Visa Waiver Program: DHS Should Take Steps to Ensure Timeliness of Information Needed to Protect U.S. National Security
Published: 2016-05-05T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Visa Waiver Program allows nationals from the 38 VWP countries to travel to the United States for tourism or business for up to 90 days without a visa. To help prevent terrorists and others who present a threat from travelling to the United States, DHS requires VWP countries to, among other things, enter into information-sharing agreements with the United States. In addition, U.S. law requires DHS to evaluate, at least once every 2 years, the effect of each VWP country's participation on U.S. law enforcement, security, and immigration enforcement interests; determine whether the country should continue in the program; and report on its determination to Congress.
GAO was asked to review the VWP. In this report, GAO examines the extent to which VWP countries have implemented the required agreements. GAO also examines the extent to which DHS evaluated VWP countries and reported to Congress as required. GAO reviewed documents related to the VWP, including a sample of DHS reports. In addition, GAO interviewed U.S. officials in Washington, D.C., and U.S. and foreign officials in four VWP countries selected on the basis of factors such as high estimated numbers of foreign terrorist fighters. This is a public version of a classified report GAO issued in January 2016.
section_title: What GAO Found
paragraphs: All 38 countries participating in the Visa Waiver Program (VWP) have entered into required agreements, or their equivalents, to (1) report lost and stolen passports, (2) share identity information about known or suspected terrorists, and (3) share criminal history information. However, not all countries have shared information through the agreements. The Department of Homeland Security (DHS) reported that all VWP countries have reported passport information through the first agreement, but more than a third of VWP countries are not sharing terrorist identity information through the second agreement and more than a third of the countries have not yet shared criminal history information through the third agreement. While VWP countries may share information through other means, U.S. agency officials told GAO that information sharing through the agreements is essential for national security. In August 2015, DHS decided to require VWP countries to implement agreements to share terrorist identity and criminal history information; previously, VWP countries were required to enter into, but not to implement, these agreements. However, contrary to standard program management practices, DHS did not establish time frames for instituting the amended requirements. In December 2015, Congress passed a law requiring that VWP countries fully implement information-sharing agreements in order to participate in the program. Time frames for working with VWP countries to implement their agreements could help DHS enforce U.S. legal requirements and could strengthen DHS's ability to protect the United States and its citizens.
GAO's analysis of a nongeneralizeable sample of 12 internal DHS reports, each evaluating one VWP country, found the reports assessed the effects of the countries' participation on U.S. law enforcement, security, and immigration enforcement interests, as required by U.S. law. Since 2011, when GAO last reviewed the VWP, DHS has improved its timeliness in reporting to Congress at least once every 2 years its determinations of whether countries should continue in the program. Nonetheless, as of October 31, 2015, GAO found that about a quarter of DHS's most recent VWP congressional reports were submitted, or remained outstanding, 5 or more months past the statutory deadlines (see figure). As a result, Congress may lack timely information needed to conduct oversight of the VWP and assess whether further modifications are necessary to prevent terrorists from exploiting the program.
section_title: What GAO Recommends
paragraphs: DHS should (1) specify time frames for working with VWP countries on the requirement to implement information-sharing agreements and (2) take steps to improve its timeliness in reporting to Congress on whether VWP countries should continue in the program. DHS concurred with the recommendations.

section_title: Letter
paragraphs: The Visa Waiver Program (VWP) was established in 1986 to facilitate the  legitimate travel of visitors for business or tourism to the United States.  Qualifying nationals from the 38 countries participating in the VWP (VWP  countries)—for example, France, Germany, and Hungary—may travel  without a visa to the United States for business or tourism stays of up to  90 days. In 2013, nationals from VWP countries were responsible for  more than $90 billion in travel and tourism expenditures in the United  States. However, some members of Congress have expressed concern  that foreign terrorist fighters might attempt to exploit the program to travel  to the United States, creating a potential terrorist threat. The Department  of State (State) has reported that in recent years, thousands of foreign  terrorist fighters—including many from VWP countries—have traveled to  countries such as Syria and Iraq to train with, support, or join extremist  groups, such as the self-proclaimed Islamic State in Iraq and Syria  (ISIS), that are hostile to the United States.
The Department of Homeland Security (DHS), in consultation with State,  is responsible for oversight of the VWP. In 2007, Congress mandated  several changes to the program that were intended to enhance bilateral  cooperation on critical counterterrorism and information-sharing  initiatives, support and expand tourism and business opportunities to  enhance long-term competitiveness, and strengthen bilateral  relationships. In response, DHS began requiring, among other things,  that VWP countries enter into bilateral agreements with the United States  to report information about the theft or loss of passports, share watch list  information about known or suspected terrorists, and establish  frameworks for enhanced law enforcement cooperation to share  information on criminal history and potential serious criminals. In addition,  Congress separately mandated that DHS, at least once every 2 years,  evaluate the effect that each VWP country’s participation in the program  has on the law enforcement and security interests of the United States,  including immigration enforcement; determine whether the country should  continue in, or be terminated from, the program; and report its  determination to Congress. In 2011, we reported that only half of the  then 36 VWP countries had entered into all of the required information- sharing agreements. In December 2015, Congress passed the Visa  Waiver Program Improvement and Terrorist Travel Prevention Act of  2015, amending certain VWP requirements to provide enhanced security  measures for the program, among other purposes.
