such attacks, and improve overall national security, Congress and the  Administration have sought better ways to record and track the entry and  departure of foreign visitors who pass through U.S. POEs by air, land, or  sea, to verify their identities, and to authenticate their travel  documentation. In March 2003, responsibility for these efforts was  transferred from the former Immigration and Naturalization Service to  DHS. Pursuant to several statutory mandates, DHS, in consultation with  the Department of State, established an automated visitor system to  integrate information on the entry and exit from the United States of  foreign nationals, called the US-VISIT Program.
According to DHS, the purpose of US-VISIT is to enhance the security of  U.S. citizens and visitors, facilitate legitimate travel and trade, ensure the  integrity of the U.S. immigration system, and protect visitors’ privacy. The  program is managed by the US-VISIT Program Office, which is headed by  the US-VISIT Director, who currently reports to the DHS Deputy Secretary.  US-VISIT is used in the field by officers with U.S. Customs and Border  Protection (CBP), a separate DHS component. US-VISIT processing is one  of many activities that takes place at POEs, where CBP officers enforce  U.S. immigration laws governing the admissibility of the millions of aliens  entering and U.S. citizens reentering the country daily; screen cargo for  weapons or illegal or dangerous goods; prevent narcotics, agricultural  pests, and smuggled goods from entering the country; and identify and  arrest those with outstanding criminal warrants.
US-VISIT is designed to use biographic information (e.g., name,  nationality, and date of birth) and biometric information (e.g., digital  fingerprint scans and photographs) to verify the identity of those covered  by the program. The program applies to certain visitors whether they hold  a nonimmigrant visa or are traveling from a country that has a visa waiver  agreement with the United States under the Visa Waiver Program. U.S.  citizens, lawful permanent residents, and most Canadian and Mexican  citizens are currently exempt from being processed under US-VISIT upon  entering and exiting the country. Foreign nationals subject to US-VISIT  who intend to enter the country encounter different inspection processes  at different types of POEs depending on their mode of travel. Foreign  nationals subject to US-VISIT who intend to enter the United States at an  air or sea POE are to be processed, for purposes of US-VISIT, in the  primary inspection area upon arrival. Generally, these visitors are subject  to prescreening before they arrive via passenger manifests, which are  forwarded to CBP by commercial air or sea carrier in advance of arrival.  By contrast, foreign nationals intending to enter the United States at land  POEs are generally not subject to prescreening because they arrive in  private vehicles or on foot and there is no manifest to record their pending  arrival. Thus, when foreign nationals subject to US-VISIT arrive at a land  POE, they are directed by CBP officers from the primary inspection area  to the secondary inspection area for further processing. At all POEs,  visitors covered by US-VISIT who are determined to be admissible are  issued an I-94 arrival/departure form, which, among other things, records  their date of arrival and the date their authorized period of admission  expires. The requirement that arriving nonimmigrants admitted to the  United States, unless otherwise exempted, be issued an I-94 as evidence of  the terms of their admission predates implementation of US-VISIT and was  incorporated into US-VISIT processing.
Many aspects of US-VISIT program implementation have been driven or  defined by various legislative mandates. These include a 2001 statutory  requirement to focus particularly on the use of biometric technology in  developing the integrated entry-exit system subsequently named US-VISIT;  a 2002 statutory requirement to develop biometric identifier standards to  be used to verify the identity of persons seeking to enter the United States  at POEs; and a requirement to install at all POEs equipment and software  to allow biometric comparison and authentication of U.S. visas and other  travel and entry documents issued to aliens, as well as Visa Waiver  Program participant passports. In addition, by law, an integrated entry and  exit data system was to be implemented at all U.S. POEs, including land  POEs, by December 31, 2005, but there was no specific requirement to  collect any new data on foreign nationals departing at land POEs by that  date. The Intelligence Reform and Terrorism Prevention Act of 2004, on  the other hand, did require the collection of biometric exit data for all  individuals subject to US-VISIT, but it did not set a deadline for  implementation of this requirement.
The United States shares over 7,500 miles of land border with Canada and  Mexico and currently, CBP operates 170 land POEs on the northern border  with Canada and the southwest border with Mexico. These POEs are  diverse in nature, with some operating in urban areas, such as Detroit,  Michigan, and others operating in remote areas, such as the northern  plains in Montana or along the southwest border. Taken together, land  POEs process the largest number of visitors to the United States each year  among all POEs (about 79 percent of about 425 million total border  crossings during fiscal year 2004) and process fewer US-VISIT eligible  visitors as compared to other POEs (about 11 percent of about 42 million  border crossings processed via US-VISIT during fiscal year 2004).
As US-VISIT was being installed at land POEs, questions arose about the  impact the program was having on the existing POE facilities where  legitimate land-border crossings take place, particularly in light of a goal,  stated by a former DHS Undersecretary, to develop a “smart border—one  that speeds through legitimate trade and travel, but stops terrorists in their  tracks.” We were asked to review implementation of US-VISIT at land POE  facilities. Specifically, we analyzed the following issues: (1) What has the  US-VISIT Program Office done to implement US-VISIT entry capabilities at  land POEs and what impact has US-VISIT had on these facilities? (2) What  is the status of US-VISIT Program Office efforts to implement a US-VISIT  exit capability at land POE facilities? (3) What has DHS done to define a  strategic context to show how US-VISIT entry and exit capabilities at land  POE facilities fit with other current and emerging border security  initiatives?
To meet our objectives, we met with officials at CBP and the US-VISIT  Program Office within DHS in Washington, D.C. We reviewed applicable  laws and regulations and studies on the US-VISIT program and examined  available DHS documents on US-VISIT entry and exit capability and  deployment at land POEs. We also visited 21 selected land POEs on the  northern and southern borders where US-VISIT entry capability had been  installed. Along the northern border, we visited land POEs at the Windsor  Tunnel and Ambassador Bridge in Detroit, Michigan; the Thousand Islands  Bridge at Alexandria Bay, Champlain, Overton Corners, and Rouses Point  in northern New York State; Highgate Springs and Alburg Springs in  northern Vermont; and Blaine-Pacific Highway and Blaine-Peace Arch in  Blaine, Washington. Along the southern border, we visited the DeConcini,  Morley Gate, and Mariposa POEs in Nogales, Arizona; the POE in San  Ysidro in California; and POEs in Brownsville-Matamoros Bridge,  Brownsville-Gateway, and Brownsville-Los Tomates/Veterans  International Bridge, Hidalgo, Progreso, Pharr, and Los Ebanos in Texas.  We selected these locations to ensure coverage on both borders and to  obtain a mix of sites with varied types of environments and levels of traffic  volume. Where feasible, we also chose to visit some geographically  proximate POEs to minimize travel costs. In addition, five of these POEs  (Thousand Islands Bridge, Blaine-Peace Arch, Blaine-Pacific Highway,  DeConcini, and Mariposa) had been designated by DHS as locations to test  exit technology. At all the locations we visited, we observed how US-VISIT  equipment was installed and operated and interviewed CBP officials about  US-VISIT installation and operations following deployment. We also  observed the impacts of US-VISIT equipment and operations on POE  facilities and infrastructures. In addition, we examined whether internal  control mechanisms were in place and being used to ensure that program  objectives were being achieved, consistent with GAO’s Standards for  Internal Controls in the Federal Government. The information from our  site visits is limited to the 21 land ports we visited and is not generalizable  to all land ports of entry. Appendix I discusses our scope and methodology  in greater detail.
We conducted our work from September 2005 through October 2006 in  accordance with generally accepted government auditing standards.
subsections: section_title: Background
paragraphs: US-VISIT is a large, complex governmentwide program intended to  achieve the goals of (1) enhancing the security of U.S. citizens and visitors,  (2) facilitating legitimate travel and trade, (3) ensuring the integrity of the  U.S. immigration system, and (4) protecting the privacy of visitors. The  program is intended to carry out these goals by    collecting, maintaining, and sharing information on certain foreign  nationals who enter and exit the United States;  identifying foreign nationals who (1) have overstayed or violated the  terms of their visit; (2) can receive, extend, or adjust their immigration  status; or (3) should be apprehended or detained by law enforcement  officials;    detecting fraudulent travel documents, verifying visitor identity, and  determining visitor admissibility through the use of biometrics (digital  fingerprints and a digital photograph); and  facilitating information sharing and coordination within the  immigration and border management community.
Currently, US-VISIT’s scope includes the pre-entry, entry, status, and exit  of hundreds of millions of foreign national travelers who enter and leave  the United States at over 300 air, sea, and land POEs.
subsections: section_title: Legislative Overview
paragraphs: The current statutory framework for US-VISIT originates with a  requirement to implement an integrated entry and exit data system for  foreign nationals, enacted in the Immigration and Naturalization Service  Data Management Improvement Act (DMIA) of 2000. The DMIA replaced  in its entirety a provision of the Illegal Immigration Reform and Immigrant  Responsibility Act of 1996 (IIRIRA) that had required an automated system  to record and then match the departure of every foreign national from the  United States to the individual’s arrival record. The DMIA instead  required an electronic system that would provide access to and integrate  foreign national arrival and departure data that are authorized or required  to be created or collected under law and are in an electronic format in  certain databases, such as those used at POEs and consular offices. Unlike  the earlier law, the DMIA specifically provided that it not be interpreted to  impose any new documentary or data collection requirements on any  person, but it also provided that it not be construed to reduce or curtail  the authority of DHS or State under any other provision of law. Thus, the  DMIA did not specifically require the collection of any new data on foreign  nationals departing at land POEs.
The system as described in the DMIA is to compare available arrival  records to available departure records; allow on-line search procedures to  identify foreign nationals who may have overstayed their authorized  period of admission; and use available data to produce a report of arriving  and departing foreign nationals. The DMIA also required the  implementation of the system at airports and seaports by December 31,  2003, at the 50 highest volume land POEs by December 31, 2004; and at all  remaining POEs by December 31, 2005.
Laws passed after the DMIA also provided specific requirements with  regard to the use of biometrics for those entering and leaving the country.  For example, the USA PATRIOT Act required, by October 26, 2003, the  development and certification of a technology standard, including  appropriate biometric identifier standards, that can be used to verify the  identity of persons applying for a U.S. visa, or seeking to enter the United  States pursuant to a visa, for the purposes of conducting background  checks, confirming identity, and ensuring that a person has not received a  visa under a different name. The act also provided that in developing US- VISIT, DHS and State were to focus particularly on the utilization of  biometric technology and the development of tamper-resistant documents  readable at POEs. The Enhanced Border Security and Visa Entry Reform  Act of 2002 required DHS and State to implement, fund, and use the  technology standard, including biometric identifier standards, developed  under the USA PATRIOT Act at U.S. POEs; it also required the installation  at all POEs of equipment and software to allow biometric comparison and  authentication of all U.S. visas and other travel and entry documents  issued to aliens, and passports issued by Visa Waiver Program  participating countries with biometric identifiers. The Intelligence Reform  and Terrorism Prevention Act of 2004, unlike the DMIA, specifically  required the collection of biometric exit data for all categories of  individuals required to provide biometric entry data under US-VISIT,  regardless of the port of entry where they entered the United States. The  2004 law did not set a deadline for implementation of this requirement,  however. Appendix III discusses the legislative history of the US-VISIT  program in greater detail.
section_title: Management and Implementation of US- VISIT
paragraphs: Within DHS, the US-VISIT Program Office is headed by the US-VISIT  Director, who reports directly to the Deputy Secretary for Homeland  Security. The US-VISIT Program Office has responsibility for managing the  acquisition, deployment, operation, and sustainment of US-VISIT and has  been delivering US-VISIT capability incrementally. According to US-VISIT,  increments 1 and 2 include a mix of interim or temporary solutions and  permanent deployments. For example, increment 1B, dealing with exit  capability at airports, is still being piloted, while US-VISIT entry capability  at the 50 busiest land POEs—increment 2B—is considered to be a  permanent deployment. Increment 3—providing entry capability at the  land POEs not covered under Increment 2B—is considered by US-VISIT to  be a permanent deployment and increment 4 is, according to US-VISIT, the  yet-to-be defined US-VISIT strategic capability. Table 1 summarizes the  scope, timeline, and intended functionality of the US-VISIT increment  schedule. This report focuses generally, but not exclusively, on increments  2B (entry capability at the 50 busiest land POEs), 2C (exit capability at the  50 busiest land POEs), and 3 (entry capability at the remaining land  POEs)—the increments and information that are shown in bold in table 1.
From fiscal year 2003 through fiscal year 2007, total funding for the US- VISIT program has been about $1.7 billion. Table 2 summarizes  appropriations for US-VISIT for fiscal years 2003 through 2007, as enacted.
In prior reports on US-VISIT, we have identified numerous challenges that  DHS faces in delivering program capabilities and benefits on time and  within budget. In September 2003, we reported that the US-VISIT program  is a risky endeavor, both because of the type of program it is (large,  complex, and potentially costly) and because of the way that it was being  managed. We reported, for example, that the program’s acquisition  management process had not been established, and that US-VISIT lacked a  governance structure. In March 2004, we testified that DHS faces a major  challenge maintaining border security while still welcoming visitors.  Preventing the entry of persons who pose a threat to the United States  cannot be guaranteed, and the missed entry of just one can have severe  consequences. Also, US-VISIT is to achieve the important law enforcement  goal of identifying those who overstay or otherwise violate the terms of  their visas. Complicating the achievement of these security and law  enforcement goals are other key US-VISIT goals: facilitating trade and  travel through POEs and providing for enforcement of U.S. privacy laws  and regulations. Subsequently, in May 2004, we reported that DHS had  not employed the kind of rigorous and disciplined management controls  typically associated with successful programs. Moreover, in February  2006, we reported that while DHS had taken steps to implement most of  the recommendations from our 2003 and 2004 reports, progress in critical  areas had been slow. Of 18 recommendations we made since 2003, only 2  had been fully implemented, 11 had been partially implemented, and 5  were in the process of being implemented, although the extent to which  they would be fully carried out was not yet known.
section_title: US-VISIT Scope, Operations, and Processing at Land POEs
paragraphs: As mentioned earlier, US-VISIT currently applies to a certain group of  foreign nationals—non-immigrants from countries whose residents are  required to obtain nonimmigrant visas before entering the United States  and residents of certain countries who are exempt from U.S. visa  requirements when they apply for admission to the United States for up to  90 days for tourism or business purposes under the Visa Waiver Program.  US-VISIT also applies to (1) Mexican nonimmigrants traveling with a  Border Crossing Card (BCC) who wish to remain in the United States  longer than 30 days or who declare that they intend to travel more than 25  miles into the country from the border (or more than 75 miles from the  Arizona border in the Tucson area) and (2) Canadians traveling to the  United States for certain specialized reasons.
Most land border crossers—including U.S. citizens, lawful permanent  residents, and most Canadian and Mexican citizens—are, by regulation or  statute, not required to enroll into US-VISIT. In fiscal year 2004, for  example, U.S. citizens and lawful permanent residents comprised about 57  percent of land border crossers; Canadian and Mexican citizens comprised   about 41 percent; and less than 2 percent were US-VISIT enrollees.   Figure 1 shows the number and percent of persons processed under US- VISIT as a percentage of all border crossings at land, air, and sea POEs in  fiscal year 2004.
Foreign nationals covered by US-VISIT enter the United States via a multi- step process. For individuals required to obtain visas before entering the  United States, the US-VISIT process begins overseas at U.S. consular  offices, which in addition to other processes, collect biographic data   (i.e., country of origin and date of birth) and biometric data (i.e., digital  fingerscans and a digital photograph) from the applicant. These data are  checked against databases or watch lists of known criminals and  suspected terrorists. If the individual’s name does not appear on any watch  list and the individual is not disqualified on the basis of other issues that  may be relevant, he or she is to be issued a visa and may seek admission to  the United States at a POE.
When visitors in vehicles first arrive at a land POE, they initially enter the  primary inspection area where CBP officers, often located in booths, are  to visually inspect travel documents and query the visitors about such  matters as their place of birth and proposed destination. Visitors arriving  as pedestrians enter an equivalent primary inspection area, generally  inside a CBP building. If the CBP officer believes a more detailed  inspection is needed or if the visitors are required to be processed under  US-VISIT for the first time, the visitors are to be referred to the secondary  inspection area—an area away from the primary inspection area—which is  generally inside a facility. The secondary inspection area inside the facility  generally contains office space, waiting areas, and space to process  visitors, including US-VISIT enrollees. Equipment used for US-VISIT  processing includes a computer, printer, digital camera, and a two- fingerprint scanner. Figure 2 shows US-VISIT equipment installed at one  land POE.
CBP officers use a document reader to scan machine readable travel  documents, such as a passport or visa, and use computers to check  biographic data from the documents against watch list databases. For US- VISIT processing, biometric verification is performed in part by taking a  digital scan of visitors’ fingerprints (the left and right index fingers) and by  taking a digital photograph of the visitor. These data are stored in the  system’s databases. The computer system compares the two index  fingerprints to those stored in DHS’s Automated Biometric Identification  System (IDENT) that, among other things, collects and stores biometric  data about foreign nationals, including FBI information on all known and  suspected terrorists.
If the fingerprints are already in IDENT, the system performs a match  against the existing digital scans to confirm that the person submitting the  fingerprints at secondary inspection at the POE is the one on file. In  addition, the CBP officer visually compares the person to the photograph  that is in the database, which is brought up onto the computer screen. If  no prints are found in IDENT (for example, if the visitor is from a visa- waiver country), that person is then processed into US-VISIT, with  biographic data entered into the databases, a digital scan of his or her two  index fingerprints, and a digital photograph. Once the CBP officer deems  the visitor to be admissible, the individual is issued an I-94 or an I-94W (for  persons from visa waiver countries) arrival/departure form. Figure 3  shows how U.S. citizens and most Mexicans, Canadians, and foreign  nationals subject to US-VISIT are to be processed at land POEs.
In addition to IDENT, US-VISIT relies on a number of information systems  to process visitors. Among the computer software applications utilized as  part of US-VISIT is U.S. Arrival, which provides an integrated process for  issuing I-94 forms and collection of biometric data for visitors covered by  US-VISIT who arrive at land POEs. Another is U.S. Pedestrian, which is  used by CBP officers in conducting inspections of visitors who arrive at  land POEs, entering the United States on foot, mostly along the southern  border.
section_title: Overview of Land POE Facilities
paragraphs: As of August 2006, there were 170 land POEs that are geographically  dispersed along the nation’s more than 7,500 miles of borders with Canada  and Mexico. Some are located in rural areas (such as Alexandria Bay, New  York and Blaine-Pacific Highway, Washington) and others in cities (such  as Detroit) or in U.S. cities across from Mexican cities, such as Laredo and  El Paso, Texas. The volume of visitor traffic at these POEs varies widely,  with the busiest four POEs characterized by CBP as San Ysidro, Calexico,  and Otay Mesa, California, and Bridge of the Americas in El Paso, Texas.  Appendix IV lists the 20 busiest land POEs, based on the number of  individuals in vehicles and pedestrian traffic recorded entering the country  through POEs in fiscal year 2005.
From a facilities standpoint, land POEs vary substantially in building type  and size (square footage) as shown in Figures 4a, 4b, and 4c.
section_title: DHS Has Installed US- VISIT Biometric Entry Capability at Nearly All Land POEs, but Faces Challenges Identifying and Monitoring the Operational Impacts on POE Facilities
paragraphs: DHS has installed US-VISIT biometric entry capability at nearly all land  POEs consistent with statutory deadlines, but faces challenges identifying  and monitoring the operational impacts on POE facilities. CBP officials at  the 21 land POEs we visited told us that US-VISIT has generally enhanced  the officials’ ability to process visitors subject to US-VISIT by providing  officials the ability to do biometric checks and automating the issuance of  the visitor I-94 arrival/departure form. DHS plans to introduce changes and  enhancements to US-VISIT at land POEs intended to bolster border  security, but deploying them poses potential operational challenges to  land POE facilities that are known by DHS to be space-constrained. US- VISIT’s efforts to evaluate the impact of US-VISIT on land POE facilities  thus far raises questions about whether sufficient management controls  exist to ensure that additional operational impacts, such as processing  delays or further space constraints, will be anticipated, identified, and  appropriately addressed and resolved.
subsections: section_title: US-VISIT Biometric Entry Capability Was Installed at Nearly All Land POEs with Minimal Construction, According to Program Officials
paragraphs: In December 2005, DHS officials announced that US-VISIT biometric entry  capability had been installed at land POEs in conformance with statutory  mandates and Increments 2B and 3 of DHS’s US-VISIT schedule.  Deployment at the 50 busiest land POEs was completed by December 31,  2004, and at all but 2 of the other land POEs where DHS determined the  program should operate by December 31, 2005, as required by law. Our  review of US-VISIT records and discussions with US-VISIT program  officials indicated that DHS installed US-VISIT biometric entry capability  at 154 of 170 land POEs. (App. V lists all land POEs where US-VISIT has  been installed.) With regard to 14 of the 16 POEs where US-VISIT was not  installed, CBP and US-VISIT program office officials told us there was no  operational need for US-VISIT because visitors who are required to be  processed into US-VISIT are, by regulation, not authorized to enter the  United States at these locations. Generally, these POEs are small facilities  in remote areas. At 2 other POEs, US-VISIT needs to be installed in order  to achieve full implementation as required by law, but both of these  present significant challenges to installation of US-VISIT. These POEs do  not currently have access to appropriate communication transmission  lines to operate US-VISIT. CBP officials told us that, given this constraint,  they determined that they could continue to operate as before.  Thus, CBP  officers at these locations process foreign visitors manually.
US-VISIT program officials reported and available records showed that  equipment for US-VISIT entry capability was installed with minimal  construction at the 154 land POEs. At the 21 land POEs we visited, we  observed that US-VISIT entry capability equipment had been installed with  little or no change to facilities. For example, at the Detroit-Windsor tunnel  and the Detroit Ambassador Bridge POEs in Detroit, Michigan, officials  confirmed that no additional computer workstations were required to be  installed; at the Blaine-Peace Arch POE at Blaine, Washington, electrical  capacity was upgraded to accommodate US-VISIT computer needs. In  general, our review of reports prepared for each of these POEs indicated  that DHS upgraded existing or added new computer workstations and  printers in the secondary inspections areas of these facilities (the area  where US-VISIT enrollees are processed); installed digital cameras to  photograph those to be processed in US-VISIT; installed two-fingerprint  scanners that digitally record fingerprints; and installed electronic card  readers for detecting data embedded in machine-readable passports and  visas. According to US-VISIT officials, funding for installing US-VISIT entry  equipment nationwide was approximately $16 million—about 9 percent of  the $182 million budgeted for US-VISIT deployment at land ports between  fiscal year 2003 and fiscal year 2005. Officials reported that the remaining  funds were allocated to computer network infrastructure (about 72  percent) and design and development, network engineering, fingerscan  devices, and public awareness and outreach (about 19 percent).
During our site visits, CBP officials at all 21 facilities told us that having  US-VISIT biometric entry capability generally improved their ability to  process visitors required to enroll in US-VISIT because it provided them  additional assurance that visitors are who they say they are and automated  the paperwork associated with processing the I-94 arrival/departure form.  For example, with US-VISIT, the ability to scan a visitor’s passport or other  travel document enables the computer at the inspection site to capture  basic biographic information and automatically print it on the I-94 form;  prior to US-VISIT deployment, the I-94 was filled in manually by the CBP  officer or the visitor.
section_title: Steps Have Been Taken to Address Operational Challenges Identified at Land POEs, but DHS May Face Additional Challenges Resulting from Planned Enhancements
paragraphs: DHS plans to introduce changes and enhancements to US-VISIT at land  POEs that are designed to further bolster CBP’s ability to verify that  individuals attempting to enter the country are who they say they are.  While these changes may further aid border security, deploying them  poses potential challenges to land POE facilities where US-VISIT operates  and where millions of visitors are processed annually. Our site visits,  interviews with US-VISIT and CBP officials, and the work of others  suggest that both before and after US-VISIT entry capability was installed  at land POEs, these facilities faced a number of challenges—operational  and physical—including space constraints complicated by the logistics of  processing high volumes of visitors and associated traffic congestion.
With respect to operational challenges at land POE facilities, we reported  in November 2002—more than 2 years before US-VISIT entry capability  was installed at the 50 busiest land POEs—that busy land POEs were  experiencing 2- to 3-hour delays in processing visitors and that any  lengthening of the entry process could affect visitors significantly, through  additional wait times. While we cannot generalize about the impact US- VISIT has had on processing time at all land POEs, at one of the busiest  land POEs we visited—San Ysidro, California, where more than 41 million  visitors entering the country in 2005 were processed—CBP officials told us  that, although they had not measured differences in processing times  before and after US-VISIT was installed, the steps required to process US- VISIT visitors had added to the total time needed to process all visitors  entering through the port. As a result, CBP officials told us that they must  occasionally direct visitors arriving at peak times, such as holidays, to  leave and return later in the day because there was no room for them to  wait. In this case, US-VISIT had an effect on both visitor processing times  and on the capacity of the facility to physically accommodate pedestrian  and vehicular traffic.
A similar type of operational problem that reflects how complex visitor  processing activities occur at facilities was reported by a contractor  retained by DHS to study wait times associated with the I-94 issuance  process at another busy POE, Nogales-DeConcini in Arizona. The study,  which examined wait times for 3 separate time periods over a 3-month  period in the summer of 2005, found that wait times varied by day (ranging  from about 3½ minutes to almost 7 minutes across the time periods  studied) and was more a function of the number of people waiting for an I- 94 rather than the time needed to process each individual under US- VISIT. The contractor noted that the group size, wait time, and processing  all affected the dynamics of the secondary-processing area or room, which  measured approximately 40 feet by 50 feet. During one day of the study,  the contractor noted that the secondary processing room became  crowded, straining processing capacity.  The contractor stated that this  occurred because some of the individuals waiting to obtain I-94s were  students or seasonal workers that required checks that included phone  calls to verify their visa status. The contractor concluded that US-VISIT  provided an advantage over manual I-94 processing because the  processing was ultimately more efficient. Nevertheless, the extent to  which these problems occur is unknown because US-VISIT has not  performed comparable studies at other locations.
DHS has long been aware of space constraints and other capacity issues at  land POE facilities. A task force report developed in response to the  Immigration and Naturalization Service Data Management Improvement  Act of 2000 found that 117 of 166 land POEs operating at that time (about  70 percent) had three-fourths or less of the required space. The US-VISIT  Program Office subsequently confirmed that land POEs had traffic flow  problems (i.e., lack of space, insufficient roadways, and poor access to  facilities) and that many were aging and undersized; the majority of land  POEs were constructed before 1970 when the volume of border crossings  was not as great as it is now. Our work for this report indicates that such  problems persist, though we cannot generalize to all facilities. For  example, at the Nogales-Morley Gate POE in Arizona, where up to 6,000  visitors are processed daily (and up to 10,000 on holidays), US-VISIT  equipment was installed, but the system is not used there because CBP  determined that it could not accommodate US-VISIT visitors because of  concerns about CBP’s ability to carry out the process in a constrained  space while thousands of other people not subject to US-VISIT processing  already transit through the facility daily. Thus, if a visitor is to be  processed into US-VISIT from Morley Gate, that person is directed to  return to Mexico (a few feet away) and to walk the approximately 100  yards to the Nogales-DeConcini POE facility, which has the capability to  handle secondary inspections of this kind. Figure 5 shows the Nogales- Morley Gate POE building—the small windowed structure on the right is  the processing site.