You asked us to review the VWP. In this report, we examine the extent to  which (1) VWP countries have shared information through the required  information-sharing agreements and U.S. agencies have been able to  use this information to address U.S. law enforcement and security  interests. We also examine the extent to which (2) DHS has, as required,  evaluated the effect of VWP countries’ participation on U.S. law  enforcement and security interests and reported to Congress its  determinations of whether countries should continue participating in the  program.
This is a public version of a classified report we issued in January 2016.  DHS deemed information related to information sharing with specific VWP  countries, data provided through INTERPOL, and information related to  specific internal DHS procedures to be For Official Use Only. DOJ  deemed information related to information sharing with specific VWP  countries to be SECRET//NOFORN.
To determine the extent to which VWP countries have shared information  through the required information-sharing agreements, we reviewed  documentation of agreements, as well as relevant U.S. laws and agency  policies; analyzed U.S. agency data; and interviewed U.S. and selected  VWP country officials responsible for negotiating and implementing the  agreements. We interviewed VWP country officials in four countries  (Belgium, Greece, France, and Spain) that we selected on the basis of a  number of factors—in particular, high estimated total and per capita  numbers of foreign terrorist fighters and concerns about border security  and counterterrorism capacity. To determine the extent to which U.S.  agencies are able to use the shared information to address U.S. law  enforcement and security interests, we reviewed U.S. agency data and  documents and discussed with U.S. law enforcement and  counterterrorism officials in the United States and overseas the value and  utility of information obtained through the agreements.
To assess the extent to which DHS has evaluated VWP countries’ effect  on U.S. law enforcement and security interests, we selected and  analyzed a nongeneralizable sample of DHS reports of its evaluations of  12 VWP countries. We selected these countries on the basis of factors  such as high estimated numbers of foreign terrorist fighters and concerns  about border security and counterterrorism capacity. We also reviewed  relevant U.S. agency documents and guidance, such as DHS’s “Visa  Waiver Program Continuing Designation Country Reviews Standard  Operating Procedures.” Additionally, in the four VWP countries we visited,  we interviewed U.S. agency and VWP country officials regarding DHS’s  processes for conducting its evaluations. To determine the extent to  which DHS has submitted the required reports to Congress, we collected  and analyzed information from DHS about the dates when the most  recent reports were due and when they were delivered, and we compared  the results of this analysis with findings from our 2011 review of the VWP  program. In addition, we interviewed DHS officials about the process for  preparing the reports and submitting them to Congress. For additional  details of our scope and methodology, see appendix I.
We conducted this performance audit from October 2014 to January 2016  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: The VWP was established as a pilot program, with two participating  countries, in November 1986 and became a permanent program in  October 2000. The program allows eligible nationals from the 38 VWP  countries to travel to the United States for 90 days or less for business or  pleasure without a visa and requires that VWP countries extend  reciprocal privileges to U.S. citizens. Additionally, the VWP makes it  possible for State to allocate more resources to visa-issuing posts in  countries with higher-risk applicant pools. In fiscal year 2013, there were  nearly 20 million traveler admissions to the United States under the VWP,  with admissions from each of the 38 countries ranging from about 700 to  more than 4 million (see fig. 1).
subsections: section_title: Electronic System for Travel Authorization
paragraphs: In August 2008, responding to a requirement in the Implementing  Recommendations of the 9/11 Commission Act of 2007, DHS’s U.S.  Customs and Border Protection (CBP) introduced the Electronic System  for Travel Authorization (ESTA). In 2009, CBP began requiring all  travelers arriving by air or sea under the VWP to, among other things,  submit an application through ESTA before departure. VWP travelers are  also required to possess a passport containing an electronic chip (e- passport) issued by the VWP country.
Before a traveler can depart for the United States under the VWP, CBP  vets the traveler’s ESTA application against several databases. These  databases include, among others, the Federal Bureau of Investigation’s  (FBI) Terrorist Screening Database—the U.S. government’s consolidated  watch list of known or suspected terrorists—and the International Criminal  Police Organization’s (INTERPOL) Stolen and Lost Travel Documents  database. If CBP approves an ESTA application, the VWP traveler is  authorized to depart for the United States. If CBP denies an ESTA  application, CBP refers the traveler to the U.S. embassy or consulate to  complete the standard visa application process. This process includes  submitting an application and being interviewed, fingerprinted, and vetted  against the FBI’s Terrorist Screening Database and INTERPOL’s Stolen  and Lost Travel Documents database, among others, before travel to the  United States. At U.S. ports of entry, CBP interviews, fingerprints, and  photographs VWP travelers arriving by air or sea with an approved ESTA  as well as travelers with a U.S. visa and vets the fingerprints against  biometrics databases.