CBP officials at three other land POEs on the southwest border also told  us that space constraints were a factor in their ability to efficiently process  those subject to US-VISIT. Specifically, at the POEs at Los Tomates,  Gateway, and Brownsville/Matamoros, Texas, CBP officials told us that  US-VISIT had made I-94 processing more efficient, but travelers continued  to experience delays of up to 2 hours on peak holiday weekends as they  had before US-VISIT was installed. Officials at these facilities told us that  they believe they could alleviate this problem if the facility had the space  to install more workstations capable of operating US-VISIT entry  capability.
According to CBP officials, CBP has begun to examine the condition of  each facility with the intent of developing a list of border station  construction and modification needs and plans to prioritize construction  projects based on need. In the meantime, CBP and US-VISIT officials told  us that they have taken steps to address problems operating US-VISIT  when space constraints are an issue. For example, at the POE in Highgate  Springs, Vermont, CBP officials told us that US-VISIT computers and those  needed to process commercial truck drivers and their cargoes were  competing for space at the interior counter area of the building. Following  our visit, we were told that the POE had adjusted its space allocation  inside the POE building so that there are now five workstations for US- VISIT and other noncommercial visitor processing, one of which can do  both. According to the POE assistant area port director, the POE also  extended the hours during which truck drivers can be processed in a  separate building designed entirely for processing them and their cargoes,  in order to relieve the space pressures in the main building that occur  during the high-volume tourist summer season.
US-VISIT and CBP officials reported that they have taken other steps to try  to minimize any problems that may arise integrating US-VISIT entry  capability operations with other CBP operations. For example, to help  ensure that US-VISIT does not have an adverse impact on CBP’s  operations at ports of entry, US-VISIT and CBP established a liaison office  in June 2005, involving supervisory managers detailed from various CBP  offices. The liaison officers worked with US-VISIT staff to overcome  operational issues at POEs; review plans; develop and deliver training; set  up call sites during busy holiday periods to provide support to POEs  needing assistance; and work through technology problems. A CBP official  told us that he believes both US-VISIT and CBP have been successful in  helping land POEs overcome problems as they arise (such as those that  might occur operating new technology at space constrained facilities). The  CBP officers detailed to the liaison office have since returned to their  original duty stations. According to CBP officials, CBP has an open  invitation to re-initiate the liaison office at any time.
While past challenges with facilities are well known to US-VISIT and CBP  officials and efforts have been made to address them, it is not clear  whether US-VISIT or CBP is prepared to anticipate additional facilities  challenges—challenges already acknowledged by senior US-VISIT  officials—that may arise as new US-VISIT capabilities are added. The  following two key initiatives, in particular, could affect operations at land  POEs:    10-fingerprint scanning of US-VISIT enrollees. DHS plans to  require that individuals subject to US-VISIT undergo a 10-fingerprint  scan, in place of the current 2, to ensure the highest levels of accuracy  in identifying people entering and exiting the country. Under this plan,  US-VISIT visitors would be required to have all fingerprints scanned the  first time they enroll in US-VISIT and to submit a 2-fingerprint scan  during subsequent visits. A cost/benefit analysis of this capability is  under way by DHS, selected components, and other agencies, with an  anticipated transition period (from the 2- to 10-fingerprint scan  requirement) taking place later this year and next. In January 2006, the  former Director of US-VISIT testified before the Senate Appropriations  Subcommittee on Homeland Security that in order to introduce a 10- fingerprint scan capability at land POEs and other locations, DHS  would need a 6-to-8-month period to develop the capability and  additional time to introduce initial operating capability. The former  Director testified that unresolved technical challenges create the  potential for a significant increase in the length of time needed to  process individuals subject to US-VISIT at POEs once the 10-fingerprint  requirement is in place. In commenting on this report, DHS noted that  US-VISIT has been working with industry to speed up processing time  and reduce the size of 10-print capture devices to “eliminate or  significantly reduce the impact of deploying 10-print scanning.”  As  noted earlier, our past work has shown that any lengthening in the  process of entering the United States at the busiest POEs could  inconvenience travelers and result in fewer visits to the United States  or lost business to the nation.
Electronic passport readers for Visa Waiver Program travelers.  All Visa Waiver Program travelers with passports issued after October  26, 2005 must have passports that contain a digital photograph printed  in the document; passports issued to visa waiver travelers after  October 26, 2006 must have integrated circuit chips, known as  electronic passports, which are also called “e-passports.” (The Visa  Waiver Program allows travelers from certain countries to gain entry to  the United States without a visa.) These e-passports are to contain  biographic and biometric information that can be read by an e-passport  reader or scanner, a device which electronically reads or scans the  information embedded in the e-passport at close proximity, about 4  inches to the reader. According to DHS, all POEs must have the ability  to compare and authenticate e-passports as well as visas and other  travel and entry documents issued to foreign nationals by DHS and the  Department of State. Earlier this year, DHS announced it had  successfully tested e-passports and e-passport scanners. A US-VISIT  Program Office official told us that deployment of these scanners is  moving toward implementation at POEs located at 34 selected  international airports where about 97 percent of the Visa Waiver  Program travelers enter the country. The official said that e-passport  readers will not initially be installed at land POEs—which process a  small percentage of visa waiver travelers—and there is no timeline for  deploying the scanners at land POEs, although there are plans to do so  at some point. CBP’s Director of Automated Programs in the Office of  Field Operations told us that e-passport readers and the database used  to process e-passport information do not operate as fast as current  processes at land POEs and thus could cause additional delays,  especially at POEs experiencing processing backlogs and wait times,  such as San Ysidro, California, and Nogales-Mariposa, Arizona.
Given the potential impact that enhancements to US-VISIT could have  both on visitor processing overall and on land POE facilities, it is  important for US-VISIT and CBP to be able to gauge how new changes  associated with US-VISIT may affect operations. However, our past work  showed that US-VISIT had not taken all needed steps to help ensure that  US-VISIT entry capability operates as intended because the approaches  used to gauge or anticipate the impact of US-VISIT operations on land  POE facilities was limited. Specifically, in 2005, in an effort to evaluate the  impact of US-VISIT on the busiest land POEs, DHS completed evaluations  of the time needed to process and issue the I-94 arrival/departure form at 5  POEs. To conduct its study, DHS studied the I-94 process before and after  US-VISIT was installed at five land POEs at three locations (Port Huron,  Michigan; Douglas, Arizona; and Laredo, Texas). Based on data collected  from these 5 POEs, US-VISIT officials concluded that no additional staff or  facility modifications were needed at other POEs in order to accommodate  US-VISIT. We reported in February 2006 that the scope of this evaluation  was too limited to determine potential operational impacts on POEs.  We  reported three limitations, in particular: (1) that the evaluations did not  take into account the impact of US-VISIT on workforce requirements or  facility needs because the evaluations focused solely on I-94 processing  time; (2) that the locations selected were chosen in part because they  already had sufficient staff to support a US-VISIT pilot-test; and (3) that  US-VISIT officials did not base their evaluation of I-94 processing times on  a constant basis before and after deployment of US-VISIT—that is, pre- deployment sites used fewer computer workstations to process travelers  than did sites studied after deployment. We recommended that DHS  explore alternative means to obtaining a full understanding of the impact  of US-VISIT on land POEs, including its impact on workforce levels and  facilities and that POE sites be surveyed that had not been included in  their original assessment. US-VISIT responded that wait times at land  POEs were already known and that it would conduct operational  assessments at POEs as new projects came online. However, apart from a  study conducted at one POE facility by a DHS contractor in August 2005  (cited above), US-VISIT has not provided documentation on any additional  evaluations conducted that would provide additional insights about the  effect of US-VISIT on land POE operations, including wait times.
We recognize that it may not be cost-effective for US-VISIT or CBP to  conduct a formal assessment of the impact US-VISIT has on each land  POE now that the entry capability has been installed or of all facilities  once new enhancements are introduced. Nevertheless, the assessment  methodology US-VISIT has used in the past—which focused on measuring  changes in I-94 processing times—raises questions about how the agency  will assess the impact that the transition from 2- to 10-fingerprint scanning  may have on land POE operations. That is, if US-VISIT uses the same  methodology and focuses on the changes in processing time, rather than  on the overall impact on operations, including facilities, staffing, and  support logistics, the results will have the same limitations we highlighted  in our earlier study. Our February 2006 recommendation would also be  applicable to enhancements that have the potential to negatively affect  operations.
section_title: Management Controls Did Not Always Alert US-VISIT and CBP to Operational Problems
paragraphs: US-VISIT and CBP have management controls in place to alert them to  operational problems as they occur, but these controls did not always  work to ensure that US-VISIT operates as intended. Specifically, US-VISIT  and CBP officials had not been made aware of computer processing  problems that affected operations, in particular, until we brought them to  their attention, partly because these problems were not always reported.  These computer processing problems have the potential to not only  inconvenience travelers because of the increased time needed to complete  the inspection process, but to compromise security, particularly if CBP  officers are unable to perform biometric checks—one of the critical  reasons US-VISIT was installed at POEs.
Our standards for internal control in the federal government state that it is  important for agencies to provide reasonable assurance that they can  achieve effective and efficient operations. This includes establishing and  maintaining a control environment that sets a positive and supportive  attitude toward control activities that are designed to help ensure that  management’s directives are carried out. Control activities include  reviewing and monitoring agency operations at the functional level (i.e., at  land POEs) to compare operational performance with planned or expected  results and to ensure that controls described in policies and procedures  are actually applied and applied properly, and having relevant, reliable,  and timely communications to ensure that information flows down,  across, and up the organization thereby helping program managers carry  out their responsibilities and providing assurance that timely action is  taken on implementation problems or information that requires follow-up.
Our site visit interviews suggest that current monitoring and control  activities were not sufficient to ensure that US-VISIT performs in  accordance with its security mission and objectives. For example, at 12 of  the 21 land POEs we visited, computer-processing problems arose that,  according to CBP officials at those locations, had an impact on processing  times and traveler delays. Generally, officials at these 12 sites said that  computer problems occurred with varying frequency and duration; some  said that computers were at times slow or froze up during certain times of  the day, while others said that problems were sporadic and they could not  ascribe them to a particular time of the day. None of the officials we  interviewed had formally assessed the impact of computer slowdowns or  freezes on visitors and visitor wait times, but nonetheless cited computer  problems as a cause of visitor delays. In November 2005, we notified a US- VISIT program official in headquarters that we had heard about computer  processing problems at some of the POEs we had visited. The official told  us that US-VISIT had not been aware of these problems and said that, as a  result of our work, CBP had been contacted to investigate the problem. In  June 2006, a CBP official responsible for information technology at CBP’s  data center told us that POEs had experienced slowdowns associated with  certain US-VISIT data queries. The CBP official told us that since the  computer processing problems were identified and resolved, performance  had greatly improved. We did not verify whether the actions taken fully  resolved these problems. “…on the morning of Thursday, June 23, the computer systems used to perform  secondary inspections became very slow, impacting the issuance of I-94 and  enrollment in US-VISIT. The staff had to revert to using the paper I-94s, which  visitors had to fill out by hand...”  “As happened during the  study, the computer systems were unavailable for  a period of time. This occurred on Tuesday from 1:00 to 2:00 p.m. Port officials  decided to revert to the manual process because the network had become very  slow and the queue was growing. CBP officers told … researchers that it was  taking up to twenty minutes to receive responses to queries....”
In an undated memorandum commenting on the contractor’s report, US- VISIT’s Director of Mission Operations expressed concern about the  contractor’s discussion of computer “downtime” as a factor impacting US- VISIT processing times. He stated that these problems can be caused by a  variety of factors, including factors related to I-94 processing and that  capturing biometric information “is only rarely responsible for the inability  to complete the process.” Based on our work, it is unclear what analysis  US-VISIT had done to make this determination.
US-VISIT officials told us that various controls are in place to alert them to  problems as they occur, but the lack of awareness about computer- processing problems raises questions about whether these controls are  working as intended. US-VISIT officials told us that it is their position that  once US-VISIT entry capability equipment was installed and operating,  CBP became responsible for identifying problems and notifying US-VISIT  when US-VISIT-related problems occurred so that US-VISIT can work with  CBP to resolve them. The officials stated that computer problems can be  attributable to other processes and systems not related to US-VISIT which  are not the US-VISIT Program Office’s responsibility. In addition, the  Acting Director of US-VISIT noted that there are mechanisms in place to  help CBP and US-VISIT identify problems. For example, US-VISIT officials  told us that US-VISIT and CBP headquarters officials meet regularly to  discuss issues associated with US-VISIT implementation and CBP  maintains a help desk at its Virginia data center to resolve technology  problems raised by CBP field officials. Regarding the latter, the Acting  Director noted that if POE officials do not report problems, there is  nothing CBP and US-VISIT can do to resolve them. During our review, we  noted that CBP officers are required—in training and as part of standard  operating procedures—to report problems with US-VISIT technology to  the CBP help desk. Nevertheless, CBP officials at 9 of the 12 sites we  visited where computer processing problems were identified said they did  not always use the help desk to report or resolve computer problems (and  thereby generating a record of the problems). Officials at 5 of the 9 sites  told us they temporarily resolved the problem by turning off and restarting  the computers.
Although US-VISIT and CBP have some controls in place to help them  identify and address problems like those discussed above, these controls  may not have been implemented consistently or may not be sufficient to  ensure that US-VISIT operates as intended because officials did not always  alert CBP and US-VISIT program managers to the fact that problems were  occurring that adversely affected operations. It is important that US-VISIT  and CBP managers are alerted to problems as they occur to ensure  continuity of operations consistent with US-VISIT’s goal of providing  security to U.S. citizens and travelers. Moreover, in light of the fact that  US-VISIT plans to enhance security through additional technology  investments and that it may be challenging to deploy and operate at  facilities that are already known to be aging and undersized, it is  incumbent upon the US-VISIT program office to play a continuing and  proactive role in the management control structure.
Our internal control standards also call for agencies to establish  performance measures and indicators throughout the organization so that  actual performance can be compared to expected results. The US-VISIT  program office has established and implemented performance measures  for fiscal years 2005 and 2006 that are designed to gauge performance of  various aspects of US-VISIT covering a variety of areas, but these  measures do not gauge the performance of US-VISIT entry capabilities at  land POEs. For example, according to a July 2006 draft report prepared by  the US-VISIT program office, US-VISIT has begun to measure the ratio of  adverse actions (defined as decisions to deny entry into the country) to  total-biometric-watch-list “hits” when visitors are processed at ports of  entry. According to US-VISIT, this measure seeks to help CBP focus its  inspection activities on preventing potential known or suspected criminals  or terrorists from entering the country. US-VISIT reported that it had not  established a baseline or target for this measure in fiscal year 2005.  However, according to US-VISIT, CBP officers at all POEs combined  denied entrance to 30 percent of persons whose biometric information  appeared on a watch list during fiscal year 2005 (about 617 of the 2,059  watch list “hits”). US-VISIT established a target for this measure during  fiscal year 2006 of 33 percent.
Another measure is designed to gauge the wait time incurred by a specific  US-VISIT activity at all air, land, and sea POEs, namely the average  response time to deliver results on biometric watch list queries for finger  scans. (This measure does not gauge other US-VISIT related activities such  as scanning the visa or passport, taking and processing a digital  photograph, or printing an I-94.) To ensure that wait times are not  increased substantially due to additional US-VISIT capabilities at POEs,  US-VISIT has established a goal of 10 seconds and reported that, since  October 2004, US-VISIT has been able to maintain, on average, less than an  8-second response time at POEs at which US-VISIT had been installed.
These and other existing measures of certain key aspects of program  performance with respect to both security and efficiency can be useful in  analyzing trends and measuring results against planned or expected  results. However, because there are operational and facility differences  among air, sea, and land POEs, it is important to be able to measure and  distinguish differences—one would not expect baseline or target measures  to be the same across these environments. At air and sea ports, visitors are  processed in primary inspection in a controlled environment and CBP  officers are able to prescreen visitors using passenger manifests, which  are transmitted to CBP while passengers are enroute to the POE. By  contrast, at land POEs, visitors arrive on foot or in a vehicle and CBP  officers refer them to secondary inspection for US-VISIT processing  without the benefit of a manifest and based on the information available to  officers at the point of initial contact—a process substantially different  than that used at air and sea ports. The measures used in August 2006  aggregated baselines and targets for all POEs and did not distinguish  among them with regard to air, land, and sea POEs.
Without additional performance measures to more fully gauge operational  impacts of US-VISIT on land POEs, CBP and US-VISIT may not be well  equipped to identify problems, trends, and areas needing improvements  now and as additional US-VISIT entry capabilities, such as 10-finger scans,  are introduced. Consistent with our past work, we believe such measures  could help DHS identify and quantify problems, evaluate alternatives,  allocate resources, track progress, and learn from any mistakes that may  have been made while deploying and operating US-VISIT at land POEs.
section_title: DHS Cannot Currently Implement a Biometric US-VISIT Exit Capability at Land POEs and Faces Uncertainties as Testing of an Alternative Exit Strategy Continues
paragraphs: While federal laws require the creation of a US-VISIT exit capability using  biometric verification,  the US-VISIT Program Office concluded that  implementing a biometrically-based exit-recording system like that used to  record visitors entering the country would require additional staff and new  infrastructure (such as buildings and roadways) that would be  prohibitively costly, would likely produce major traffic congestion in exit  lanes at the busier land POEs and could have adverse impacts on trade  and commerce. Although current technology does not exist to enable  biometric verification of those leaving the country without major  infrastructural changes, US-VISIT officials believe technological advances  over the next 5- to 10- years will enable them to record who is leaving the  country using biometrics without requiring travelers to stop at a facility,  thereby minimizing the need for major infrastructure changes.  In the  interim, US-VISIT is testing an alternative nonbiometric technology for  recording visitors as they exit the country, in which electronic tags  containing a numeric identifier associated with each visitor are embedded  in I-94 forms. US-VISIT’s own analysis of this technology and our analysis  and that of others has identified numerous performance and reliability  problems with this solution, including the inability of the nonbiometric  solution to ensure that the person exiting the country is the same who  entered. US-VISIT has taken corrective actions and testing is still ongoing,  but uncertainties remain about how US-VISIT will use technology in the  future to meet biometric exit requirements. These uncertainties reflect the  fact that DHS has not met a June 2005 statutory requirement to submit a  report to the Congress that describes (1) the status of biometric exit data  systems already in use at POEs and (2) the manner in which US-VISIT is to  meet the goal of a comprehensive screening system, with both entry and  exit biometric capability.
subsections: section_title: Various Factors Have Prevented US-VISIT from Implementing a Biometric Exit Capability
paragraphs: Federal laws require the creation of a US-VISIT exit capability using  biometric verification methods to ensure that the identity of visitors  leaving the country can be matched biometrically against their entry  records. However, according to officials at the US-VISIT program office  and CBP and US-VISIT program documentation, there are interrelated  logistical, technological, and infrastructure constraints that have  precluded DHS from achieving this mandate, and there are cost factors  related to the feasibility of implementation of such a solution. The major  constraint to performing biometric verification upon exit at this time, in  the US-VISIT Program Office’s view, is that the only proven technology  available would necessitate mirroring the processes currently in use for  US-VISIT at entry. A mirror-image system for exit would, like entry, require  CBP officers at land POEs to examine the travel documents of those  leaving the country, take fingerprints, compare visitors’ facial features to  photographs, and, if questions about identity arise, direct the departing  visitor to secondary inspection for additional questioning. These steps  would be carried out for exiting pedestrians as well as for persons exiting  in vehicles. The US-VISIT Program Office concluded in an internal January  2005 report assessing alternatives to biometric exit that the mirror-imaging  solution was “an infeasible alternative for numerous reasons, including but  not limited to, the additional staffing demands, new infrastructure  requirements, and potential trade and commerce impacts.”
US-VISIT officials told us that they anticipated that a biometric exit  process mirroring that used for entry could result in delays at land POEs  with heavy daily volumes of visitors. And they stated that in order to  implement a mirror-image biometric exit capability, additional lanes for  exiting vehicles and additional inspection booths and staff would be  needed, though they have not determined precisely how many. According  to these officials, it is unclear how new traffic lanes and new facilities  could be built at land POEs where space constraints already exist, such as  those in congested urban areas. (For example, San Ysidro, California,  currently has 24 entry lanes, each with its own staffed booth and 6  unstaffed exit lanes. Thus, if full biometric exit capability were  implemented using a mirror image approach, San Ysidro’s current capacity  of 6 exit lanes would have to be expanded to 24 exit lanes.) As shown in  figure 6, based on observations during our site visit to the San Ysidro POE,  the facility is surrounded by dense urban infrastructure, leaving little, if  any, room to expand in place. Some of the 24 entry lanes for vehicle traffic  heading northwards from Mexico into the United States appear in the  bottom left portion of the photograph, where vehicles are shown waiting  to approach primary inspection at the facility; the six exit lanes (traffic  towards Mexico), which do not have fixed inspection facilities, are at the  upper left.
Other POE facilities are similarly space-constrained. At the POEs at  Nogales-DeConcini, Arizona, for example, we observed that the facility is  bordered by railroad tracks, a parking lot, and industrial or commercial  buildings. In addition, CBP has identified space constraints at some rural  POEs. For example, the Thousand Islands Bridge POE at Alexandria Bay,  New York, is situated in what POE officials described as a “geological  bowl,” with tall rock outcroppings potentially hindering the ability to  expand facilities at the current location. Officials told us that in order to  accommodate existing and anticipated traffic volume upon entry, they are  in the early stages of planning to build an entirely new POE on a hill about  a half-mile south of the present facility. CBP officials at the Blaine-Peace  Arch POE in Washington state said that CBP also is considering whether  to relocate and expand the POE facility, within the next 5-to-10 years, to  better handle existing and projected traffic volume. According to the US- VISIT program officials, none of the plans for any expanded, renovated, or  relocated POE include a mirror-image addition of exit lanes or facilities  comparable to those existing for entry.
In 2003, the US-VISIT Program Office estimated that it would cost  approximately $3 billion to implement US-VISIT entry and exit capability  at land POEs where US-VISIT was likely to be installed and that such an  effort would have a major impact on facility infrastructure at land POEs.  We did not assess the reliability of the 2003 estimate. The cost estimate did  not separately break out costs for entry and exit construction, but did  factor in the cost for building additional exit vehicle lanes and booths as  well as buildings and other infrastructure that would be required to  accommodate a mirror imaging at exit of the capabilities required for entry  processing. US-VISIT program officials told us that they provided this  estimate to congressional staff during a briefing, but that the reaction to  this projected cost was negative and that they therefore did not move  ahead with this option. No subsequent cost estimate updates have been  prepared, and DHS’s annual budget requests have not included funds to  build the infrastructure that would be associated with the required  facilities.
US-VISIT officials stated that they believe that technological advances  over the next 5-to-10 years will make it possible to utilize alternative  technologies that provide biometric verification of persons exiting the  country without major changes to facility infrastructure and without  requiring those exiting to stop and/or exit their vehicles, thereby  precluding traffic backup, congestion, and resulting delays. US-VISIT’s  report assessing biometric alternatives noted that although limitations in  technology currently preclude the use of biometric identification because  visitors would have to be stopped, the use of the as-yet undeveloped  biometric verification technology supports the long-term vision of the US- VISIT program. However, no such technology or device currently exists  that would not have a major impact on facilities. The prospects for its  development, manufacture, deployment and reliable utilization are  currently uncertain or unknown, although a prototype device that would  permit a fingerprint to be read remotely without requiring the visitor to  come to a full stop is under development.
While logistical, technical, and cost constraints may prevent  implementation of a biometrically based exit technology for US-VISIT at  this time, it is important to note that there currently is not a legislatively  mandated date for implementation of such a solution. The Intelligence  Reform and Terrorism Prevention Act of 2004 requires US-VISIT to collect  biometric-exit-data from all individuals who are required to provide  biometric entry data. The act did not set a deadline, however, for  requiring collection of biometric exit data from all individuals who are  required to provide biometric entry data. Although US-VISIT had set  a  December 2007 deadline for implementing exit capability at the 50 busiest  land POEs, US-VISIT has since determined that implementing exit  capability by this date is no longer feasible, and a new date for doing so  has not been set.
section_title: The US-VISIT Program Office Is Testing Nonbiometric Technology to Record Travelers’ Departure
paragraphs: US-VISIT evaluated 12 different exit-recording technologies against the six criteria listed  above, including some that incorporated biometric features—scanning the retina or iris,  and a facial recognition system. Because the biometric solutions considered would have  required an exiting visitor to slow down, stop, or possibly enter a POE facility, they were  rejected. Other alternatives, such as the use of a global positioning system, were rejected  because they transmit signals that could facilitate surveillance of individuals, raising  concerns about privacy. no additional traffic congestion); (5) be convenient to the visitor, and (6)  be commercially available.  None of these criteria directly addressed or  reflected the legislative mandate to deploy a system to record entry and  exit by foreign travelers using biometric identifiers in order to ensure that  persons leaving the country were those who had entered. Rather, the  criteria focused on choosing a technology that would not require a major  investment in facilities, would protect privacy, and would not generate  large traffic backups that would inconvenience or delay both travelers and  commercial carriers.
Among the technologies considered for testing by the US-VISIT Program  Office, the only one that met all the US-VISIT evaluation criteria was  passive, automated, radio frequency identification (RFID). This  technology, according to US-VISIT, “best satisfied all the assessment  criteria.” RFID is an automated data-capture technology that can be used  to electronically store information contained on a very small tag that can  be embedded in a document (or some other physical item). This  information can then be identified, and recorded as having been identified,  by RFID readers that are connected to computer databases.
For purposes of US-VISIT’s testing of the nonbiometric technology, the  RFID tag is embedded in a modified I-94 arrival/departure form, called an  I-94A. Each RFID tag has only a single number stored in it; privacy is  protected because no information is stored on these tags other than a  unique ID number that is linked to the visitor’s biographic information.  To  facilitate the transmission of the number from the RFID tag, a new DHS  system of records—the Automated Identification Management System  (AIDMS) —was created to link the unique RFID tag ID number to existing  information stored in the Treasury Enforcement Communications System  (TECS) database, which is used by CBP to verify travel information and  update traveler data. According to US-VISIT, limiting the data on the tag  to a single number helps preserve the privacy of travelers; acquisition of  the number would provide no meaningful information to non-authorized  persons, since they would then have to access TECS to link the number to  biographic data. However, access to computers and their databases at land  POEs is restricted to authorized personnel and involves additional  protections such as passwords as well as entrance into physically  restricted areas inside POE buildings. (A more detailed discussion of RFID  technology and privacy issues is contained in appendix VI.)