In November 2014, DHS revised the ESTA application to address  concerns that foreign terrorist fighters might exploit the VWP to enter the  United States. The revised application requires additional passport data,  contact information, information about connections to U.S. persons, and  any other names or aliases. According to DHS documents, DHS  determined that these revisions would improve its ability to vet  prospective VWP travelers and to more accurately and effectively identify  those who pose a security risk to U.S. interests. DHS also rephrased  questions in the ESTA application to make them easier for the general  public to understand.
section_title: Requirements for Continuing Participation in VWP
paragraphs: In response to the Implementing Recommendations of the 9/11  Commission Act of 2007, DHS worked with interagency partners to  develop several requirements to help prevent terrorists from using the  VWP to travel to the United States, according to DHS officials. To  continue participating in the program, each VWP country must, among  other things, accept repatriation of any citizens, former citizens, and  nationals ordered removed from the United States within 3 weeks of the  final order of removal. In addition, since before the 2007 act, VWP  countries have been required to extend reciprocal visa-free travel to U.S.  citizens and issue machine-readable passports. Further, the U.S.  government requires each country to enter into a  1.  Lost and Stolen Passport (LASP) agreement to report information  about the theft or loss of passports,  2.  Homeland Security Presidential Directive 6 (HSPD-6) arrangement to  share watch list information about known or suspected terrorists, and  3.  Preventing and Combating Serious Crime (PCSC) agreement to  establish frameworks for enhanced law enforcement cooperation,  including sharing of criminal history information.
As of December 2015, all VWP countries are also required by law to,  among other things, fully implement their agreements to share information  on whether their citizens and nationals traveling to the United States  represent a threat to the security or welfare of the United States or its  citizens.
Under existing law, a number of factors can result in a VWP country’s  termination or suspension from the program. DHS is required to terminate  a country’s VWP designation if the country (1) experiences an emergency  that the DHS Secretary, in consultation with the Secretary of State,  determines to be a threat to the law enforcement or security interests of  the United States, including interests in enforcing U.S. immigration laws;  (2) does not report the theft or loss of passports, as jointly determined by  DHS and State; or (3) does not share required passenger information.  In addition, DHS may place on probationary status or, in certain  circumstances, terminate the designation of any VWP country if, following  certain criteria, more than 2 percent of the country’s nationals who  applied for admission as nonimmigrant visitors to the United States during  the previous fiscal year were denied admission, withdrew their application  for admission, or were admitted as nonimmigrant visitors and violated the  terms of admission.
In consultation with State, DHS also may for any reason—including  national security—rescind any waiver or designation previously granted at  any time or may refrain from waiving the visa requirement for nationals of  any country that may otherwise qualify for designation. In addition, DHS  may terminate a VWP country’s designation if, in consultation with State,  DHS determines through its biennial evaluation that a country’s  participation is inconsistent with the law enforcement and security  interests of the United States, including U.S. interests in enforcing  immigration laws and securing criminal extraditions. Further, in  consultation with State, DHS may suspend a VWP country’s designation  if the Director of National Intelligence informs the Secretary of Homeland  Security of any current and credible threat of an imminent danger to the  United States or its citizens that originates from a VWP country.
section_title: DHS Responsibilities for VWP
paragraphs: Under U.S. law, DHS is required to periodically evaluate VWP countries  and report its findings to Congress. In particular, DHS, in consultation  with State, must perform the following at least once every 2 years:
Evaluate the effect of each VWP country’s continued participation in  the program on U.S. law enforcement and national security interests  (including immigration enforcement interests).
Determine, based on the evaluation conducted, whether each VWP  country’s participation in the program should be continued or  terminated.
Submit a written report to appropriate congressional committees,  including the Secretary’s determination with an explanation of any  effects of each VWP country’s continued participation in the program  on U.S. law enforcement and security interests.
Submit a written report to Congress regarding the implementation of  the electronic system for travel authorization.