The RFID technology used in this way is considered passive because the  tag cannot initiate communications. Rather, the tag responds to radio  frequency emissions from an RFID reader—an electronic device that can  be installed on a pole, or on a steel gantry of the kind that holds highway  signs over the entire width of a roadway (see figure 11)—and transmits the  numeric information stored on the tag back to the reader, from up to 30  feet away, according to the US-VISIT Program Office. Figure 7a shows  RFID readers mounted on a metal gantry at the Thousand Islands Bridge  land POE, Alexandria Bay, New York. The readers are attached to metal  extensions that project out from the right side of the gantry, to record an I- 94A embedded with tags that are inside the vehicles that pass underneath.  RFID readers can also be installed in portals or on poles at pedestrian  traffic areas to read the I-94A embedded with tags of persons leaving the  country on foot. Figure 7b shows RFID readers in portals positioned on  either side of pedestrian exit doors at the Blaine-Peace Arch POE in  Washington State.
section_title: Initial Results of Testing Using RFID Technology Indicate Problems Meeting a Key Program Goal— Verifying the Identity of Persons Leaving the Country
paragraphs: In December 2004 and January 2005, a team of US-VISIT contractors  conducted the first part of a feasibility study to test passive RFID  equipment in a simulated environment-at a mock POE in Virginia. At this  site, different types of vehicles– including cars, buses, and trucks—were  run at different speeds to test RFID read rates. Pedestrians carrying  documents with RFID tags embedded or attached were not tested. The  feasibility study raised numerous issues about the reliability and  performance of the RFID technology. For example, RFID readers held on a  gantry over a roadway had difficulty detecting RFID-detectable tags that  were inside vehicles with metallic tinted windows (whether the windows  were open or closed). The read rate was improved from about 56 percent  to about 70 percent if the readers were moved to both sides of the road,  rather than overhead, and if the occupants held their documents with the  RFID-detectable tags up to the vehicle’s side windows. The study  concluded that the physical actions of the visitor had to be taken into  account when obtaining a read of the I-94A and made specific  recommendations to improve read rates, such as suggesting that vehicle  occupants hold the I-94A up to a side window and keep multiple forms  apart.
After the feasibility study, US-VISIT proceeded, as planned, with phase 1 of  proof-of-concept testing for RFID at five land POEs at the northern and  southern borders to determine what corrective actions, if any, should be  taken to improve RFID read rates for exiting vehicles and pedestrians.  This effort comprised testing for both exit and for re-entry by persons who  have been issued a tag-embedded I-94A that is valid for multiple entries  over several months.  The RFID performance tests were conducted for  one-week periods at land POEs, as follows: vehicular traffic was tested at  Nogales-Mariposa and Nogales-DeConcini POEs in Nogales, Arizona; the  Blaine-Pacific Highway and Blaine-Peace Arch POEs in Blaine,  Washington; and Thousand Islands Bridge POE in Alexandria Bay, New  York; pedestrian traffic was tested at the Nogales-Mariposa and Nogales- DeConcini POEs.
For these exit tests, the US-VISIT Program Office developed critical  success factor target read rates to compare them to the actual read rates  obtained during the test for both pedestrians carrying an I-94A with RFID- detectable tags and for travelers in vehicles who also had an RFID- detectable I-94A with them inside the vehicles. The target exit read rates  ranged from an expected success rate of 70 percent to 95 percent, based  on anticipated performance under different conditions, partly as  demonstrated in the earlier feasibility study, on business requirements,  and on a concept of operation plan prepared for Increment 2C.
In a January 2006 assessment of the test results, the US-VISIT Program  Office reported that the exit read rates that occurred during the test  generally fell short of the expected target rates for both pedestrians and  for travelers in vehicles. For example, according to US-VISIT, at the  Blaine-Pacific Highway test site, of 166 vehicles tested, RFID readers  correctly identified 14 percent; the target read rate was 70 percent.  Another problem that arose was that of cross-reads, in which multiple  RFID readers installed on gantries or poles picked up information from the  same visitor, regardless of whether the individual was entering or exiting  in a vehicle or on foot. Thus, cross-reads resulted in inaccurate record- keeping. According to a January 2006 US-VISIT corrective-action report,  signal-filtering equipment is to be installed to correct the problem and  additional testing is to be conducted to confirm and understand the extent  of the problem. The report also noted that remedying cross-reads would  require changes to equipment and infrastructure on a case-by-case basis at  each land POE, because each has a different physical configuration of  buildings, roadways, roofs, gantries, poles, and other surfaces against  which the signals can bounce and cause cross-reads. Each would therefore  require a different physical solution to avoid the signal interference that  triggers cross-reads. Although cost estimates or time lines have not been  developed for such alterations to facilities and equipment, it is possible  that having to alter the physical configuration at each land POE in some  regard and then test each separately to ensure that cross-reads had been  eliminated would be both time consuming and potentially costly, in terms  of changes to infrastructure and equipment.
We observed potential problems with the RFID exit system relating to  facilities and infrastructure at some of the POEs we visited. At the  Nogales-Mariposa POE, in Nogales, Arizona, for example, we observed  that RFID portals for pedestrians had been placed on the right side of the  CBP POE building, on a rocky, sloping hillside, and that there was no  signage directing pedestrians to walk between them, nor was a walkway  installed, as shown in figure 8a. Although travelers were expected to walk  between the portals, this configuration enabled pedestrians to avoid the  portals altogether—to walk around them or cross the road to avoid them,  as shown in figure 8b.
According to the US-VISIT corrective actions report, 15 percent of exiting  pedestrian (including those participating in the test and those who did not)  used the pathway between the two portals at the Nogales facility during a  September 2005 observation period. In this same report, US-VISIT  acknowledged that there was no defined pathway or infrastructure for  pedestrian exit at Nogales-Mariposa, Arizona, and that only one of the  three pedestrian paths were covered by the portals that had been placed  there. US-VISIT reported that while the placement of the portal readers  will not be changed, it is taking steps to improve the likelihood of  detection with additional antennae, readers, and signage. However, there  are no plans at present to modify the existing POE infrastructure on the  west side of the building where the portals were installed, such as by  installing a paved walkway or by constructing fencing to divert those  exiting to go through the readers in order to increase the chances that  exiting pedestrians are detected.  In commenting on this report, DHS  stated that it had constructed a new primary pedestrian exit walkway  parallel to the existing pedestrian entry and had installed signage,  sidewalks, and a new secure gate.  However, according to a CBP official at  the Nogales-Mariposa POE, the newly constructed pedestrian exit  walkway is on the other (east) side of the building from the pathway  where the portal readers were placed and tested.
During the period that US-VISIT carried out RFID exit tests at land POEs,  US-VISIT also tested read rates for RFID-detectable documents carried by  pedestrians or persons in vehicles who had been issued an I-94A during a  prior visit to the United States, had subsequently left the country, and were  intending to re-enter. (I-94s can be issued that are valid for up to 6  months for multiple re-entries into the country.) US-VISIT performed the  re-entry test for documents held by persons in vehicles at the Mariposa  and DeConcini POEs in Nogales, Arizona; the Blaine-Pacific Highway and  Blaine-Peace Arch, POEs in Washington state; and Thousand Islands  Bridge POE at Alexandria Bay, New York. For pedestrians, the re-entry  test was performed at the Mariposa and DeConcini POEs in Nogales,  Arizona (see tables 6a and 6b, appendix VII). US-VISIT set higher expected  target read rates for the re-entry test than for exit because all persons and  vehicles entering or re-entering the country must stop for questioning by  CBP officers and must take travel documents out of their pockets or from  inside a vehicle, and show them to the officer, enhancing the likelihood  that RFID-detectable documents would be detected. As expected by US- VISIT, read rates for the re-entry test for vehicles were generally higher  than for exit, although the results did not meet the critical success factors  initially projected by US-VISIT. Appendix VII discusses the results of RFID  performance for exit and re-entry in greater detail.
Beyond RFID operations issues that affect facilities, our work and that of  the DHS Privacy Office have identified other performance and reliability  problems related to passive RFID. In June 2005, we testified before the  Subcommittee on Economic Security, Infrastructure Protection, and  Cybersecurity of the House Committee on Homeland Security on similar  reliability problems with RFID. We noted, for example, that when an  object close to the reader or tag interferes with the radio waves, read-rate  accuracy decreases, and that environmental conditions, such as  temperature and humidity, can make tags unreadable. We further noted  that tags read at high speeds have a significant decrease in read rates.
According to US-VISIT officials, phase 2 of the RFID proof-of-concept  testing, which is to expand the capabilities identified at the five phase 1  locations will, among other things, link visitor data to vehicle exit data (or  re-entry, if the visitor already has an RFID- embedded I-94 form), address  deficiencies noted in phase 1, and further evaluate RFID performance. At  the time of our review, many uncertainties about the future of a US-VISIT  exit capability remained because US-VISIT had not developed a plan to  show when phase 2 of proof-of-concept testing of RFID would conclude,  when an evaluation of the technology would be completed, and how US- VISIT would define success.
However, even if RFID deficiencies were to be fully addressed and  deadlines set, questions remain about DHS’s intentions going forward. For  example, the RFID solution does not meet the congressional requirement  for a biometric exit capability because the technology that has been tested  cannot meet a key goal of US-VISIT—ensuring that visitors who enter the  country are the same ones who leave. By design, an RFID tag embedded in  an I-94 arrival/departure form cannot provide the biometric identity- matching capability that is envisioned as part of a comprehensive  entry/exit border security system using biometric identifiers for tracking  overstays and others entering, exiting, and re-entering the country.  Specifically, the RFID tag in the I-94 form cannot be physically tied to an  individual. This situation means that while a document may be detected as  leaving the country, the person to whom it was issued at time of entry may  be somewhere else.
DHS was to have reported to Congress by June 2005 on how the agency  intended to fully implement a biometric entry/exit program. As of October  2006, this plan was still under review in the Office of the Secretary,  according to US-VISIT officials. According to statute, this plan is to  include, among other things, a description of the manner in which the US- VISIT program meets the goals of a comprehensive entry and exit  screening system—including both biometric entry and exit—and fulfills  statutory obligations imposed on the program by several laws enacted  between 1996 and 2002. Until such a plan is finalized and issued, DHS is  not able to articulate how entry/exit concepts will fit together—including  any interim nonbiometric solutions—and neither DHS nor Congress is  positioned to prioritize and allocate resources for a US-VISIT exit  capability or plan for the program’s future.
In commenting on this report, DHS acknowledged that the interim non- biometric exit technology using RFID tags embedded in the I-94 does not  meet the statutory requirement for a biometric exit capability.  DHS stated  that it used the non-biometric technology because industry was not to the  point of developing a device that could satisfy US-VISIT requirements,  such as not impacting traffic flows or not having safety impacts.  DHS said  that US-VISIT officials would perform subsequent research and industry  outreach activities in an attempt to satisfy statutory requirements for a  biometric exit capability.
section_title: DHS Has Not Articulated How US- VISIT Strategically Fits with Other Land- Border Security Initiatives
paragraphs: In recent years, DHS has planned or implemented a number of initiatives  aimed at securing the nation’s borders. However, DHS has not defined a  strategic context that shows how US-VISIT fits with other land border  initiatives. As we reported in September 2003, agency programs need to  properly fit within a common strategic context governing key aspects of  program operations—e.g., what functions are to be performed by whom;  when and where they are to be performed; what information is to be used  to perform them; what rules and standards will govern the application of  technology to support them; and what facility or infrastructure changes  will be needed to ensure that they operate in harmony and as intended.  Without a clear strategic context for US-VISIT, the risk is increased that  the program will not operate with related programs and thus not cost- effectively meet mission needs.
In our September 2003 report, we stated that DHS had not defined key  aspects of the larger homeland security environment in which US-VISIT  would need to operate. For example, certain policy and standards  decisions had not been made, such as whether official travel documents  would be required for all persons who enter and exit the country,  including U.S. and Canadian citizens, and how many fingerprints would be  collected—factors that could potentially increase inspection times and  ultimately increase traveler wait times at some of the higher volume land  POE facilities. To minimize the impact of these changes, we recommended  that DHS clarify the context in which US-VISIT is to operate. Three years  later, defining this strategic context remains a work in progress. Thus, the  program’s relationships and dependencies with other closely allied  initiatives and programs are still unclear.
According to the US-VISIT Chief Strategist, the Program Office drafted in  March 2005 a strategic plan that showed how US-VISIT would be  strategically aligned with DHS’s organizational mission and also defined an  overall vision for immigration and border management. According to this  official, the draft plan provided for an immigration and border  management enterprise that unified multiple internal departmental and  other external stakeholders with common objectives, strategies,  processes, and infrastructures. As of October 2006, we were told that DHS  had not approved this strategic plan. This draft plan was not available to  us, and it is unclear how it would provide an overarching vision and road  map of how all these component elements can at this time be addressed  given that critical elements of other emerging border security initiatives  have yet to be finalized. For example, under the Intelligence Reform and  Terrorism Prevention Act of 2004, DHS and State are to develop and  implement a plan, no later than June 2009, which requires U.S. citizens and  foreign nationals of Canada, Bermuda, and Mexico to present a passport  or other document or combination of documents deemed sufficient to  show identity and citizenship to enter the United States (this is currently  not a requirement for these individuals entering the United States via land  POEs from within the western hemisphere). This effort, known as the  Western Hemisphere Travel Initiative (WHTI), was first announced in  2005, and some members of Congress and others have raised questions  about agencies’ progress carrying out WHTI. In May 2006, we issued a  report that provided our observations on efforts to implement WHTI along  the U.S. border with Canada.   We stated that DHS and State had taken  some steps to carry out the Travel Initiative, but they had a long way to go  to implement their proposed plans, and time was slipping by. Among other  things, we found that:    key decisions had yet to be made about what documents other than a  passport would be acceptable when U.S. citizens and citizens of  Canada enter or return to the United States—a decision critical to  making decisions about how DHS is to inspect individuals entering the  country, including what common facilities or infrastructure might be  needed to perform these inspections at land POEs;    a DHS and Department of State proposal to develop an alternative form  of passport, called a PASS card, would rely on RFID technology to help  DHS process U.S. citizens re-entering the country, but DHS had not  made decisions involving a broad set of considerations that include (1)  utilizing security features to protect personal information, (2) ensuring  that proper equipment and facilities are in place to facilitate crossings  at land borders, and (3) enhancing compatibility with other border  crossing technology already in use.
As of September 2006, DHS had still not finalized plans for changing the  inspection process and using technology to process U.S. citizens and  foreign nationals of Canada, Bermuda, and Mexico reentering or entering  the country at land POEs. In the absence of decisions about the strategic  direction of both programs, it is still unclear (1) how the technology used  to facilitate border crossings under the Travel Initiative will be integrated  with US-VISIT technology, if at all, and (2) how land POE facilities would  have to be modified to accommodate both programs to ensure efficient  inspections that do not seriously affect wait times. This raises the  possibility that CBP would be faced with managing differing technology  platforms and border inspection processes at high-volume land POEs  facilities that, according to DHS, already face space constraints and  congestion.
Similarly, it is not clear how US-VISIT is to operate in relation to another  emerging border security effort, the Secure Border Initiative (SBI)—a new  comprehensive DHS initiative, announced last year, to secure the  country’s borders and reduce illegal migration. According to DHS, as of  June 2006, SBI is to focus broadly on two major themes:    border control—gaining full control of the borders to prevent illegal  immigration, as well as security breaches, and  interior enforcement—disrupting and dismantling cross border crime  into the interior of the United States while locating and removing aliens  who are present in the United States in violation of law.
Under SBI and its CBP component, called SBInet, DHS plans to use a  systems approach to integrate personnel, infrastructures, technologies,  and rapid response capability into a comprehensive border protection  system. DHS reports that, among other things, SBInet is to encompass  both the northern and southern land borders, including the Great Lakes,  under a unified border control strategy whereby CBP is to focus on the  interdiction of cross-border violations between the ports and at the official  land POEs and funnel traffic to the land POEs.
DHS has recently awarded a contract to help DHS design, build, and  execute SBInet. Although DHS has published some information on various  aspects of SBI and SBInet, it remains unclear how SBInet will be linked, if  at all, to US-VISIT so that the two systems can share technology,  infrastructure, and data across programs. For example, from a border  control perspective, questions arise on whether CBP needs additional  resources, facilities or facility modifications, and procedural changes at  land POEs if all those who attempt to enter the country on the northern  and southern border are successfully funneled to land POEs.
Also, given the absence of a comprehensive entry and exit system,  questions remain about what meaningful data US-VISIT may be able to  provide other DHS components, such as Immigration and Customs  Enforcement (ICE), to ensure that DHS can, from an interior enforcement  perspective, identify and remove foreign nationals covered by US-VISIT  who may have overstayed their visas. In a May 2004 report, we stated that  although no firm estimates were available, the extent of overstaying is  significant. We stated that most long-term overstays appeared to be  motivated by economic opportunities, but a few had been identified as  terrorists or involved in terrorist-related activities. Notably, some of the  September 11 hijackers had overstayed their visas. We further reported  that US-VISIT held promise for identifying and tracking overstays as long  as it could overcome weaknesses matching visitors’ entry and exit.
section_title: Conclusions
paragraphs: Developing and deploying complex technology that records the entry and  exit of millions of visitors to the United States, verifies their identities to  mitigate the likelihood that terrorists or criminals can enter or exit at will,  and tracks persons who remain in the country longer than authorized is a  worthy goal in our nation’s effort to enhance border security in a post-9/11  era. But doing so also poses significant challenges; foremost among them  is striking a reasonable balance between US-VISIT’s goals of providing  security to U.S. citizens and visitors while facilitating legitimate trade and  travel. DHS has made considerable progress making the entry portion of  the US-VISIT program at land ports of entry (POEs) operational, and  border officials have clearly expressed the benefits that US-VISIT  technology and biometric identification tools have afforded them.  Nevertheless, US-VISIT is one in a series of ambitious border security  initiatives that could take a toll on the current facilities and infrastructure  in place to support the activities at land POEs, which already process a  large majority (more than 75 percent) of all visitors entering the United  States via legal checkpoints. Many land POEs operate out of small, aging  structures that are constrained by space and that were constructed before  technology and associated equipment played a prominent role in  processing activities.
Our current and past work has raised questions on whether DHS has  adequately assessed how US-VISIT has affected operations at land POEs,  given current constraints at facilities that routinely experience high traffic  volumes and which encounter occasional computer-processing problems.  As additional US-VISIT capabilities—such as 10-fingerprint scanning—are  installed at land POEs and as other border security initiatives unfold,  including the Western Hemisphere Travel Initiative, it is particularly  important that DHS be able to anticipate potential problems and develop  solutions to minimize any operational and logistical impacts on aging and  already overcrowded land POE facilities. Our earlier recommendation on  this issue suggested that DHS needed to expand upon prior efforts to  assess the impact of US-VISIT on busy land POEs in order to obtain a  fuller understanding of the system’s impact on these facilities from an  operational and human capital perspective. We believe this remains an  important step to take because it would help DHS establish a baseline or  foundation from which to anticipate potential problems while providing a  framework for developing strategies and action plans to overcome them.
Although US-VISIT has said it would conduct operational assessments at  POEs as new projects came online, the assessment methodology US-VISIT  has used in the past—which focused on measuring changes in I-94  processing times—raised questions about how the agency will perform  future assessments.
In addition, because US-VISIT will likely continue to have an impact on  land POE facilities as it evolves, it is important for US-VISIT and CBP  officials to have sufficient management controls for identifying and  reporting potential computer and other operational problems as they  arise—problems that could affect the ability of US-VIST entry capability to  operate as intended. If additional delays in processing visitors were to  occur, the ability of POE facilities to handle additional vehicular and  pedestrian traffic could be further strained, and incidents requiring  officials to turn visitors away temporarily may increase. Likewise, if  disruptions to US-VISIT computer operations are not consistently and  promptly reported and resolved and if communication between CBP and  US-VISIT officials about computer-related problems and other operational  challenges is not effective, then it is possible that a critical US-VISIT  function—notably, the ability to use biometric information to confirm  visitors’ identities through various databases—could be disrupted, as has  occurred in the past. The need to avoid disruptions to biometric  verification is important given that one of the primary goals of US-VISIT is  to enhance the security of U.S. citizens and visitors, and in light of the  substantial investment DHS has made in US-VISIT technology and  equipment.
US-VISIT has taken appropriate steps to develop performance measures  that focus on various aspects of US-VISIT performance across air, land,  and sea POEs. However, these measures do not go far enough to assess  the affect of US-VISIT on POE operations, particularly land POEs, which  are operationally distinctive from air and sea POEs where US-VISIT entry  has also been installed. Such measures are needed to ensure that officials  can identify and address problems at land-based facilities where  improvements may be needed.
With respect to DHS’s effort to create an exit verification capability,  developing and deploying this capability for US-VISIT at land POEs has  posed a set of challenges that are distinct from those associated with  entry. US-VISIT has not determined whether it can achieve, in a realistic  time frame, or at an acceptable cost, the legislatively mandated capability  to record the exit of travelers at land POEs using biometric technology.  Apart from acquiring new facilities and infrastructure at an estimated cost  of billions of dollars, US-VISIT officials have acknowledged that no  technology now exists to reliably record travelers’ exit from the country,  and to ensure that the person leaving the country is the same person who  entered, without requiring them to stop upon exit—potentially imposing a  substantial burden on travelers and commerce. US-VISIT officials stated  that they believe a biometrically based solution that does not require those  exiting the country to stop for processing, that minimizes the need for  major facility changes, and that can used to definitively match a visitor’s  entry and exit will be available in 5 to 10 years. In the interim, it remains  unclear how officials plan to proceed—whether a nonbiometric alternative  now being tested can provide an acceptable interim solution or whether  the government ought to wait for a viable biometric solution to become  available. According to statute, DHS was required to report more than a  year ago on its plans for developing a comprehensive biometric entry and  exit system, but DHS has yet to finalize this road map for Congress.  Reporting might provide better assurance that US-VISIT can balance its  goals of providing security, serving the immigration system, facilitating  trade and travel, and protecting privacy at land POEs. This plan would also  give DHS the opportunity to discuss the costs, benefits, barriers, and  opportunities associated with various strategies for deploying biometric  and nonbiometric exit capabilities and keep Congress informed of its  progress overall. Until DHS finalizes such a plan, neither Congress nor  DHS are likely to have sufficient information as a basis for decisions about  various factors relevant to the success of US-VISIT, ranging from funding  needed for any land POE facility modifications in support of the  installation of exit technology to the trade-offs associated with ensuring  traveler convenience while providing verification of travelers’ departure  consistent with US-VISIT’s national security and law enforcement goals.
Finally, DHS has not articulated how US-VISIT fits strategically and  operationally with other land-border security initiatives, such as the  Western Hemisphere Travel Initiative and Secure Border Initiative.  Without knowing how US-VISIT is to be integrated within the larger  strategic context governing DHS operations, DHS faces substantial risk  that US-VISIT will not align or operate with other initiatives at land POEs  and thus not cost-effectively meet mission needs. Knowing how US-VISIT  is to work in harmony with these initiatives could help Congress, DHS, and  others better understand what resources, tools, and investments in land  POE facilities and infrastructure are needed to ensure their success, while  providing critical information to help make decisions about other DHS  missions. This could include, for example, information on what funds and  staffing resources ICE would need to enforce immigration laws if US-VISIT  were able to provide reliable and timely information on potentially  millions of persons who have overstayed the terms of their visas, some of  whom may pose a threat to the nation’s security.
section_title: Recommendations for Executive Action
paragraphs: To help DHS achieve benefits commensurate with its investment in US- VISIT at land POEs and security goals and objectives, we are  recommending that the Secretary of Homeland Security direct the US- VISIT Program Director, in collaboration with the Commissioner of CBP,  to take the following two actions:  improve existing management controls for identifying and reporting  computer processing and other operational problems as they arise at  land POEs and ensure that these controls are consistently  administered; and    develop performance measures for assessing the impact of US-VISIT  operations specifically at land POEs.
We also recommend that as DHS finalizes the statutorily mandated report  describing a comprehensive biometric entry and exit system for US-VISIT,  the Secretary of Homeland Security take steps to ensure that the report  include, among other things,  information on the costs, benefits, and feasibility of deploying  biometric and nonbiometric exit capabilities at land POEs;    a discussion of how DHS intends to move from a nonbiometric exit  capability, such as the technology currently being tested, to a reliable  biometric exit capability that meets statutory requirements; and    a description of how DHS expects to align emerging land border  security initiatives with US-VISIT and what facility or facility  modifications would be needed at land POEs to ensure that technology  and processes work in harmony.
section_title: Agency Comments and Our Evaluation
paragraphs: We requested comments on a draft of this report from the Secretary of  Homeland Security.  In an October 31, 2006, letter, DHS provided written  comments, which are summarized below and included in their entirety in  appendix VIII.
DHS generally agreed with our recommendations and stated that it needed  to improve existing management controls associated with US-VISIT,  develop performance measures to assess the impact of US-VISIT  operations at land POEs, and ensure that the statutorily mandated report  describes how DHS will move to a biometric entry and exit capability and  align US-VISIT with emerging land border initiatives.  DHS did not provide  timelines for when it plans to take these steps, including finalizing the  statutorily mandated report, which was to have been issued to the  Congress in June 2005.
DHS disagreed with certain aspects of or sought clarification on some of  our findings.  DHS disagreed with our finding that the US-VISIT program  office did not fully consider the impact of US-VISIT on the overall  operations at POEs.  It said that US-VISIT impacts are limited to changes  in Form I-94 processing time, which it says are positive, as supported by  US-VISIT evaluations.  According to DHS other factors related to capacity,  staffing, and the volume of travelers are “arguably” beyond the scope of  US-VISIT.
We agree that the approach taken to do operational assessments of the  impact of US-VISIT land POE facilities focused on changes to I-94  processing time and that a variety of factors and processes can affect  traveler inspections and associated wait times at land POEs.  However, as  discussed in this and our February 2006 report, the assessment  methodology US-VISIT has used thus far had limitations--including  focusing solely on I-94 processing time.  Unanticipated problems at  facilities that routinely experience high traffic volumes and occasionally  encounter computer processing shortfalls raise questions about whether  DHS has adequately assessed how US-VISIT has affected operations at  land POEs.  Although it may not be cost-effective for US-VISIT or CBP to  conduct a formal assessment of the impact of US-VISIT at each land POE,  it is important that DHS be positioned to anticipate potential problems and  develop solutions to minimize any operational and logistical impacts on  aging and already overcrowded land POE facilities.  This is especially true  given that DHS recognizes that the transition from 2- to 10-print digital  scanning has a high likelihood of impacting port facilities.
Regarding the latter, we have amended our report to clarify, consistent  with DHS’s comments, that US-VISIT is currently working with industry to  speed up processing time and reduce the size of the 10-print capture  devices to “eliminate or significantly reduce the impact of deploying 10- print scanning.”  DHS efforts to work with industry highlights the need to  more fully assess how US-VISIT affects land POEs so that potential  problems can be identified and addressed before the readers, or any other  new programs, are introduced at land POEs.  As noted in our report, based  on our past work, any lengthening in the process of entering the United  States at the busiest land POEs could inconvenience travelers and result in  fewer visits to the United States or lost business to the nation.
DHS also suggested that we clarify its acknowledgement that the non- biometric technology tested did not meet the statutory requirement for  biometric exit capability.  DHS stated that the non-biometric technology  was used because industry has yet to develop a biometric exit device that  could satisfy mission requirements such as not impacting traffic flow and  not having safety impacts.  We have amended our report to clarify that  DHS acknowledged that the non-biometric technology would not satisfy  statutory requirements and to reflect that it would perform research and  industry outreach to satisfy the mandate. Nonetheless, the fact that the  non-biometric exit technology used does not satisfy the congressionally  mandated biometric exit capability underscores the importance of our  recommendation for DHS to clearly articulate how it plans to move from a  non-biometric exit technology to a biometric exit solution.