Within DHS, the Visa Waiver Program Office (VWPO) is responsible for  overseeing and monitoring VWP countries’ adherence to the program’s  statutory and policy requirements. VWPO’s responsibilities include  evaluating the effects of VWP countries’ participation in the program,  preparing the Secretary of Homeland Security’s determinations to  continue or terminate VWP countries’ participation, and submitting the  written reports to Congress. According to VWPO officials, the office also  monitors VWP country security, law enforcement, and immigration  enforcement issues outside the formal review periods to identify issues  that could negatively affect U.S. interests. In addition, the DHS Office of  Intelligence and Analysis produces an independent intelligence review of  each VWP country, examining threats associated with the country’s  participation in the VWP, the country’s counterterrorism capabilities, and  the country’s information sharing with the United States about terrorist  threats, according to officials from that office.
section_title: All VWP Countries Have Entered into Required Agreements or Equivalents, but Not All Are Sharing Information through Two Agreements
paragraphs: All 38 countries participating in the VWP have entered into the three types  of required information-sharing agreements, or their equivalents, with the  United States, but not all countries are sharing information through two of  the agreements. According to DHS, all VWP countries are reporting  losses or thefts of passports through LASP agreements, although DHS  previously placed two countries on provisional status partly because of a  lack of timely reporting. However, as of December 2015, about a third of  VWP countries were not sharing identity information about known or  suspected terrorists through HSPD-6 arrangements. Also, about a third of  VWP countries had not yet shared criminal history information through  PCSC agreements. Although U.S. agencies receive law enforcement and  national security information from VWP countries through other means,  such as multilateral entities, the U.S. government identified the  information-sharing agreements as critical for protecting the United States  from nationals of VWP countries who might present a threat. While U.S.  law before December 2015 required VWP countries to enter into, but not  to implement, the agreements, DHS announced in August 2015 that it  had developed a new requirement that countries implement them by  sharing information. However, contrary to standard program  management practices, DHS has not specified time frames for working  with VWP countries to institute this and other new VWP security  requirements.
subsections: section_title: VWP Countries Are Reporting through LASP Agreements, and U.S. Agencies Use Shared Information to Vet Travelers
paragraphs: All 38 VWP countries have entered into LASP agreements with the United  States and, according to DHS officials, are reporting lost or stolen  passports through the agreements. Before December 2015, U.S. law  required that VWP countries enter into an agreement with the United  States to report, or to make available to the U.S. government through  INTERPOL or other means designated by the Secretary of Homeland  Security, information about the theft or loss of passports within a strict  time limit and in a manner specified in the agreement. Since December  2015, U.S. law has required that countries agree to report on lost and  stolen passports not later than 24 hours after becoming aware of the theft  or loss. Of the 38 countries, 35 agreed to report lost or stolen travel  documents exclusively through INTERPOL and in accordance with  INTERPOL standards. According to DHS officials, 2 of the remaining  countries agreed to report through the Regional Movement Alert System,  an alternative mechanism for reporting LASP information that provides a  direct query capability between national document-issuing authorities and  border control systems; the third country agreed to report through another  means. According to VWPO officials, VWPO considers all VWP countries  to be in compliance with the requirement to report lost and stolen  passports. VWPO officials noted that VWPO bases its compliance  determinations in part on data from INTERPOL’s Stolen and Lost Travel  Documents database that are available to VWPO and other U.S.  agencies.
DHS and State use information about lost and stolen passports to vet  travelers to the United States. DHS’s CBP uses information obtained  through the LASP agreements to vet foreign travelers attempting to enter  the United States, which, according to CBP and DOJ documents, may  help counter the threat of foreign terrorist fighters. CBP and State use this  information to vet travelers’ ESTA applications and visa applications  before travel, and CBP uses it to vet foreign passports of all travelers  before boarding and at U.S. ports of entry. According to testimony by the  DHS Deputy Assistant Secretary for International Affairs, CBP has denied  over 165,000 ESTA applications since 2008 on the basis of LASP  information, potentially preventing criminals or terrorists from using stolen  passports to illegally enter the United States. In 2013, U.S. agencies— primarily DHS—queried INTERPOL’s Stolen and Lost Travel Documents  database over 238 million times.
section_title: Not All VWP Countries Are Sharing Information through HSPD-6 Arrangements, but Shared Information Has Enhanced Terrorist Watch List
paragraphs: All VWP countries have entered into HSPD-6 or equivalent arrangements  to exchange information with the United States about known or suspected  terrorists, but not all countries are sharing information through these  arrangements. U.S. law requires that each VWP country enter into an  agreement with the United States to share information regarding whether  the country’s citizens and nationals traveling to the United States  represent a threat to the security or welfare of the United States or its  citizens. Since December 2015, U.S. law has also required that VWP  countries fully implement these agreements. State’s Bureau of  Counterterrorism and the FBI’s Terrorist Screening Center (TSC)  negotiate HSPD-6 arrangements between the U.S. government and VWP  countries. Under the arrangements, VWP countries share information  directly with the TSC, which then integrates the information into the U.S.  terrorist watch list.
As of December 2015, most VWP countries were exchanging information  about known or suspected terrorists with the TSC through HSPD-6  arrangements, but about a third of VWP countries were not exchanging  information directly with the TSC. The TSC reported in December 2015  that the number of known or suspected terrorist identities that each VWP  country had shared with the TSC through HSPD-6 arrangements ranged  from zero to over 1,000. For example, one country that entered into a  HSPD-6 arrangement in 2012 had not shared information through the  arrangement as of December 2015. According to DHS officials, some  countries share information about known or suspected terrorists with U.S.  agencies through alternative arrangements rather than sharing directly  with the TSC.
Information provided through the HSPD-6 arrangements has enhanced  U.S. traveler-screening capabilities and improved U.S. agencies’ ability to  prevent known and suspected terrorists from traveling to the United  States. According to FBI documents, from 2008 through 2015, the TSC  received information about approximately 9,000 known or suspected  terrorists, including approximately 3,500 who were previously unidentified,  through HSPD-6 arrangements with VWP countries. The FBI integrates  into the Terrorist Screening Database the information that VWP countries  provide to the TSC, and U.S. agencies reported using the database to vet  travelers attempting to enter the United States. CBP vets ESTA  applications against the Terrorist Screening Database to identify any  potential known or suspected terrorists attempting to use the VWP to  travel to the United States. According to the DHS Deputy Assistant  Secretary for International Affairs, since 2008, CBP has denied over  4,300 ESTA applications for national security concerns as a result of  vetting against the Terrorist Screening Database and other terrorism- related databases. In addition, at ports-of-entry, CBP vets every  international traveler attempting to enter the United States against the  database, according to DHS documents. State also uses the Terrorist  Screening Database to vet visa applicants.
section_title: Not All VWP Countries Have Shared Information through PCSC or Equivalent Agreements, but Shared Information Has Aided Criminal Investigations
paragraphs: As of February 2014, all 38 VWP countries had entered into PCSC  agreements, or their equivalents, with the United States regarding the  exchange of information about criminals who pose a risk to U.S. interests,  but not all VWP countries had shared information through the  agreements. U.S. law requires that VWP countries enter into an  agreement with the United States to share information regarding whether  citizens and nationals of that country traveling to the United States  represent a threat to the security or welfare of the United States or its  citizens. Since December 2015, U.S. law has also required that VWP  countries fully implement these agreements. In some cases, countries  entered into the agreements several years after the requirement to enter  into agreements was established in 2008. According to DHS officials, the  existing domestic political environments of individual VWP countries may  have delayed some countries’ entry into the agreements.
As of September 2015, about two-thirds of VWP countries had shared  information about criminals with U.S. agencies through PCSC or  equivalent agreements, using interim, manual query mechanisms—either  electronic file transfer systems or compact disc exchanges. The  remaining VWP countries had not shared such information through the  agreements. For example, one country that entered into a PCSC  agreement in 2008 had not shared information through the agreement as  of September 2015. PCSC agreements are intended to automate and  expedite the sharing of information about individuals suspected or  convicted of committing serious crimes, according to DHS officials.  PCSC agreements allow for the exchange of biometric data, such as  fingerprints, and biographic data of suspected criminals while protecting  individual privacy. According to DHS, by authorizing both the United  States and a VWP country to conduct automated queries of the other’s  criminal fingerprint databases, PCSC agreements establish a framework  for enhanced law enforcement cooperation.
Both DOJ and DHS reported using interim exchange mechanisms  established through PCSC agreements to aid in law enforcement  investigations. Likewise, many VWP countries had used interim exchange  mechanisms to query U.S. law enforcement databases. As of January  2016, U.S. agencies and VWP countries had not fully established virtual  private networks to allow for automated querying of criminal databases as  authorized by PCSC agreements. However, the FBI reported working with  several VWP countries to establish these networks.
section_title: U.S. Agencies May Receive Information from VWP Countries through Other Means
paragraphs: In addition to receiving information through the three agreements required  for participation in VWP, U.S. agencies may receive information related to  national security and law enforcement through other means, such as  multilateral entities. For example, since 2013, INTERPOL has issued 670  notices seeking arrest and extradition of suspected foreign terrorist  fighters to all 190 of its members, and individual members had issued an  additional 2,100 alerts. The United States also works with an international  coalition—which includes at least 30 VWP countries—to counter threats  posed by ISIS, such as the threat of foreign terrorist fighters’ entering this  country. The coalition has a working group focused on disrupting the  recruitment, travel, and sustainment of foreign terrorist fighters.
While VWP countries may use other means to share information that is  useful to U.S. agencies responsible for law enforcement and national  security, the U.S. government identified the three information-sharing  agreements as critical for protecting the United States from nationals of  VWP countries who might present a threat. As we reported in 2011, DHS  officials told us that formal agreements—in contrast to the sharing of  information on an informal, case-by-case basis—expand the pool of  information to which the United States has systematic access and  generally expedite information sharing by laying out specific terms that  can be referenced easily in requests for data. DHS officials observed  that timely access to information is especially important for CBP officials  at ports of entry.
section_title: DHS Lacks Time Frames for Instituting a Requirement to Share Information through HSPD-6 Arrangements and PCSC Agreements
paragraphs: In August 2015, the Secretary of Homeland Security announced that DHS  and other agencies were developing additional requirements for VWP  participation, including a requirement to implement HSPD-6 and PCSC  agreements by sharing information. Previously, in accordance with U.S.  law, DHS required VWP countries to enter into the arrangements and  agreements but did not require the countries to implement them in order  to participate in the program. According to testimony by the Secretary,  DHS developed the new VWP requirements in order to detect and  prevent travel by foreign terrorist fighters.