In addition, DHS suggested that we clarify that, with regard to the RFID  pedestrian exit portals at the Nogales-Mariposa, Arizona, POE, it had  constructed a new primary pedestrian exit walkway parallel to the existing  pedestrian entry and had installed signage, sidewalks, and a new secure  gate.  We have amended the report to include information about the new  pedestrian exit walkway.  However, as we noted in our report, portals  were installed only on one of the three pedestrian pathways used to exit  the United States.  According to a CBP official at the Nogales-Mariposa  POE, the newly constructed pedestrian exit walkway is on the other side  of the building from the pathway where the portal readers were placed  and tested and thus would not mitigate the vulnerabilities we identified.
Finally, DHS provided other comments that we considered technical in  nature.  We have amended our report to incorporate these clarifications,  where appropriate.
As agreed with your offices, unless you publicly announce its contents  earlier, we plan no further distribution of this report until 30 days after the  issuance date of our original report, which, as discussed earlier, was  classified For Official Use Only.  At that time, we will provide copies of  this report to appropriate departments and interested congressional  committees.  We will also make copies available to others upon request.
In addition, this report will be available on GAO’s Web site at  http://www.gao.gov.
If you or your staff have any questions about this report or wish to discuss  the matter further, please contact me at (202) 512-8777 or stanar@gao.gov.  Contact points for our Offices of Congressional Relations and Public  Affairs may be found on the last page of this report. Major contributors to  this report are listed in appendix IX.
section_title: Appendix I: Objective, Scope, and Methodology
paragraphs: This report addresses the progress the Department of Homeland Security  and U.S. Customs and Border Protection (CBP) have made in  implementing the United States Visitor Status Indicator Technology (US- VISIT) program at existing land Ports of Entry (POE). Specifically, we  analyzed the following issues: (1) What has the US-VISIT Program Office  done to implement US-VISIT entry capabilities at land POEs and what  impact has US-VISIT had on these facilities? (2) What is the status of US- VISIT Program Office efforts to implement a US-VISIT exit capability at  land POE facilities? (3) What has DHS done to define a strategic context to  show how US-VISIT entry and exit capabilities at land POE facilities fit  with other current and emerging border security initiatives?
We performed our work at the Department of Homeland Security’s US- VISIT Program Office and CBP. We also carried out work at 21 of 154 land  POEs where US-VISIT entry capability had been installed. At 3 of these 21  land POEs, DHS was also testing exit capability. Table 3 shows the 21 land  POEs we visited, by location and state, between August 2005 and February  2006.
In selecting land POEs to visit, we originally selected 10 land POEs on the  northern border and 10 POEs on the southern border based on geographic  dispersion along the border and taking into consideration POEs that were  located near each other to minimize travel costs. We added the Morley  Gate POE after we initially selected sites because it is physically located  about 100 yards from the DeConcini POE in downtown Nogales (Ariz.) and  after learning that US-VISIT was treating Morley Gate as a stand-alone  POE for US-VISIT deployment purposes. In making our selections, we  also considered US-VISIT deployment schedules, facility size, and the  number of border crossings and I-94 issuances. Fifteen of the 21 selected  sites in our study were among the 50 busiest land POEs for which US- VISIT entry capability was to be operating by December 31, 2004, as  required by law. The other 6 sites were among those remaining POEs  where, according to law, US-VISIT entry capability was to be operating by  December 31, 2005. While selecting sites, we also included the five POEs  at which the US-VISIT program office was testing radio frequency  identification (RFID) technology as part of a proof of concept for meeting  US-VISIT exit capability requirements. These were: Blaine-Peace Arch;  Blaine-Pacific Highway; Thousand Islands Bridge, Alexandria Bay;  Nogales-Mariposa; and Nogales-DeConcini. The information from our site  visits is limited to the 21 POEs we visited and is not generalizable to the  remaining POEs.
To examine what the US-VISIT Program Office has done to implement US- VISIT entry capabilities at land POEs and what impact US-VISIT has had  on these facilities, we interviewed US-VISIT and CBP headquarters  officials as well as CBP officials at the 21 locations we visited. We  obtained and analyzed available DHS reports on US-VISIT entry capability  planning, deployment, and operations across land POEs, including the 21  we visited. At the 21 locations, we (1) discussed US-VISIT entry capability  deployment at the facility, any facility-related barriers or constraints  encountered during installation, and any operational issues encountered  since and (2) obtained any available documentation about US-VISIT  deployment and operations at the facility. We also toured secondary  inspection at each facility to observe what US-VISIT equipment was  installed, how it was installed, and where possible, how it operated when  visitors covered by US-VISIT arrived at the facility for processing into the  country. While doing our site visits, we met with US-VISIT and CBP  officials at headquarters to discuss our field work; discern why problems  we identified in the field may have occurred, and if problems occurred,  gather and analyze available US-VISIT and CBP information about those  problems, including information on any corrective actions. We also  examined whether internal or management controls were in place to alert  officials to the problems we identified, and examined whether these  controls were being applied, consistent with GAO’s Standards for Internal  Controls in the Federal Government. In addition, we interviewed CBP and  US-VISIT headquarters officials about plans for installing and operating  new technology and equipment related to US-VISIT, such as 10-finger-scan  readers, at land POEs; reviewed available DHS documents about plans to  implement these devices; and reviewed available DHS documents that  discussed performance measures for US-VISIT overall. We also reviewed  applicable laws, regulations, and DHS federal register notices pertaining to  US-VISIT entry capability deployment at land POEs, as well as reports  prepared by DHS, GAO, the DHS Office of Inspector General, and the  Congressional Research Service.
To determine the status of DHS’s efforts to implement a US-VISIT exit  capability at land POEs, we interviewed US-VISIT and CBP headquarters  officials and CBP officials at the five locations where US-VISIT exit  capability was being tested (Nogales-Mariposa, Nogales-DeConcini,  Blaine-Pacific Highway, Blaine-Peace Arch, and Alexandria Bay). At each  of the locations, we toured the areas where exit testing equipment and  technology had been installed and discussed with CBP officials how it was  installed and to be tested. We also reviewed applicable laws and  regulations and obtained and analyzed available DHS reports on US-VISIT  exit capability including an operational alternatives assessment; feasibility  studies; and proof of concept performance evaluation and corrective  action reports. Our analysis of these reports focused on DHS strategies for  selecting, testing, acquiring, and evaluating alternative methods that could  meet the requirements; DHS’s criteria used to select and test the potential  of RFID technology; and the challenges encountered, including any  privacy issues associated with RFID use. Finally, we obtained and  analyzed DHS reports on the costs of the equipment and related facility  infrastructure, such as the metal gantry erected over roadways to hold  RFID readers, to estimate what it would cost to install RFID equipment at  all land POEs. We developed our overall estimate based on the average  cost to date (about $1 million each) of installing exit gantries and  associated RFID equipment at the four POEs where gantries and  equipment were installed. (Although RFID use was tested at five POEs, at  the DeConcini POE in downtown Nogales, Arizona, the RFID readers were  placed on poles on either side of entry lanes, since all entering vehicles  pass under a large permanent canopy structure that precludes installing a  gantry. At the other four POEs, RFID readers were attached to metal  gantries placed over roadway lanes.)
To examine what DHS has done to define a strategic context to show how  US-VISIT entry and exit capabilities at land POE facilities fit with other  current and emerging border security initiatives, we reviewed past GAO  reports and public DHS announcements about the Western Hemisphere  Travel Initiative and the Secure Border Initiative (SBI). We also  interviewed DHS officials about the status of efforts to implement these  initiatives as well as the status of efforts to develop and promulgate a  strategic plan for US-VISIT and compared available information on DHS  plans to implement initiatives with the results of our discussions with US- VISIT program officials.
We conducted our work from September 2005 through October 2006 in  accordance with generally accepted government auditing standards.
section_title: Appendix II: Visa Waiver Countries
paragraphs: The Department of State’s (State) Visa Waiver Program (VWP) enables  nationals of certain countries to travel to the United States for tourism or  business for stays of 90 days or less without obtaining a visa. The program  was established in 1986 with the objective of promoting better relations  with U.S. allies, eliminating unnecessary barriers to travel, stimulating the  tourism industry, and permitting the Department of State to focus consular  resources in other areas. VWP eligible travelers may apply for a visa, if  they prefer to do so. Not all countries participate in the VWP, and not all  travelers from VWP countries are eligible to use the program. VWP  travelers are screened prior to admission into the United States, and they  are enrolled in the Department of Homeland Security’s US-VISIT program.  Currently, 27 countries participate in the Visa Waiver Program as shown in  the following table.
section_title: Appendix III: Legislative Overview of the US-VISIT Program
paragraphs: The Illegal Immigration Reform and Immigrant Responsibility Act of 1996  originally required the development of an automated entry and exit control  system to collect a record of departure for every alien departing the United  States and match the record of departure with the record of the alien’s  arrival in the United States; make it possible to identify nonimmigrants  who remain in the country beyond the authorized period; and not  significantly disrupt trade, tourism, or other legitimate cross-border traffic  at land border ports of entry. It also required the integration of overstay  information into appropriate databases of the INS and the Department of  State, including those used at ports of entry and at consular offices. The  system was originally to be developed by September 30, 1998; this deadline  was changed to October 15, 1998, and was changed again for land border  ports of entry and sea ports to March 30, 2001.
The Immigration and Naturalization Service Data Management  Improvement Act (DMIA) of 2000 replaced the 1996 statute in its entirety,  requiring instead an electronic system that would provide access to and  integrate alien arrival and departure data that are authorized or required to  be created or collected under law, are in an electronic format, and are in a  data base of the Department of Justice or the Department of State,  including those created or used at ports of entry and at consular offices.  The Act specifically provided that it not be construed to permit the  imposition of any new documentary or data collection requirements on  any person for the purpose of satisfying its provisions, but it further  provided that it also not be construed to reduce or curtail any authority of  the Attorney General (now Secretary of Homeland Security) or Secretary  of State under any other provision of law. The integrated entry and exit  data system was to be implemented at airports and seaports by December  31, 2003, at the 50 busiest land ports of entry by December 31, 2004, and at  all remaining ports of entry by December 31, 2005.
The DMIA also required that the system use available data to produce a  report of arriving and departing aliens by country of nationality,  classification as an immigrant or nonimmigrant, and date of arrival in and  departure from the United States. The system was to match an alien’s  available arrival data with the alien’s available departure data, assist in the  identification of possible overstays, and use available alien arrival and  departure data for annual reports to Congress. These reports were to  include the number of aliens for whom departure data were collected  during the reporting period, with an accounting by country of nationality;  the number of departing aliens whose departure data was successfully  matched to the alien’s arrival data, with an accounting by country of  nationality and classification as an immigrant or nonimmigrant; the  number of aliens who arrived pursuant to a nonimmigrant visa, or as a  visitor under the visa waiver program, for whom no matching departure  data have been obtained as of the end of the alien’s authorized period of  stay, with an accounting by country of nationality and date of arrival in the  United States; and the number of identified overstays, with an accounting  by country of nationality.
In 2001, the USA PATRIOT Act provided that, in developing the integrated  entry and exit data system under the DMIA, the Attorney General (now  Secretary of Homeland Security) and Secretary of State were to focus  particularly on the utilization of biometric technology and the  development of tamper-resistant documents readable at ports of entry. It  also required that the system be able to interface with law enforcement  databases for use by federal law enforcement to identify and detain  individuals who pose a threat to the national security of the United States.  The PATRIOT Act also required by January 26, 2003, the development and  certification of a technology standard, including appropriate biometric  identifier standards, that can be used to verify the identity of persons  applying for a U.S. visa or persons seeking to enter the United States  pursuant to a visa for the purposes of conducting background checks,  confirming identity, and ensuring that a person has not received a visa  under a different name. This technology standard was to be the  technological basis for a cross-agency, cross-platform electronic system  that is a cost-effective, efficient, fully interoperable means to share law  enforcement and intelligence information necessary to confirm the  identity of persons applying for a U.S. visa or persons seeking to enter the  United States pursuant to a visa. This electronic system was to be readily  and easily accessible to consular officers, border inspection agents, and  law enforcement and intelligence officers responsible for investigation or  identification of aliens admitted to the United States pursuant to a visa.  Every 2 years beginning on October 26, 2002, the Attorney General (now  Secretary of Homeland Security) and the Secretary of State were to jointly  report to Congress on the development, implementation, efficacy, and  privacy implications of the technology standard and electronic database  system.
The Enhanced Border Security and Visa Entry Reform Act of 2002 required  that, in developing the integrated entry and exit data system for the ports  of entry under the DMIA, the Attorney General (now Secretary of  Homeland Security) and Secretary of State implement, fund, and use the  technology standard required by the USA PATRIOT Act at U.S. ports of  entry and at consular posts abroad. The act also required the  establishment of a database containing the arrival and departure data from  machine-readable visas, passports, and other travel and entry documents  possessed by aliens and the interoperability of all security databases  relevant to making determinations of admissibility under section 212 of the  Immigration and Nationality Act. In implementing these requirements, the  INS (now DHS) and the Department of State were to utilize technologies  that facilitate the lawful and efficient cross-border movement of  commerce and persons without compromising the safety and security of  the United States and were to consider implementing a North American  National Security Program, for which other provisions in the act called for  a feasibility study.