However, contrary to standard program management practices, DHS did  not establish time frames for instituting the new requirements. In October  2015, DHS officials confirmed that the department had not established  time frames for DHS’s consultations with each country or for instituting  the new requirements. Standard practices in program and project  management call for, among other things, developing a plan to execute  specific projects needed to obtain defined results within a specified time  frame. Time frames for working with VWP countries to institute the  requirement to implement the HSPD-6 arrangements and PCSC  agreements could help DHS ensure that countries meet all legal criteria  for participating in the VWP—including the December 2015 law requiring  them to fully implement their agreements—and could help DHS protect  against threats to the United States or its citizens.
section_title: DHS Has Evaluated Effects of VWP Countries’ Participation on U.S. Interests but Has Not Provided Required Reports to Congress on a Timely Basis
paragraphs: Our analysis of a nongeneralizable sample of 12 internal VWPO  evaluation reports on VWP countries found that VWPO assessed the  effect of the countries’ participation in the program on U.S. law  enforcement and security interests, including immigration enforcement, as  required by federal law. However, almost one-quarter of DHS’s most  recent reports to Congress regarding whether VWP countries should  continue to participate in the program were submitted, or remained  outstanding, 5 or more months after the dates when DHS had determined  that, under U.S. law, they were due. As a result, Congress may lack  timely information that it needs to conduct oversight of the VWP.
subsections: section_title: Sampled Internal Evaluations of VWP Countries Addressed U.S. Law Enforcement and Security Interests, Including Immigration Enforcement
paragraphs: The internal VWPO evaluation reports for 12 countries that we reviewed  showed that, for each of these countries, VWPO assessed the effect of  the country’s participation in the program on U.S. law enforcement and  security interests, including immigration enforcement, as required by U.S.  law. The law states, among other things, that DHS, in consultation with  State, must periodically evaluate the effect of each VWP country’s  continued participation in the program on U.S. law enforcement and  security interests, including immigration enforcement interests. VWPO  standard operating procedures lay out steps for conducting, and for  reporting internally on, VWPO’s evaluations of VWP countries, which it  uses to prepare the required DHS reports to Congress.
For the 12 countries, VWPO completed 10 internal evaluation reports  after a site visit to the relevant VWP country and completed 2 reports on  the basis of desk-based, administrative reviews. In the 12 reports, the  required sections on law enforcement interests and security interests,  including immigration enforcement interests, had been updated from  previous evaluations of the VWP country. The reports showed that VWPO  consulted broadly with relevant U.S. agency officials, both in Washington,  D.C., and at overseas posts and also consulted with relevant foreign  VWP country officials to gather information about law enforcement  interests, security interests, and immigration enforcement interests.  Moreover, according to U.S. officials and VWP country officials whom we  spoke with overseas, VWPO’s site visits, including questionnaires sent to  countries beforehand, were generally thorough and complete and  addressed the topic of foreign terrorist fighters.
section_title: DHS Has Not Consistently Submitted Required Reports about Visa Waiver Program Countries on a Timely Basis to Support Congressional Oversight
paragraphs: Our review showed that almost a quarter of DHS’s most recent reports to  Congress about VWP countries were submitted 5 or more months after  the dates when, according to DHS, they were due under U.S. law. U.S.  law requires DHS to submit a written report to Congress for each VWP  country not less than once every 2 years. Each report must provide  DHS’s determination of whether the country’s participation in the program  should be continued or terminated as well as an explanation of any  effects of the country’s continued participation on U.S. law enforcement  and security interests, including immigration enforcement interests.  Because of DHS’s inconsistency in submitting the reports within the  required statutory time frame, Congress may lack access to timely  information needed for its oversight of the VWP.
DHS’s timeliness in reporting to Congress about VWP countries has  improved since 2011, when we found that the department had not  completed half of its recent VWP congressional reports in a timely  manner and that many of the reports were more than a year past due.  Nonetheless, our current analysis shows that as of October 31, 2015, 28  of DHS’s 38 most recent congressional reports on VWP countries had  been submitted, or remained outstanding, 1 or more months after the due  dates. Nine of those reports were 5 or more months past due, including 2  that were past due by more than a year (see fig. 2).
section_title: Conclusions
paragraphs: Since its establishment in 1986, the VWP has evolved to address U.S.  national security and law enforcement interests while allowing travelers  from VWP countries to contribute significantly to the U.S. economy. Most  recently, the Visa Waiver Program Improvement and Terrorist Travel  Prevention Act of 2015 included changes to the program—including  requiring VWP countries to fully implement their agreements—that may  help prevent foreign terrorist fighters from attempting to exploit it to travel  to this country. U.S. agencies have used information that some VWP  countries have shared under the required agreements or their equivalents  to mitigate this and other threats to U.S. interests. However, because  many VWP countries have not yet provided information through the  agreements—possibly including information about known or suspected  terrorists—agencies’ access to this critical information may be limited.  Time frames for instituting the new requirement that VWP countries fully  implement the information-sharing agreements could help strengthen  DHS’s ability to protect against threats to the security of the United States  and its citizens.
The VWPO internal reports that we reviewed showed that DHS has  evaluated the effect of VWP countries’ participation in the program on  U.S. security and law enforcement interests, as required by law. DHS has  also improved the timeliness of its required reports to Congress about the  effects of VWP countries’ participation in the program on U.S. interests  and its determinations of countries’ eligibility to continue in the program.  Nonetheless, DHS’s inconsistency in submitting its congressional reports  by the statutory deadlines may have limited Congress’s access to  information needed for conducting oversight of the VWP and identifying  any modifications to the program necessary to protect U.S. law  enforcement and national security interests.
section_title: Recommendations for Executive Action
paragraphs: To strengthen DHS’s ability to fulfill legislative requirements for the VWP  and protect the security of the United States and its citizens, we are  making the following two recommendations to the Secretary of Homeland  Security:
Specify time frames for working with VWP countries to institute the  additional VWP security requirements, including the requirement that  the countries fully implement agreements to share information about  known or suspected terrorists through the countries’ HSPD-6  arrangements and PCSC agreements with the United States.
Take steps to improve DHS’s timeliness in reporting to Congress,  within the statutory time frame, the department’s determination of  whether each VWP country should continue participating in the  program and any effects of the country’s participation on U.S. law  enforcement and security interests.
section_title: Agency Comments
paragraphs: We provided a draft of the classified report to DHS, DOJ, and State for  their review and comment. DHS and DOJ provided technical comments,  which we incorporated as appropriate. DHS also provided written  comments, which are reproduced in appendix II. In its written comments,  DHS concurred with both of our recommendations. In addition, DHS  noted that it had begun taking steps to address our first recommendation  and was planning actions to address our second recommendation.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date.  At that time, we will send copies to the appropriate  congressional committees, the Secretary of Homeland Security, the  Secretary of State, and the Attorney General of the United States.  In  addition, the report will be available at no charge on the GAO website at  http://www.gao.gov.
If you or your staff have any questions concerning this report, please  contact Michael J. Courts at (202) 512-8980 or courtsm@gao.gov.  Contact points for our Offices of Congressional Relations and Public  Affairs may be found on the last page of this report. GAO staff who made  key contributions to this report are listed in appendix III.
section_title: Appendix I: Scope and Methodology
paragraphs: To determine whether Visa Waiver Program (VWP) countries have  entered into the required Lost and Stolen Passport (LASP) agreements,  Homeland Security Presidential Directive 6 (HSPD-6) arrangements, and  Preventing and Combating Serious Crime (PCSC) agreements, we  analyzed data provided by the Department of Homeland Security (DHS)  and interviewed officials from DHS and the Department of State (State) in  Washington, D.C. We also reviewed supporting documentation from DHS  and State, such as diplomatic notes, letters of intent, and memorandums  of understanding, that indicate whether countries entered into the  agreements. To identify the information-sharing requirements, we  reviewed relevant U.S. law and DHS policy. In addition, to better  understand what each agreement entailed and to learn of any associated  challenges, we interviewed officials from the agencies that are  responsible for negotiating each agreement. We determined that the  information we obtained was sufficiently reliable for our purposes.
To determine the extent to which VWP countries have implemented LASP  agreements, HSPD-6 arrangements, and PCSC agreements, or their  equivalents, we analyzed data from DHS and the Department of Justice  (DOJ) showing the status of, and information sharing through, the signed  agreements and arrangements. We also visited four VWP countries:  Belgium, Greece, France, and Spain. We selected these countries from  among the 38 VWP countries on the basis of numerous factors—in  particular, high estimated total and per capita numbers of foreign fighters  and concerns about border security and counterterrorism capacity. In  these four countries, we interviewed U.S. and VWP country officials  responsible for implementing the agreements and arrangements to  understand challenges associated with the countries’ sharing information  with the United States.