The act, as amended, also established a number of requirements regarding  biometric travel and entry documents. It required that not later than  October 26, 2004, the Attorney General (now Secretary of Homeland  Security) and the Secretary of State issue to aliens only machine-readable,  tamper-resistant visas and other travel and entry documents that use  biometric identifiers and that they jointly establish document  authentication standards and biometric identifiers standards to be  employed on such visas and other travel and entry documents from among  those biometric identifiers recognized by domestic and international  standards organizations. It also required by October 26, 2005, the  installation at all ports of entry of the United States equipment and  software to allow biometric comparison and authentication of all U.S.  visas and other travel and entry documents issued to aliens and passports  issued by visa waiver participants. Such biometric data readers and  scanners were to be those that domestic and international standards  organizations determine to be highly accurate when used to verify identity,  that can read the biometric identifiers used under the act, and that can  authenticate the document presented to verify identity. These systems also  were to utilize the technology standard established pursuant to the  PATRIOT Act.
The Intelligence Reform and Terrorism Prevention Act of 2004 did not  amend the existing statutory provisions governing US-VISIT, but it did  establish additional statutory requirements concerning the program. It  described the program as an “automated biometric entry and exit data  system” and required DHS to develop a plan to accelerate the full  implementation of the program and to report to Congress on this plan by  June 15, 2005. The report was to provide several types of information  about the implementation of US-VISIT, including a “listing of ports of entry  and other DHS and Department of State locations with biometric exit data  systems in use.” The report also was to provide a description of the  manner in which the US-VISIT program meets the goals of a  comprehensive entry and exit screening system, “including both entry and  exit biometric;” and fulfills the statutory obligations imposed on the  program by several laws enacted between 1996 and 2002. The act provided  that US-VISIT “shall include a requirement for the collection of biometric  exit data for all categories of individuals who are required to provide  biometric entry data, regardless of the port of entry where such categories  of individuals entered the United States.”
The new provisions in the 2004 act also addressed integration and  interoperability of databases and data systems that process or contain  information on aliens and federal law enforcement and intelligence  information relevant to visa issuance and admissibility of aliens;  maintaining the accuracy and integrity of the US-VISIT data system; using  the system to track and facilitate the processing of immigration benefits  using biometric identifiers; the goals of the program (e.g., serving as a vital  counterterrorism tool, screening visitors efficiently and in a welcoming  manner, integrating relevant databases and plans for database  modifications to address volume increase and database usage, and  providing inspectors and related personnel with adequate real time  information); training, education, and outreach on US-VISIT, low risk  visitor programs, and immigration law; annual compliance reports by DHS,  State, the Department of Justice, and any other department or agency  subject to the requirements of the new provisions; and development and  implementation of a registered traveler program.
section_title: Appendix IV: The 20 Busiest Land Ports of Entry (POE) by Volume of Individuals Entering the United States in Fiscal Year 2005
paragraphs: Appendix IV: The 20 Busiest Land Ports of  Entry (POE) by Volume of Individuals  Entering the United States in Fiscal Year 2005  and Foreign Entrants  (Pedestrians and Vehicle  Occupants)
Calif.
Calif.
Calif.
Tex.
Tex.
Tex.
Ariz.
Tex.
N.Y.
Ariz.
Tex.
Mich.
Ariz.
N.Y.
Tex.
Tex.
Calif.
Mich.
Mich.
Tex.
This site comprises multiple POEs at this location.
section_title: Appendix V: Land Ports of Entry (POE) at Which US-VISIT Has Been Installed
paragraphs: According to the US-VISIT program office, US-VISIT entry capability was  installed at the following land POE by December 31, 2005. The list is  arranged in state alphabetical order.
subsections: section_title: Alaska (3)
section_title: Arizona (8)
section_title: California (6)
section_title: Idaho (2)
section_title: Maine (15)
section_title: Michigan (6)
section_title: Minnesota (8)
section_title: Montana (13)
section_title: New Hampshire (1)
section_title: New Mexico (3)
section_title: New York (16)
section_title: North Dakota (18)
section_title: Ohio (1)
section_title: Texas (25)
section_title: Vermont (14)
section_title: Washington (13)
section_title: Canada (1)
section_title: Appendix VI: Actions Taken by US-VISIT Program Office to Mitigate Privacy Risks Associated with RFID at Land POEs
paragraphs: Protecting the privacy of visitors to the United States is one of the four  stated primary mission goals of the US-VISIT program. We and others have  raised questions in recent years about the potential privacy risks  surrounding the use of RFID technology to track the movement of  persons, as opposed to goods; the potential for the technology to be  subverted for surveillance purposes, rather than identification; and the  potential for “function creep,” whereby information collected for one  purpose gradually develops other secondary uses, such as has occurred  with Social Security numbers. In congressional testimony, we have noted  that the use of RFID tags and associated databases raises important  security considerations related to the confidentiality, integrity, and  availability of the data on the tags and in the databases, and in how this  information is being protected. We have noted, as well, that while the  federal government had begun using RFID technology for a variety of  applications—to track and identify assets, weapons, and baggage on  flights, for example—using this technology for generic inventory control  did not raise the same privacy issues as using it to track the movement of  persons.
The US-VISIT Program Office has taken steps to meet statutory and  congressional requirements protecting the privacy of individuals who  would be affected if RFID technology were to be implemented as part of  the US-VISIT exit and re-entry process, and to address the privacy  concerns raised by us and others. According to OMB guidance, a privacy  impact assessment should be conducted before an agency develops or  procures an information technology system, such as the proposed RFID  system, which collects, maintains, or disseminates information about an  individual—in this case, numeric information that may be linked to  biographic information contained within databases. In January 2004, DHS  published a Privacy Impact Assessment in the Federal Register, as  required by law, for the initial deployment of US-VISIT, and published the  latest in a series of updated Privacy Impact Assessments in July 2005,  addressing privacy issues related to the proof-of-concept testing of RFID  for Increment 2C.
In its July 2005 Privacy Impact Assessment, DHS said that by design, the  information embedded in the RFID-readable I-94 tag does not compromise  a visitor’s security, for the following reasons and with the following  strictures:    Passive RFID minimizes privacy impacts and reduces the chance of  visitors being surreptitiously tracked because it does not constantly  transmit information or “beacon” a signal.
The numeric identifier read in the I-94 tag does not contain and is not  derived from any personal information, and can only be used to obtain  personal information when combined with data within the Automated  Identification Management System (the system created to link the  unique RFID tag ID number to existing biographic information received  from the TECS database).
The Automated Identification Management System records the exit and  re-entry data automatically captured for a particular RFID tag, rather  than a specific individual. The individual’s complete travel history is  created only when the information captured from the RFID tag is sent  along with the biographic information stored in the TECS database to a  DHS Arrival and Departure Information System.
The Automated Identification Management System is undergoing the  DHS certification and accreditation process, which includes having an  approved detailed security plan and a comprehensive technical  assessment of the risks of operating the system. The certification and  accreditation process will be completed before the proof-of-concept  becomes operational.
The Automated Identification Management System database can only  be accessed by authorized personnel signed into authorized  workstations that communicate with the system via a secure network.  These computer workstations are generally in CBP POE buildings,  inside work areas with physical controls over who can enter the area,  according to the Privacy Impact Assessment, and each POE is required  to be in compliance with DHS regulations with regard to security. Even  if an RFID tag number were secretly detected by someone, that person  would also have to obtain access to the Automated Identification  Management System secure database, to link the number to an  individual’s records.
DHS acknowledged that two potential privacy risks related to the RFID  exit/re-entry solution have been identified, and that US-VISIT creates a  pool of individuals whose personal information is at risk. Nevertheless, it  is stated in the July 2005 Privacy Impact Assessment that the privacy risks  will either be avoided or mitigated through the use of access controls,  education and training, encryption, and minimizing collection and use of  personal information will mitigate privacy risks associate with data  sharing. The first stated risk is that, if the format or some other  characteristic of the RFID tag number renders it recognizable as a US- VISIT RFID tag, this would allow an unauthorized reader to surreptitiously  determine an individual’s status (i.e., within US-VISIT covered population).  DHS stated that the RFID tag number will be structured so that it cannot  be used to identify an individual specifically as a nonimmigrant. Second,  DHS noted there is a low risk that the RFID tag could be used to conduct  surreptitious locational surveillance of an individual; i.e., to use the  presence of the tag to follow an individual as he or she moves about in the  United States. However, ensuring that RFID tag numbers do not exhibit  properties that can be readily attributed to US-VISIT and using a limited  radio frequency range effectively mitigates this risk, according to DHS.
section_title: Appendix VII: US-VISIT Test of Radio Frequency Identification (RFID) Readers Upon Exit and Re-entry at Selected Land POEs
paragraphs: The US-VISIT Program Office has been testing the use of passive,  automated, radio frequency identification (RFID) technology as a means to  record the exit of visitors from the United States at land POEs. RFID is an  automated data-capture technology that can be used to electronically store  information contained on a very small tag that can be embedded in a  document (or some other physical item); in this case, US-VISIT embedded  the tag in a modified Form I-94, called an I-94A. This information can then  be identified, and recorded as having been identified, by RFID readers that  are connected to computer databases. The RFID tests were conducted for  one-week periods at land POEs, as follows: vehicular traffic was tested at  Nogales-Mariposa and Nogales-DeConcini POEs in Nogales, Arizona; the  Blaine-Pacific Highway and Blaine-Peace Arch POEs in Blaine,  Washington; and Thousand Islands Bridge POE in Alexandria Bay, New  York; pedestrian traffic was tested at the Nogales-Mariposa and Nogales- DeConcini POEs.
For these exit tests, the US-VISIT Program Office developed critical  success factor target read rates to compare them to the actual read rates  obtained during the test for both pedestrians carrying I-94As with RFID- detectable tags and for travelers in vehicles who also had RFID-detectable  I-94As with them inside the vehicles. The target exit read rates ranged  from an expected success rate of 70 percent to 95 percent, based on  anticipated performance under different conditions, partly as  demonstrated in the earlier feasibility study, on business requirements,  and on a concept of operation plan prepared for Increment 2C. Table 5  shows the exit test results compared to the target read rates, reflecting  specifically the percentage of persons detected by the readers who were  carrying RFID-detectable documents for (1) pedestrians and (2) persons in  vehicles, as they passed through the POE area, while exiting the country.
In phase 1 of proof-of-concept testing for RFID, US-VISIT reported that  read rates were higher for both vehicle occupants and pedestrians who  held the I-94A up toward the reader, rather than leaving it inside a pocket.  Through the use of billboards, radio and print advertisements, and other  methods of communication, visitors were encouraged to place their RFID- detectable I-94A forms on the vehicle dashboard or up to a window. These  locations were believed to increase the chances for a successful read.  Those who took these actions were referred to as “participants,” and those  who did not as “nonparticipants.” The US-VISIT Program Office reported  that during the week-long proof-of-concept exit testing, one of the three  pedestrians was a participant—that is, the individual was observed as  voluntarily complying with the instructions; for those exiting in a vehicle,  these data were not reported. Moreover, although CBP officials made  substantial pre-test efforts to encourage travelers to optimize the chances  of I-94A tags being read, the report noted that this effort apparently met  with mixed success and that no additional solutions were planned.
During the time period that US-VISIT tested the performance of RFID  readers for detecting I-94As carried by persons exiting the country in  vehicles at two land POEs (Thousand Islands Bridge, Alexandria Bay, New  York and Blaine-Pacific Highway, Washington), it also tested RFID reader  performance for persons in vehicles with RFID-embedded I-94As who re- entered the country at both of these locations and three others (Blaine- Peace Arch, Washington; and, in Arizona, Nogales-Mariposa and Nogales- DeConcini). In addition, tests of RFID detectability carried by pedestrians  re-entering the country were conducted at Nogales-Mariposa, and Nogales- DeConcini; pedestrian exit was tested only at Nogales-Mariposa because  of operational constraints at Nogales-DeConcini, according to the report  on the tests. Since persons re-entering the country with a RFID-enabled I- 94 would already have obtained an I-94A on a prior visit to the United  States, in order for it to be detected by an RFID reader, this process is  sometimes referred to by the US-VISIT program office as “re-entry.”
DHS set separate, higher critical success factors (performance targets) for  the RFID proof-of-concept tests for the vehicle re-entry process than for  the vehicle exit process. According to a US-VISIT official, these higher  performance targets were based, in part, on the fact that vehicles must  stop as part of the re-entry process, which makes it more likely that a tag  will be detected than is the case for exiting vehicles, which do not need to  slow down or stop at land POEs. As with the tests conducted for exit, test  observers monitored traveler behavior to see whether, in compliance with  numerous advertisements in print and on local radio, the vehicle driver  placed the RFID-enabled I-94A on the vehicle dashboard or on an empty  passenger seat, or, for vehicle occupants, if they held the I-94A up to a  window or who made it otherwise visible, to better enable detection it by  the reader. Vehicle drivers or occupants who displayed an I-94A in any of  these requested ways were categorized as “participants,” but read rates for  them were, nevertheless, low at four of five test locations. For example, at  Nogales-DeConcini, which had the lowest vehicle-entry read rates overall,  the read rate was 27 percent for the 62 persons re-entering in vehicles with  visitors whom US -VISIT reported as making an effort to have their I-94A  tags read. In contrast, at Nogales-Mariposa, which had the highest overall  re-entry read rate for the vehicle test, US-VISIT reported that 83 out of 96  (86 percent) of travelers who were categorized as participants were  detected. Among those at this same location who did not make this effort,  US-VISIT reported that I-94s with RFID tags were detected for about half  (51 percent) of the persons in the vehicles. Table 6 shows the results of  RFID read-rates upon re-entry for vehicle participants and  nonparticipants.
Table 7 shows the results of RFID read-rate detection upon re-entry for  pedestrian participants and nonparticipants.
section_title: Appendix VIII: Comments from the U.S. Department of Homeland Security
section_title: Appendix IX: GAO Contact and Acknowledgments
subsections: section_title: Acknowledgments
paragraphs: In addition to the above, John F. Mortin, Assistant Director; Amy  Bernstein, Frances Cook, Odi Cuero, Richard Hung, Amanda Miller, James  R. Russell, and Jonathan Tumin made key contributions to this report.