LASP agreements. To examine VWP countries’ sharing of information  about lost and stolen passports, we reviewed data provided by DHS  and INTERPOL for calendar years 2014 and 2015. We also discussed  with DHS officials their level of engagement with VWP countries  regarding the timeliness of their information sharing under the LASP  agreement. Although we discussed the DHS and INTERPOL data  with DHS and DOJ officials, we did not interview officials of all VWP  countries that report through INTERPOL. DOJ officials described their  uses and checks of the data they received. We determined that the  DHS and INTERPOL data were sufficiently reliable for placing the  reporting countries in broad categories that indicate the relative  frequency with which they report to INTERPOL but were not  sufficiently reliable for determining the countries’ compliance with the  VWP requirement to report lost and stolen passports. We did not  independently verify the legal status of each VWP country’s LASP  agreement.
HSPD-6 arrangements. To examine VWP countries’ information  sharing through HSPD-6 arrangements, we reviewed information that  we received from the Federal Bureau of Investigation (FBI) about  VWP countries’ provision of information through these arrangements  or their equivalents. When we encountered anomalies in the  information we received, we discussed and resolved them with  agency officials. We discussed the data with DOJ officials but did not  interview officials of all VWP countries that report to the Terrorist  Screening Center. DOJ officials described their uses and checks of  the data they received but stated that they did not formally study the  accuracy of the underlying data. We determined that the FBI data we  received were sufficiently reliable for placing the reporting countries in  broad categories that indicate the relative volume and frequency of  their reporting of information to the Terrorist Screening Center through  HSPD-6 arrangements or their equivalents. We did not independently  verify the legal status of each VWP country’s HSPD-6 arrangement.
PCSC agreements. To examine VWP countries’ information sharing  through PCSC agreements, as well as the mechanisms that VWP  countries have established for sharing information through the  agreements, we reviewed information and data that DHS and DOJ  provided. We discussed the data with DOJ officials but did not  interview VWP country officials regarding the data. DOJ officials  described their uses and checks of the data they received but stated  that they did not formally study the data’s accuracy. We determined  that the data were sufficiently reliable to place countries into broad  categories that indicate the relative frequency with which they shared  information. We did not independently verify the legal status of each  VWP country’s PCSC agreement.
In addition, to determine the extent to which U.S. agencies have been  able to use the shared information to address U.S. law enforcement and  security interests, we reviewed U.S. agency data and documents  reporting the agencies’ use of information shared through the  agreements. We also discussed the value and utility of information  obtained through the agreements with U.S. law enforcement and  counterterrorism officials in the United States and in the countries where  we conducted our fieldwork. We determined that the information and data  provided were sufficiently reliable for the purposes of this report.
To determine the extent to which DHS has evaluated VWP countries’  effect on U.S. security and law enforcement interests, including  immigration enforcement, we selected and analyzed a nongeneralizable  sample of 12 internal DHS reports evaluating VWP countries. We  selected these reports on the basis of a number of factors chosen to  identify countries where concerns might exist regarding foreign terrorist  fighters traveling to the United States—for example, high estimated  numbers of foreign terrorist fighters; border security and counterterrorism  capacity concerns; a high number of ESTA denials; number of travelers to  the United States, including the percentage that traveled under the VWP;  relative population size (e.g., large or small); date of entry into the VWP  (i.e., pre-2000, 2001-2010, 2010-the present); geographic variation (e.g.,  Western Europe, Eastern Europe, the Asia Pacific region); and status of  VWP information-sharing agreements as characterized by U.S. agencies  (i.e., whether agreements had been signed, were ratified, and were in  force and whether sharing had occurred). We used a data collection  instrument developed in consultation with a methodological expert to  analyze the nongeneralizable sample of 12 internal DHS reports. We also  reviewed relevant U.S. agency documents and guidance, such as  VWPO’s January 2015 “Visa Waiver Program Continuing Designation  Country Reviews Standard Operating Procedures.” In addition, we  interviewed U.S. agency and VWP country officials regarding the  processes for conducting the evaluations and communicating results of  the evaluations to VWP countries.
To determine the extent to which DHS has submitted required reports  about VWP countries to Congress, we collected and analyzed information  from DHS that documented the due dates and actual delivery dates to  Congress for DHS’s most recent VWP congressional reports. To assess  DHS’s timeliness in submitting the required reports to Congress since  2011, when we last reviewed the VWP, we compared the results of our  current analysis with our 2011 findings on DHS’s timeliness in submitting  the reports. In addition, we interviewed VWPO officials regarding the  process they use to prepare the reports and submit them to Congress.  We determined that the information we obtained was sufficiently reliable  for our purposes.
We conducted this performance audit from October 2014 to January 2016  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: Comments from the Department of Homeland Security
paragraphs: .
section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
paragraphs: Michael J. Courts, (202) 512-8980 or courtsm@gao.gov.
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Hynek Kalkus (Assistant  Director), Ian Ferguson, Brandon Hunt, Reid Lowe, and Christal Ann  Simanski made key contributions to this report. Ashley Alley, Kathryn  Bernet, Jose Cardenas, Martin De Alteriis, and Ozzy Trevino also  provided assistance.